Sla (#11)

Co-authored-by: gorbenko.pavel <gorbenko.pavel@tansu.kz>
Reviewed-on: http://git.tnsu.kz/gorbenko.pavel/tnsu-approval-route/pulls/11

backend/Tnsu.ApprovalRoute.Api/Auth/AuthSchemes.cs

@@ -0,0 +1,30 @@
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+
+namespace Tnsu.ApprovalRoute.Api.Auth;
+
+public static class AuthSchemes
+{
+    /// <summary>Локальная разработка и тесты — Entra не настроен (см. AuthSetup).</summary>
+    public const string Dev = "Dev";
+
+    /// <summary>Токен пользователя (делегированный) — обычная работа админки.</summary>
+    public const string Bearer = JwtBearerDefaults.AuthenticationScheme;
+
+    /// <summary>
+    /// Токен приложения (client_credentials) — вызовы без участия пользователя,
+    /// например Power Automate, который по расписанию забирает напоминания.
+    /// </summary>
+    public const string AppOnly = "AppOnly";
+}
+
+public static class AuthPolicies
+{
+    /// <summary>Только пользовательские токены.</summary>
+    public const string Delegated = "Delegated";
+
+    /// <summary>Только токены приложений.</summary>
+    public const string AppOnly = "AppOnlyPolicy";
+
+    /// <summary>Любой из двух — политика по умолчанию для всех контроллеров.</summary>
+    public const string Any = "AnyAuth";
+}

backend/Tnsu.ApprovalRoute.Api/Auth/AuthSetup.cs

@@ -0,0 +1,150 @@
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Tnsu.ApprovalRoute.Api.Auth;
+
+public static class AuthSetup
+{
+    /// <summary>
+    /// Две схемы аутентификации вместо одной: помимо пользовательского токена
+    /// (админка) API должен принимать токен ПРИЛОЖЕНИЯ — эндпоинт напоминаний
+    /// вызывает Power Automate по расписанию, там нет ни пользователя, ни
+    /// интерактивного входа.
+    ///
+    /// Сделано по образцу api-tnsu-portal/AuthRegistration.cs, включая настройки
+    /// Entra — приложение регистрируется то же самое.
+    /// </summary>
+    public static IServiceCollection AddApprovalRouteAuth(this IServiceCollection services, IConfiguration configuration)
+    {
+        var tenantId = configuration["Entra:TenantId"];
+        var audience = configuration["Entra:Audience"];
+
+        if (!string.IsNullOrWhiteSpace(tenantId) && !string.IsNullOrWhiteSpace(audience))
+            AddEntraAuth(services, configuration, tenantId, audience);
+        else
+            AddDevAuth(services);
+
+        return services;
+    }
+
+    private static void AddEntraAuth(
+        IServiceCollection services, IConfiguration configuration, string tenantId, string audience)
+    {
+        // Белый список приложений, которым разрешён app-only доступ. Пустой список
+        // означает «не ограничивать» — иначе на пустой конфигурации сломались бы
+        // вообще все app-only вызовы, что при выкладке выглядит как необъяснимый 401.
+        var allowedAppIds = configuration.GetSection("Entra:AllowedAppIds").Get<string[]>() ?? [];
+
+        var validationParameters = () => new TokenValidationParameters
+        {
+            ValidAudiences = [audience, $"api://{audience}"],
+            ValidIssuers =
+            [
+                $"https://login.microsoftonline.com/{tenantId}/v2.0",
+                $"https://sts.windows.net/{tenantId}/"
+            ],
+            ValidateIssuer = true,
+            ValidateAudience = true,
+            ValidateLifetime = true
+        };
+
+        services.AddAuthentication(options =>
+            {
+                options.DefaultAuthenticateScheme = AuthSchemes.Bearer;
+                options.DefaultChallengeScheme = AuthSchemes.Bearer;
+            })
+            .AddJwtBearer(AuthSchemes.Bearer, options =>
+            {
+                options.Authority = $"https://login.microsoftonline.com/{tenantId}/v2.0";
+                options.TokenValidationParameters = validationParameters();
+                // Без этого JwtBearerHandler переименовывает короткие имена claim'ов
+                // из токена в длинные ClaimTypes-URI (upn → ClaimTypes.Upn,
+                // unique_name → ClaimTypes.Name — а НЕ ClaimTypes.Email!) ещё до
+                // того, как код увидит ClaimsPrincipal. CurrentUserAccessor ищет
+                // ровно сырые имена ("upn", "unique_name") — с ремаппингом они не
+                // совпадали ни с чем, и email инициатора не находился вообще
+                // (не только у токенов без claim'а email, как этот — у ЛЮБЫХ).
+                options.MapInboundClaims = false;
+            });
+
+        services.AddAuthentication()
+            .AddJwtBearer(AuthSchemes.AppOnly, options =>
+            {
+                options.Authority = $"https://login.microsoftonline.com/{tenantId}/v2.0";
+                options.TokenValidationParameters = validationParameters();
+                options.MapInboundClaims = false;
+                options.Events = new JwtBearerEvents
+                {
+                    // Подпись, издатель и аудитория у app-only токена те же, что у
+                    // пользовательского, поэтому единственное, что реально отличает
+                    // «свой» вызывающий сервис от любого приложения тенанта, — appid.
+                    OnTokenValidated = context =>
+                    {
+                        var claims = context.Principal?.Claims;
+                        var appId = claims?.FirstOrDefault(c => c.Type == "appid")?.Value
+                                    ?? claims?.FirstOrDefault(c => c.Type == "azp")?.Value;
+
+                        if (allowedAppIds.Length > 0 && !allowedAppIds.Contains(appId))
+                        {
+                            context.HttpContext.RequestServices
+                                .GetRequiredService<ILoggerFactory>()
+                                .CreateLogger("Auth.AppOnly")
+                                .LogWarning("Приложение «{AppId}» отклонено — его нет в Entra:AllowedAppIds", appId);
+                            context.Fail($"Приложение «{appId}» не входит в список разрешённых.");
+                        }
+
+                        return Task.CompletedTask;
+                    }
+                };
+            });
+
+        services.AddAuthorization(options =>
+        {
+            options.AddPolicy(AuthPolicies.Delegated, policy =>
+            {
+                policy.AuthenticationSchemes.Add(AuthSchemes.Bearer);
+                policy.RequireAuthenticatedUser();
+            });
+
+            options.AddPolicy(AuthPolicies.AppOnly, policy =>
+            {
+                policy.AuthenticationSchemes.Add(AuthSchemes.AppOnly);
+                policy.RequireAuthenticatedUser();
+            });
+
+            // RequireAssertion, а не RequireAuthenticatedUser: политика с двумя
+            // схемами падает, если ОДНА из них отвергла токен, даже когда вторая
+            // его приняла. Здесь достаточно, чтобы аутентифицировала любая.
+            options.AddPolicy(AuthPolicies.Any, policy =>
+            {
+                policy.AddAuthenticationSchemes(AuthSchemes.Bearer, AuthSchemes.AppOnly);
+                policy.RequireAssertion(ctx => ctx.User.Identities.Any(i => i.IsAuthenticated));
+            });
+
+            options.DefaultPolicy = options.GetPolicy(AuthPolicies.Any)!;
+        });
+    }
+
+    private static void AddDevAuth(IServiceCollection services)
+    {
+        services.AddAuthentication(AuthSchemes.Dev)
+            .AddScheme<AuthenticationSchemeOptions, DevAuthHandler>(AuthSchemes.Dev, _ => { });
+
+        // Те же имена политик, но поверх Dev-схемы: иначе контроллер с
+        // [Authorize(Policy = ...)] падал бы локально с «политика не найдена».
+        services.AddAuthorization(options =>
+        {
+            foreach (var name in new[] { AuthPolicies.Delegated, AuthPolicies.AppOnly, AuthPolicies.Any })
+            {
+                options.AddPolicy(name, policy =>
+                {
+                    policy.AuthenticationSchemes.Add(AuthSchemes.Dev);
+                    policy.RequireAuthenticatedUser();
+                });
+            }
+
+            options.DefaultPolicy = options.GetPolicy(AuthPolicies.Any)!;
+        });
+    }
+}

backend/Tnsu.ApprovalRoute.Api/Auth/CurrentUserAccessor.cs

@@ -0,0 +1,13 @@
+using System.Security.Claims;
+using Tnsu.ApprovalRoute.Application.Common.Interfaces;
+
+namespace Tnsu.ApprovalRoute.Api.Auth;
+
+public sealed class CurrentUserAccessor(IHttpContextAccessor httpContextAccessor) : ICurrentUser
+{
+    public string? Email =>
+        httpContextAccessor.HttpContext?.User.FindFirstValue(ClaimTypes.Email)
+        ?? httpContextAccessor.HttpContext?.User.FindFirstValue("preferred_username")
+        ?? httpContextAccessor.HttpContext?.User.FindFirstValue("upn")
+        ?? httpContextAccessor.HttpContext?.User.FindFirstValue("unique_name");
+}

backend/Tnsu.ApprovalRoute.Api/Auth/DevAuthHandler.cs

@@ -0,0 +1,26 @@
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.Extensions.Options;
+
+namespace Tnsu.ApprovalRoute.Api.Auth;
+
+public sealed class DevAuthHandler(
+    IOptionsMonitor<AuthenticationSchemeOptions> options,
+    ILoggerFactory logger,
+    UrlEncoder encoder,
+    IConfiguration configuration)
+    : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
+{
+    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        var email = Request.Headers["X-Dev-User-Email"].FirstOrDefault()
+            ?? configuration["Dev:DefaultUserEmail"]
+            ?? "dev@tnsu.kz";
+
+        var identity = new ClaimsIdentity([new Claim(ClaimTypes.Email, email)], AuthSchemes.Dev);
+        var ticket = new AuthenticationTicket(new ClaimsPrincipal(identity), AuthSchemes.Dev);
+
+        return Task.FromResult(AuthenticateResult.Success(ticket));
+    }
+}

backend/Tnsu.ApprovalRoute.Api/Common/ApiResponse.cs

@@ -0,0 +1,5 @@
+namespace Tnsu.ApprovalRoute.Api.Common;
+
+public sealed record ApiResponse<T>(T Data);
+
+public sealed record ApiError(IReadOnlyList<string> Messages);

backend/Tnsu.ApprovalRoute.Api/Common/ResultExtensions.cs

@@ -0,0 +1,32 @@
+using FluentResults;
+using Microsoft.AspNetCore.Mvc;
+using Tnsu.ApprovalRoute.Application.Common.Errors;
+
+namespace Tnsu.ApprovalRoute.Api.Common;
+
+public static class ResultExtensions
+{
+    public static IActionResult ToActionResult<T>(this Result<T> result)
+    {
+        if (result.IsFailed)
+            return result.Errors[0].ToActionResult();
+
+        return new OkObjectResult(new ApiResponse<T>(result.Value));
+    }
+
+    public static IActionResult ToActionResult(this Result result)
+    {
+        if (result.IsFailed)
+            return result.Errors[0].ToActionResult();
+
+        return new NoContentResult();
+    }
+
+    private static IActionResult ToActionResult(this IError error) => error switch
+    {
+        NotFoundError => new NotFoundObjectResult(new ApiError([error.Message])),
+        ValidationError => new BadRequestObjectResult(new ApiError([error.Message])),
+        ConflictError => new ConflictObjectResult(new ApiError([error.Message])),
+        _ => new ObjectResult(new ApiError([error.Message])) { StatusCode = StatusCodes.Status500InternalServerError }
+    };
+}

backend/Tnsu.ApprovalRoute.Api/Controllers/RemindersController.cs

@@ -0,0 +1,26 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tnsu.ApprovalRoute.Api.Auth;
+using Tnsu.ApprovalRoute.Api.Common;
+using Tnsu.ApprovalRoute.Application.Reminders;
+
+namespace Tnsu.ApprovalRoute.Api.Controllers;
+
+/// <summary>
+/// Просроченные шаги согласования и исполнения на текущий момент.
+///
+/// Политика — та же AnyAuth, что и у остальных контроллеров: эндпоинт вызывает
+/// Power Automate по расписанию (токен приложения), но и из админки его удобно
+/// открыть под пользователем, чтобы посмотреть, что сервис реально отдаёт.
+/// </summary>
+[ApiController]
+[Authorize(Policy = AuthPolicies.Any)]
+[Route("api/reminders")]
+[Produces("application/json")]
+public sealed class RemindersController(ReminderService service) : ControllerBase
+{
+    [HttpGet]
+    [ProducesResponseType(typeof(ApiResponse<IReadOnlyList<ReminderDto>>), StatusCodes.Status200OK)]
+    public async Task<IActionResult> List(CancellationToken ct) =>
+        (await service.GetOverdueAsync(DateTimeOffset.UtcNow, ct)).ToActionResult();
+}

backend/Tnsu.ApprovalRoute.Api/Controllers/RequestTypesController.cs

@@ -0,0 +1,50 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tnsu.ApprovalRoute.Api.Common;
+using Tnsu.ApprovalRoute.Application.RequestTypes;
+
+namespace Tnsu.ApprovalRoute.Api.Controllers;
+
+[ApiController]
+[Authorize]
+[Route("api/request-types")]
+[Produces("application/json")]
+public sealed class RequestTypesController(RequestTypeService service) : ControllerBase
+{
+    [HttpGet]
+    [ProducesResponseType(typeof(ApiResponse<IReadOnlyList<RequestTypeDto>>), StatusCodes.Status200OK)]
+    public async Task<IActionResult> List(CancellationToken ct) =>
+        (await service.ListAsync(ct)).ToActionResult();
+
+    [HttpGet("{id:int}")]
+    [ProducesResponseType(typeof(ApiResponse<RequestTypeDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Get(int id, CancellationToken ct) =>
+        (await service.GetAsync(id, ct)).ToActionResult();
+
+    [HttpPost]
+    [ProducesResponseType(typeof(ApiResponse<RequestTypeDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status400BadRequest)]
+    public async Task<IActionResult> Create(CreateRequestTypeRequest body, CancellationToken ct) =>
+        (await service.CreateAsync(body, ct)).ToActionResult();
+
+    [HttpPut("{id:int}")]
+    [ProducesResponseType(typeof(ApiResponse<RequestTypeDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Update(int id, UpdateRequestTypeRequest body, CancellationToken ct) =>
+        (await service.UpdateAsync(id, body, ct)).ToActionResult();
+
+    [HttpPatch("{id:int}")]
+    [ProducesResponseType(typeof(ApiResponse<RequestTypeDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Patch(int id, PatchRequestTypeRequest body, CancellationToken ct) =>
+        (await service.PatchAsync(id, body, ct)).ToActionResult();
+
+    [HttpDelete("{id:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Delete(int id, CancellationToken ct) =>
+        (await service.DeleteAsync(id, ct)).ToActionResult();
+}

backend/Tnsu.ApprovalRoute.Api/Controllers/TemplateRouteStepsController.cs

@@ -0,0 +1,52 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tnsu.ApprovalRoute.Api.Common;
+using Tnsu.ApprovalRoute.Application.TemplateRouteSteps;
+
+namespace Tnsu.ApprovalRoute.Api.Controllers;
+
+[ApiController]
+[Authorize]
+[Route("api/template-routes/{routeId:int}/steps")]
+[Produces("application/json")]
+public sealed class TemplateRouteStepsController(TemplateRouteStepService service) : ControllerBase
+{
+    [HttpGet]
+    [ProducesResponseType(typeof(ApiResponse<IReadOnlyList<TemplateRouteStepDto>>), StatusCodes.Status200OK)]
+    public async Task<IActionResult> List(int routeId, CancellationToken ct) =>
+        (await service.ListAsync(routeId, ct)).ToActionResult();
+
+    [HttpGet("{id:int}")]
+    [ProducesResponseType(typeof(ApiResponse<TemplateRouteStepDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Get(int routeId, int id, CancellationToken ct) =>
+        (await service.GetAsync(routeId, id, ct)).ToActionResult();
+
+    [HttpPost]
+    [ProducesResponseType(typeof(ApiResponse<TemplateRouteStepDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Create(int routeId, CreateTemplateRouteStepRequest body, CancellationToken ct) =>
+        (await service.CreateAsync(routeId, body, ct)).ToActionResult();
+
+    [HttpPut("{id:int}")]
+    [ProducesResponseType(typeof(ApiResponse<TemplateRouteStepDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Update(int routeId, int id, UpdateTemplateRouteStepRequest body, CancellationToken ct) =>
+        (await service.UpdateAsync(routeId, id, body, ct)).ToActionResult();
+
+    [HttpPatch("{id:int}")]
+    [ProducesResponseType(typeof(ApiResponse<TemplateRouteStepDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Patch(int routeId, int id, PatchTemplateRouteStepRequest body, CancellationToken ct) =>
+        (await service.PatchAsync(routeId, id, body, ct)).ToActionResult();
+
+    [HttpDelete("{id:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Delete(int routeId, int id, CancellationToken ct) =>
+        (await service.DeleteAsync(routeId, id, ct)).ToActionResult();
+}

backend/Tnsu.ApprovalRoute.Api/Controllers/TemplateRoutesController.cs

@@ -0,0 +1,64 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tnsu.ApprovalRoute.Api.Common;
+using Tnsu.ApprovalRoute.Application.TemplateRoutes;
+
+namespace Tnsu.ApprovalRoute.Api.Controllers;
+
+[ApiController]
+[Authorize]
+[Route("api/template-routes")]
+[Produces("application/json")]
+public sealed class TemplateRoutesController(TemplateRouteService service) : ControllerBase
+{
+    // POST, а не GET: запрос принимает список условий (field_name/value) переменной длины,
+    // который не ложится на плоскую query-строку без индексной эквилибристики. Единственный
+    // потребитель — диагностический экран «Проверка маршрута» в админке, внешних вызовов нет.
+    [HttpPost("resolve")]
+    [ProducesResponseType(typeof(ApiResponse<ResolveTemplateRouteResultDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Resolve([FromBody] ResolveTemplateRouteRequest request, CancellationToken ct) =>
+        (await service.ResolveAsync(request, ct)).ToActionResult();
+
+    [HttpGet]
+    [ProducesResponseType(typeof(ApiResponse<IReadOnlyList<TemplateRouteDto>>), StatusCodes.Status200OK)]
+    public async Task<IActionResult> List([FromQuery] int? requestTypeId, CancellationToken ct) =>
+        (await service.ListAsync(requestTypeId, ct)).ToActionResult();
+
+    [HttpGet("{id:int}")]
+    [ProducesResponseType(typeof(ApiResponse<TemplateRouteDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Get(int id, CancellationToken ct) =>
+        (await service.GetAsync(id, ct)).ToActionResult();
+
+    [HttpPost]
+    [ProducesResponseType(typeof(ApiResponse<TemplateRouteDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Create(CreateTemplateRouteRequest body, CancellationToken ct) =>
+        (await service.CreateAsync(body, ct)).ToActionResult();
+
+    [HttpPut("{id:int}")]
+    [ProducesResponseType(typeof(ApiResponse<TemplateRouteDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Update(int id, UpdateTemplateRouteRequest body, CancellationToken ct) =>
+        (await service.UpdateAsync(id, body, ct)).ToActionResult();
+
+    [HttpPatch("{id:int}")]
+    [ProducesResponseType(typeof(ApiResponse<TemplateRouteDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Patch(int id, PatchTemplateRouteRequest body, CancellationToken ct) =>
+        (await service.PatchAsync(id, body, ct)).ToActionResult();
+
+    [HttpDelete("{id:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(typeof(ApiError), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> Delete(int id, CancellationToken ct) =>
+        (await service.DeleteAsync(id, ct)).ToActionResult();
+}

backend/Tnsu.ApprovalRoute.Api/Dockerfile

@@ -0,0 +1,21 @@
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+COPY Directory.Build.props Directory.Packages.props ./
+COPY Tnsu.ApprovalRoute.Domain/Tnsu.ApprovalRoute.Domain.csproj Tnsu.ApprovalRoute.Domain/
+COPY Tnsu.ApprovalRoute.Application/Tnsu.ApprovalRoute.Application.csproj Tnsu.ApprovalRoute.Application/
+COPY Tnsu.ApprovalRoute.Infrastructure/Tnsu.ApprovalRoute.Infrastructure.csproj Tnsu.ApprovalRoute.Infrastructure/
+COPY Tnsu.ApprovalRoute.Api/Tnsu.ApprovalRoute.Api.csproj Tnsu.ApprovalRoute.Api/
+RUN dotnet restore Tnsu.ApprovalRoute.Api/Tnsu.ApprovalRoute.Api.csproj
+COPY Tnsu.ApprovalRoute.Domain/ Tnsu.ApprovalRoute.Domain/
+COPY Tnsu.ApprovalRoute.Application/ Tnsu.ApprovalRoute.Application/
+COPY Tnsu.ApprovalRoute.Infrastructure/ Tnsu.ApprovalRoute.Infrastructure/
+COPY Tnsu.ApprovalRoute.Api/ Tnsu.ApprovalRoute.Api/
+RUN dotnet publish Tnsu.ApprovalRoute.Api/Tnsu.ApprovalRoute.Api.csproj -c Release -o /app/publish /p:UseAppHost=false
+
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS final
+WORKDIR /app
+RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
+COPY --from=build /app/publish .
+ENV ASPNETCORE_URLS=http://+:8080
+EXPOSE 8080
+ENTRYPOINT ["dotnet", "Tnsu.ApprovalRoute.Api.dll"]

backend/Tnsu.ApprovalRoute.Api/Filters/ValidationActionFilter.cs

@@ -0,0 +1,33 @@
+using FluentValidation;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Tnsu.ApprovalRoute.Api.Common;
+
+namespace Tnsu.ApprovalRoute.Api.Filters;
+
+public sealed class ValidationActionFilter(IServiceProvider serviceProvider) : IAsyncActionFilter
+{
+    public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
+    {
+        foreach (var argument in context.ActionArguments.Values)
+        {
+            if (argument is null)
+                continue;
+
+            var validatorType = typeof(IValidator<>).MakeGenericType(argument.GetType());
+            if (serviceProvider.GetService(validatorType) is not IValidator validator)
+                continue;
+
+            var validationContext = new ValidationContext<object>(argument);
+            var result = await validator.ValidateAsync(validationContext, context.HttpContext.RequestAborted);
+            if (result.IsValid)
+                continue;
+
+            context.Result = new BadRequestObjectResult(
+                new ApiError(result.Errors.Select(e => e.ErrorMessage).ToList()));
+            return;
+        }
+
+        await next();
+    }
+}

backend/Tnsu.ApprovalRoute.Api/Program.cs

@@ -0,0 +1,99 @@
+using System.Text.Json.Serialization;
+using Extensions.Hosting.AsyncInitialization;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.HttpOverrides;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.OpenApi;
+using Scalar.AspNetCore;
+using Tnsu.ApprovalRoute.Api.Auth;
+using Tnsu.ApprovalRoute.Api.Filters;
+using Tnsu.ApprovalRoute.Application;
+using Tnsu.ApprovalRoute.Application.Reminders;
+using Tnsu.ApprovalRoute.Application.Common.Interfaces;
+using Tnsu.ApprovalRoute.Infrastructure;
+
+const string CorsPolicyName = "Frontend";
+
+var builder = WebApplication.CreateBuilder(args);
+
+builder.Services.Configure<ForwardedHeadersOptions>(options =>
+{
+    options.ForwardedHeaders =
+        ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
+    
+    options.KnownNetworks.Clear();
+    options.KnownProxies.Clear();
+});
+
+var corsAllowedOrigins = builder.Configuration.GetSection("Cors:AllowedOrigins").Get<string[]>() ?? [];
+builder.Services.AddCors(options =>
+{
+    options.AddPolicy(CorsPolicyName, policy => policy
+        .WithOrigins(corsAllowedOrigins)
+        .AllowAnyHeader()
+        .AllowAnyMethod());
+});
+builder.Services.AddApprovalRouteInfrastructure(builder.Configuration);
+builder.Services.AddApprovalRouteApplication();
+builder.Services.Configure<RemindersOptions>(builder.Configuration.GetSection("Reminders"));
+builder.Services.AddApprovalRouteAuth(builder.Configuration);
+builder.Services.AddScoped<ICurrentUser, CurrentUserAccessor>();
+builder.Services.AddOpenApi(options =>
+{
+    options.AddDocumentTransformer((document, _, _) =>
+    {
+        document.Components ??= new OpenApiComponents();
+        document.Components.SecuritySchemes ??= new Dictionary<string, IOpenApiSecurityScheme>();
+        document.Components.SecuritySchemes["Bearer"] = new OpenApiSecurityScheme
+        {
+            Type = SecuritySchemeType.Http,
+            Scheme = "bearer",
+            BearerFormat = "JWT",
+            Description = "Введите JWT токен"
+        };
+        return Task.CompletedTask;
+    });
+    options.AddOperationTransformer((operation, context, _) =>
+    {
+        operation.Security =
+        [
+            new OpenApiSecurityRequirement
+            {
+                [new OpenApiSecuritySchemeReference("Bearer", context.Document)] = []
+            }
+        ];
+        return Task.CompletedTask;
+    });
+});
+builder.Services.AddHealthChecks();
+builder.Services.AddControllers(options => options.Filters.Add<ValidationActionFilter>())
+    .AddJsonOptions(o => o.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter()));
+builder.Services.ConfigureHttpJsonOptions(o => o.SerializerOptions.Converters.Add(new JsonStringEnumConverter()));
+
+var app = builder.Build();
+
+app.UseForwardedHeaders();
+
+app.MapOpenApi();
+
+app.MapScalarApiReference(options =>
+{
+    options
+        .WithTitle("Tnsu Approval Route")
+        .AddPreferredSecuritySchemes("Bearer")
+        .AddHttpAuthentication("Bearer", _ => { });
+});
+
+app.MapHealthChecks("/health");
+
+app.UseCors(CorsPolicyName);
+
+app.UseAuthentication();
+app.UseAuthorization();
+
+app.MapControllers();
+
+await app.InitAndRunAsync();
+
+public partial class Program;

backend/Tnsu.ApprovalRoute.Api/Properties/launchSettings.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "http": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": false,
+      "applicationUrl": "http://localhost:5080",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    },
+    "https": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": false,
+      "applicationUrl": "https://localhost:5443;http://localhost:5080",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

backend/Tnsu.ApprovalRoute.Api/Tnsu.ApprovalRoute.Api.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <ItemGroup>
+    <ProjectReference Include="..\Tnsu.ApprovalRoute.Application\Tnsu.ApprovalRoute.Application.csproj" />
+    <ProjectReference Include="..\Tnsu.ApprovalRoute.Infrastructure\Tnsu.ApprovalRoute.Infrastructure.csproj" />
+  </ItemGroup>
+  <ItemGroup>
+    <PackageReference Include="Extensions.Hosting.AsyncInitialization" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+    <PackageReference Include="Scalar.AspNetCore" />
+  </ItemGroup>
+</Project>

backend/Tnsu.ApprovalRoute.Api/appsettings.Development.json

@@ -0,0 +1,9 @@
+{
+  "Entra": {
+    "TenantId": "",
+    "Audience": ""
+  },
+  "ConnectionStrings": {
+    "Postgres": "Host=localhost;Port=5435;Database=tnsu_approval_route;Username=tnsu_approval_route;Password=tnsu_approval_route"
+  }
+}

backend/Tnsu.ApprovalRoute.Api/appsettings.json

@@ -0,0 +1,39 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "ConnectionStrings": {
+    "Postgres": "Host=db-master.tnsu.kz;Database=tnsu_approval_route;Username=dbuser;Password=p}{6{Pa]{JQwP1H"
+  },
+  "Entra": {
+    "TenantId": "b4c2af35-bfd6-4cff-9af9-556efb53e65a",
+    "Audience": "9232d9e2-9807-4753-808f-07250e5474b0",
+    "AllowedAppIds": []
+  },
+  "Dev": {
+    "DefaultUserEmail": "dev@tnsu.kz"
+  },
+  "Cors": {
+    "AllowedOrigins": [
+      "https://tnsukz.sharepoint.com",
+      "https://localhost:4321"
+    ]
+  },
+  "SharePoint": {
+    "TenantId": "b4c2af35-bfd6-4cff-9af9-556efb53e65a",
+    "ClientId": "9232d9e2-9807-4753-808f-07250e5474b0",
+    "CertificateSettingName": "AzurePfx",
+    "CertificatePassword": "Rk.xDjccnfyjdktybz1"
+  },
+  "TnsuPortal": {
+    "BaseUrl": "https://api.tnsu.kz",
+    "TenantId": "b4c2af35-bfd6-4cff-9af9-556efb53e65a",
+    "ClientId": "9232d9e2-9807-4753-808f-07250e5474b0",
+    "ClientSecret": "",
+    "Scope": "",
+    "DirectorTansuEmail": "a.samayeva@tnsu.kz"
+  }
+}