86d9879a6d
feat(expense): add MonthlyStatementService with server-side recompute + tests
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-29 18:34:39 -07:00
d9289008f6
feat(expense): add ExpenseService with state machine + receipt storage + tests
...
TDD: wrote 8 tests first (red), then implemented IExpenseService + ExpenseService
covering CRUD, Draft→PendingApproval→Approved→Paid state machine, soft-delete,
per-owner access guards, and receipt blob round-trip via IFileStorage.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-29 18:28:38 -07:00
015f689d9b
feat(expense): add ExpenseCategoryService + tests
...
TDD cycle: wrote 3 xUnit tests first (red), then implemented
IExpenseCategoryService + ExpenseCategoryService (green).
2026-05-29 18:24:07 -07:00
e7bf07c2ad
feat(storage): add IFileStorage + local-disk implementation
...
Adds IFileStorage abstraction and LocalDiskFileStorage for receipt file storage with path-traversal protection, and registers it in DI. Includes 3 TDD-verified xUnit tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-29 18:18:28 -07:00
f6f06d841c
feat(ministry): add Ministry entity, seed (10), and read endpoint
2026-05-29 18:03:28 -07:00
a573179714
feat(giving): match giver member name in single-giving search (spec §4.2)
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-28 17:24:47 -07:00
86041c0d05
fix(giving): map duplicate-date race to 409 + return zelle/paypal refs in session detail
2026-05-28 16:53:24 -07:00
e04776460d
feat(giving): offering-session batch service with server-side totals + locking
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-28 16:47:19 -07:00
2b6f29e775
feat(giving): single-entry giving service with paging + lock guard
...
Adds GivingListItemDto, GivingDto, CreateGivingRequest, UpdateGivingRequest DTOs;
IGivingService interface; GivingService implementation with category/date filtering,
OfferingSession lock guard (Submitted/Reconciled), and DI registration in Program.cs.
Covered by 4 xUnit tests (TDD: red → green).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-28 16:38:32 -07:00
cb15d30980
refactor(giving): drop unused accessor from category service + add deactivate-missing test
2026-05-28 16:33:27 -07:00
798dfa3fe0
feat(giving): giving-category service with CRUD + soft-disable
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-28 16:29:31 -07:00
a525c71baa
WIP
2026-05-28 15:25:31 -07:00
e83fa4c2e9
fix: use RandomNumberGenerator for cryptographic temp password generation
...
Replaced `new Random()` with `RandomNumberGenerator.GetInt32()` and a
Fisher-Yates shuffle to ensure temp passwords are cryptographically secure.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-27 14:29:26 -07:00
3ab0998793
feat: add UserManagementService with temp-password creation and deactivation
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-27 14:08:50 -07:00
bfffdee2a8
feat: add MemberService with soft-delete and paged search
...
Implements IMemberService with Create/Read/Update/soft-Delete operations,
NickName/zh-name search, status and hasUser filtering, and full xUnit coverage
(11 tests). Uses separate user-lookup query for InMemory DB compatibility; detaches
entity after soft-delete so query-filter assertions work correctly in tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-27 14:00:59 -07:00
2aa095c158
Task 11: Smoke test fixes (all 5 scenarios pass)
...
TokenService.GenerateRefreshToken():
- Switched to URL-safe Base64 (RFC 4648 §5): +→-, /→_, no = padding.
- Characters are unreserved per RFC 6265, so Response.Cookies.Append
does NOT percent-encode the value. Request.Cookies reads back exact value.
AuthController:
- CookieOptions.Secure = !env.IsDevelopment()
Plain HTTP in local dev works; HTTPS-only in staging/production.
- Inject IWebHostEnvironment for environment-aware Secure flag.
TokenServiceTests:
- Updated GenerateRefreshToken test: 86-char URL-safe Base64 instead
of 64-byte standard Base64. 16/16 tests pass.
Smoke test results (http://localhost:5209 ):
1. POST /api/auth/login → 200 + rolac_rt cookie + JWT
2. POST /api/auth/refresh → 200 + new token (rotation)
3. POST /api/auth/logout → 204 + cookie cleared
4. Refresh with revoked token → 401
5. Wrong password → 401
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-26 19:28:20 -07:00
9db8b34181
Task 6: AuthService + 9 unit tests (16/16 pass)
...
- IAuthService: LoginAsync / RefreshAsync / LogoutAsync
- AuthService: refresh-token rotation, hashed storage, LastLoginAt update
- AuthServiceTests: 5 login + 3 refresh + 1 logout tests via Moq + EF InMemory
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-26 17:38:56 -07:00
f74563bb36
Task 5: TokenService + unit tests (7/7 pass)
...
- ITokenService: GenerateAccessToken / GenerateRefreshToken / HashToken
- TokenService: JWT (HS256, 15-min), 64-byte CSPRNG refresh, SHA-256 hex hash
- Role claims use short JWT name role (v7.x JsonWebTokenHandler compatible)
- TokenServiceTests: 7 xUnit tests, payload decoded via Base64Url+System.Text.Json
to avoid Microsoft.IdentityModel 7.1.2/7.5.2 version-mismatch issues
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-26 17:34:56 -07:00
Chris Chen