Until now, anyone who knows the Kladde's address can read, change and delete all the contacts. For a practice app on your own machine that was fine. Once the Kladde is on the internet in module 2.9, it no longer is. In this module the Kladde gets a sign-in and permissions: the public appointment booking stays open, only signed-in people see everything else, and some things only the office manager may do.

The module has six lessons and an exam:

  1. This lesson: how a web app remembers who is signed in, with cookies and claims.
  2. The real sign-in with Microsoft Entra ID over OpenID Connect.
  3. Roles and policies, and denying as the normal case.
  4. Every permission decision backed by a test.
  5. Forged forms, injected script and security headers.
  6. The OWASP Top 10, the most important risks of web apps, walked through on the Kladde.

In this lesson you first build a small sign-in to try out and watch exactly what travels back and forth between the browser and the server. After that the Kladde gets an internal area and a sign-in that exists only on your machine.

Where the Kladde stands

This module builds on the state after module 2.7. In the solutions, the Kladde looks like this:

Kladde.slnx, global.json, Directory.Build.props
src/
  Kladde.Core/      model and rules: Contact, Appointment, free times, Result<T>, IKladdeStore
  Kladde.Data/      KladdeDbContext and the store with EF Core
  Kladde.Files/     the JSON store from K1, now only for the console (lesson 2.3.1)
  Kladde.Web/       Program.cs, the API under /api (ContactEndpoints, AppointmentEndpoints), BookingOptions,
                    Components/ with the pages: public home and appointment booking (/appointment),
                    internal under Pages/Internal/ (contacts, appointments, week calendar) with the InternalLayout
  Kladde.Console/   the console from K1
tests/
  Kladde.Core.Tests/
  Kladde.Console.Tests/
  Kladde.Data.Tests/ mapping, seed and store with EF Core (module 2.4)
  Kladde.Web.Tests/  unit and integration tests with WebApplicationFactory<Program>, component tests
  Kladde.EndToEnd/   the end-to-end test of the booking with Playwright

If your files, classes, folders or addresses have different names, keep your names and carry the steps over. That isn't a mistake.

This module's exercises are file-based apps again, this time in the folder k2-practice/2-6 next to the Kladde's repository.