JWT Authorization API

A .NET Web API that demonstrates role based authorization with JSON Web Tokens (JWT). Users authenticate with email and password, receive a signed token that carries their role, and the token controls which employee (Funcionario) endpoints they can call.

Tech stack

• C# on .NET 7
• ASP.NET Core Web API with controllers
• JWT bearer authentication (Microsoft.AspNetCore.Authentication.JwtBearer)
• Entity Framework Core 7 with SQL Server (LocalDB)
• AutoMapper for request to entity mapping
• Swagger / OpenAPI (Swashbuckle) for interactive documentation

What it does

• Authenticates an employee by email and password and returns a signed JWT (POST /api/Autenticacao).
• Signs tokens with HMAC SHA-512 and embeds the employee name, email and role as claims. Tokens expire five minutes after issue.
• Protects the employee endpoints with role based policies using three roles: Funcionario, Gerente and Administrador.
• Exposes CRUD endpoints for employees:
  • GET /api/Funcionario and GET /api/Funcionario/{id}: any of the three roles.
  • POST /api/Funcionario and PUT /api/Funcionario/{id}: Gerente or Administrador.
  • DELETE /api/Funcionario/{id}: Administrador only.
• Ships EF Core migrations that create the schema and seed the three roles plus one sample user per role.
• Serves a Swagger UI with a Bearer token input so requests can be tested from the browser.

Roles and seeded users

The initial data migration inserts three roles and one sample account for each. The passwords below come from the seed migration and are for local testing only.

Role	Email	Password
Funcionario	funcionario@glass.com.br	funcionario123
Gerente	gerente@glass.com.br	gerente123
Administrador	adm@glass.com.br	adm123

Getting started

Requirements: the .NET 7 SDK and a SQL Server LocalDB instance (the default connection string points at (localdb)\MSSQLLocalDB).

git clone https://github.com/nicolasfvp/jwt-authorization-api.git
cd jwt-authorization-api/ExercicioSemana2

# create the database from the EF Core migrations
dotnet tool install --global dotnet-ef
dotnet ef database update

# run the API
dotnet run

With the development profile the API listens on http://localhost:5197 and https://localhost:7240, and the Swagger UI is available at /swagger.

Typical flow:

1. Call POST /api/Autenticacao with a JSON body { "email": "...", "senha": "..." } to get a token.
2. Send that token as an Authorization: Bearer <token> header on the employee endpoints.

Configuration

Database connection and JWT settings live in ExercicioSemana2/appsettings.json under ConnectionStrings:ServerConnection and the Jwt section (Issuer, Audience, Key). Replace the sample signing key before using this anywhere other than a local machine.

Project structure

ExercicioSemana2/
  Controllers/   Authentication and employee endpoints
  Services/      Token generation (ITokenService, TokenService)
  Models/        Funcionario and Permissao entities
  Dto/           Request and login payloads
  Context/       EF Core DbContext
  Migrations/    Schema and seed data

Status

Personal study project built while learning JWT authentication and authorization in ASP.NET Core. The project folder and namespace keep their original name, ExercicioSemana2.

License

Released under the MIT License. See the LICENSE file.