Indotalent Enterprise Kit Documentation

Authentication

Full-featured authentication with ASP.NET Core Identity, JWT access tokens with refresh token rotation, and optional Firebase SSO.

// 1. Login → POST /api/auth/login with email+password
// 2. Response returns: { token, refreshToken, expiresAt, user }
// 3. When access token expires → POST /api/auth/refresh
//    with { refreshToken } → new token pair (rotation)
// 4. Refresh token is hashed (SHA256) and stored in DB

Role-Based Authorization

Pre-configured roles: Guest, Member, and Admin. New users automatically receive the Guest role.

public static class ApplicationRoles
{
    public const string AdminConst  = "Admin";
    public const string MemberConst = "Member";
    public const string GuestConst  = "Guest";
}

SSO Firebase

Indotalent supports Firebase Single Sign-On (SSO) as an optional authentication method. When enabled, users can sign in using their Google account via Firebase Authentication. The Firebase configuration is stored in appsettings.json under the SsoFirebase section.

To enable Firebase SSO, configure the following in appsettings.json:

"SsoFirebase": {
    "IsUsed": true,
    "ProjectId": "xxx",
    "ApiKey": "xxx",
    "AuthDomain": "xxx.firebaseapp.com",
    "StorageBucket": "xxx.firebasestorage.app",
    "MessagingSenderId": "xxx",
    "AppId": "xxx"
}

Set "IsUsed": true to enable Firebase SSO. Replace the placeholder values (xxx) with your actual Firebase project credentials from the Firebase Console. Set "IsUsed": false to disable Firebase SSO and use only the built-in Identity authentication.

AutoNumber Generation

Entities implementing IHasAutoNumber get auto-generated codes like COMP-0001.

Background Jobs (Hangfire)

Hangfire with built-in dashboard at /hangfire (Admin only). Supports recurring, fire-and-forget, and delayed jobs.

Multi-Database

Switch between InMemory, SQL Server, and PostgreSQL with a single config change. The application supports three database providers — simply toggle "IsUsed" to switch between them.

Configure your database provider in appsettings.json under DatabaseSettings:

"DatabaseSettings": {
    // InMemory (default, no external DB needed)
    "InMemory": {
        "IsUsed": true,
        "ConnectionString": "IndotalentDb",
        "TimeoutInSeconds": 1800
    },
    // Microsoft SQL Server
    "MsSQL": {
        "IsUsed": false,
        "ConnectionString": "Server=localhost\\SQLEXPRESS;Database=MyDb;Trusted_Connection=True;TrustServerCertificate=True",
        "TimeoutInSeconds": 1800
    },
    // PostgreSQL
    "PostgreSQL": {
        "IsUsed": false,
        "ConnectionString": "Host=localhost;Database=MyDb;Username=postgres;Password=yourpassword",
        "TimeoutInSeconds": 1800
    }
}

To switch providers, set the desired provider's "IsUsed" to true and the others to false. Only one provider can be active at a time. Update the ConnectionString to match your database server credentials.

Demo Mode

Indotalent includes a Demo Mode feature that, when enabled, automatically seeds the database with dummy demo data on application startup. This is useful for testing, presentations, or evaluation purposes without needing to manually enter data.

Configure Demo Mode in appsettings.json:

"DemoMode": {
    "IsDemo": true
}

Set "IsDemo": true to enable Demo Mode — the application will seed dummy data (sample users, roles, and demo records) on every startup. Set "IsDemo": false to disable it and start with a clean database.

AI Chat

Indotalent includes an AI Chat feature that can be enabled by configuring your preferred AI provider's API key. The application supports multiple AI providers including ChatGPT, Claude, Gemini, and DeepSeek.

Configure AI Chat in appsettings.json under AiSettings:

"AiSettings": {
    // Choose your provider: "ChatGPT", "Claude", "Gemini", or "DeepSeek"
    "Provider": "ChatGPT",
    "ChatGPT": {
        "ApiKey": "sk-your-chatgpt-api-key",
        "Model": "gpt-4o"
    },
    "Claude": {
        "ApiKey": "sk-ant-your-claude-api-key",
        "Model": "claude-3-opus-20240229"
    },
    "Gemini": {
        "ApiKey": "your-gemini-api-key",
        "Model": "gemini-1.5-pro"
    },
    "DeepSeek": {
        "ApiKey": "your-deepseek-api-key",
        "Model": "deepseek-v4-flash"
    }
}

To enable AI Chat, set the "Provider" field to your chosen provider name and fill in the corresponding "ApiKey" with your actual API key from that provider. Leave the API keys empty to disable the AI Chat feature.

Email Delivery

Multi-provider email service supporting SendGrid, Mailgun, SMTP, and Mailjet. Toggle "IsUsed" to switch between providers.

Configure email delivery in appsettings.json under EmailSettings:

"EmailSettings": {
    // SendGrid
    "SendGrid": {
        "IsUsed": false,
        "ApiKey": "SG.your-sendgrid-api-key",
        "FromEmail": "noreply@email.com"
    },
    // Mailgun
    "Mailgun": {
        "IsUsed": false,
        "ApiKey": "key-your-mailgun-api-key",
        "Domain": "mg.yourdomain.com",
        "FromEmail": "noreply@email.com"
    },
    // Mailjet
    "Mailjet": {
        "IsUsed": false,
        "ApiKey": "mj-your-public-key",
        "ApiSecret": "mj-your-private-key",
        "FromEmail": "noreply@email.com"
    },
    // SMTP (default)
    "Smtp": {
        "IsUsed": true,
        "Host": "smtp.gmail.com",
        "Port": 465,
        "UserName": "your-email@gmail.com",
        "Password": "your-app-password",
        "FromAddress": "your-email@gmail.com",
        "FromName": "no-reply"
    }
}

To switch email providers, set the desired provider's "IsUsed" to true and the others to false. Only one provider can be active at a time. Fill in the API keys and credentials for your chosen provider.

File Upload / Download

File storage service supporting local file system with upload, download, delete operations.

Health Checks

Built-in health check endpoints, hardened for container probes (for example Docker or a load balancer), plus a System Monitoring dashboard at /Admin/HealthCheck/Index.

Endpoints

All probe endpoints are public (no authentication, no rate limiting) so orchestrators can call them without credentials. The response is never redirected to the error page: an unhealthy readiness check returns a raw 503, which is exactly what container probes observe.

Docker container probe (example)

A HEALTHCHECK that probes the readiness endpoint - only a 503 response marks the container unhealthy.

HEALTHCHECK --interval=30s --timeout=3s --start-period=30s --retries=3 \
    CMD curl -f http://localhost:80/health/ready || exit 1

curl must exist in the runtime image; orchestrators can alternatively point a readiness probe at /health/ready.

The dashboard also shows in-memory traffic metrics - see System Monitoring Dashboard (Ops Metrics) below.

System Monitoring Dashboard (Ops Metrics)

The Admin dashboard at /Admin/HealthCheck/Index shows the health cards plus an Application card, a rolling Traffic summary, and the most recent endpoints. It is fed by the Admin-only endpoint GET /api/ops/metrics.

Configure the rolling window in appsettings.json:

"OpsMetricsSettings": {
    "WindowMinutes": 5,
    "MaxBuckets": 10,
    "MaxRecentRequests": 200
}

The snapshot returned by /api/ops/metrics uses camelCase keys:

{
  "app": {
    "name", "version", "environment", "startedAtUtc", "uptimeSeconds"
  },
  "window": {
    "minutes", "totalRequests", "success", "errors", "errorRate",
    "avgMs", "p95Ms", "p99Ms",
    "byStatus": { "2xx", "3xx", "4xx", "5xx" }
  },
  "recent": [
    { "method", "path", "status", "durationMs", "timestampUtc" }
  ],
  "sinceStart": {
    "totalRequests", "success", "errors", "errorRate",
    "avgMs", "p95Ms", "p99Ms"
  }
}

• success counts 2xx responses; errors counts 5xx responses; latency is in milliseconds.
• P95/P99 are approximated from a bounded per-minute histogram, so memory stays flat under load.
• Health probes, static assets, and dashboard polls are excluded from the counts.
• Numbers reset whenever the web process restarts - the store is in-memory only.

OpenTelemetry (OTLP Export)

A vendor-neutral observability foundation that exports metrics and traces over OTLP. It is disabled by default: no exporter runs and no diagnostic listeners start until you set OpenTelemetrySettings:Enabled to true. The in-memory traffic recording for the System Monitoring dashboard always runs and is independent of this exporter.

NuGet packages

Configure OpenTelemetry in appsettings.json:

"OpenTelemetrySettings": {
    "Enabled": false,
    "Otlp": {
        "Endpoint": "",
        "Headers": ""
    }
}

• Both Enabled: true and a non-empty Otlp:Endpoint are required before any exporter starts.
• Exports the ASP.NET Core and HttpClient instrumentations plus the app meter Indotalent.Api with indotalent.api.requests, indotalent.api.errors, and indotalent.api.request.duration (tag http.response.status.family).
• The OTLP exporter defaults to the gRPC protocol, so a plain http://host:4317 endpoint works with configuration only.
• To use an HTTP/protobuf gateway, some telemetry backends publish an OTLP HTTP gateway endpoint - add otlp.Protocol = OtlpExportProtocol.HttpProtobuf; inside the AddOtlpExporter(...) call in Infrastructures/OpenTelemetry/DI.cs.
• The default service.name resource attribute is the assembly name (Indotalent) - use it to identify the application in your telemetry backend.

Logging (Serilog)

Structured logging with Serilog. Writes to rolling files with automatic 3-day cleanup via Hangfire.

Rate Limiting

Four rate limiting policies using System.Threading.RateLimiting, configurable via appsettings.json.

CORS (Cross-Origin Resource Sharing)

Browsers block cross-origin requests unless the server returns the appropriate CORS response headers. This project is a monolith - the frontend and the Web API are served from the same origin - so CORS is not needed today. The setting exists only to prepare for a future scenario where the Web API (/api/*) is consumed from a different domain (for example a separate SPA or a partner site). It is disabled by default, so there is zero behavior change and zero overhead until it is enabled.

Default configuration in appsettings.json:

"CorsSettings": {
    "IsUsed": false,
    "AllowedOrigins": [],
    "AllowedMethods": [],
    "AllowedHeaders": [],
    "ExposedHeaders": [],
    "AllowCredentials": false
}

Example - enabling access for one cross-origin single-page app:

"CorsSettings": {
    "IsUsed": true,
    "AllowedOrigins": [ "https://app.example.com" ],
    "AllowedMethods": [ "GET", "POST", "PUT", "DELETE" ],
    "AllowedHeaders": [ "Content-Type", "Authorization" ],
    "AllowCredentials": true
}

• IsUsed: false means no CORS service, no CORS middleware, and no CORS headers - the default.
• An empty AllowedOrigins (or one containing "*") allows any origin and cannot be combined with credentials.
• AllowCredentials is applied only when an explicit origin allow-list is configured.
• The policy is registered globally as the default policy, so it covers /api/* and the authentication endpoints.
• Override per environment in appsettings.Development.json or with the environment variable CorsSettings__IsUsed=true.
• After enabling, a request from an allowed origin returns Access-Control-Allow-Origin and the preflight OPTIONS request succeeds - verify in the browser DevTools Network tab or with curl -H "Origin: https://app.example.com" -i.