SmartSchool

Context

A personal project built to go deeper into backend API development: layered architecture, versioning, robust authentication and testing. The API covers a school's domain — students, teachers, courses and subjects.

The challenge

Design a stable and secure API: versioning that does not break consumers (V1/V2), JWT authentication with rotating refresh tokens, consistent input validation, soft delete to preserve history and a CI pipeline that runs tests on every push.

Role and responsibilities

• REST API in ASP.NET Core 10 with CRUD endpoints for students, teachers, courses and subjects
• JWT authentication with rotating refresh tokens via ASP.NET Core Identity, with login rate limiting
• API versioning (deprecated V1 / active V2) and Swagger documentation
• Input validation with FluentValidation and Problem Details errors (RFC 7807)
• Unit and integration tests with xUnit, NSubstitute and WebApplicationFactory
• Containerization with Docker and free deployment on Render

Stack and architecture

.NET 10, EF Core 10 + SQLite, ASP.NET Core Identity, JwtBearer, Mapster, FluentValidation, Swashbuckle, xUnit + NSubstitute; Docker and GitHub Actions for CI

Highlights

• Rotating refresh tokens with revocation of the old token
• Soft delete on resources to preserve history
• V1/V2 versioning without breaking existing consumers
• Test coverage across authentication, authorization and CRUD

Takeaways

Managing sessions with refresh tokens, versioning an API without breaking clients and writing integration tests that actually boot the API transformed my backend approach: secure, testable and with a reliable release cycle.