Initial commit: base slice (auth, roles, users, admin) scaffold

Backend: .NET 10 Clean Architecture + LiteCqrs.Net + EF Core/PostgreSQL +
Identity/JWT. Frontend: React 19 + Vite + TanStack Query/Router + Tailwind v4
with a retro CRT theme. Docker/compose deployment mirroring PnvPanel's
conventions, scoped down to the current base feature set.

backend/src/TeleWave.Application/Auth/AuthErrors.cs

@@ -0,0 +1,29 @@
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth;
+
+public static class AuthErrors
+{
+    public static readonly Error InvalidCredentials =
+        Error.Unauthorized("Auth.InvalidCredentials", "Неверное имя пользователя или пароль.");
+
+    public static readonly Error Unauthorized = Error.Unauthorized(
+        "Auth.Unauthorized",
+        "Требуется вход в систему."
+    );
+
+    public static readonly Error InvalidRefreshToken = Error.Unauthorized(
+        "Auth.InvalidRefreshToken",
+        "Сессия истекла, войдите заново."
+    );
+
+    public static readonly Error Blocked = Error.Forbidden(
+        "Auth.Blocked",
+        "Аккаунт заблокирован администратором."
+    );
+
+    public static readonly Error UserNameTaken = Error.Conflict(
+        "Auth.UserNameTaken",
+        "Это имя пользователя уже занято."
+    );
+}

backend/src/TeleWave.Application/Auth/AuthResult.cs

@@ -0,0 +1,11 @@
+namespace TeleWave.Application.Auth;
+
+public sealed record CurrentUserDto(Guid Id, string UserName, string Role);
+
+public sealed record AuthResult(
+    string AccessToken,
+    DateTimeOffset AccessTokenExpiresAt,
+    string RefreshToken,
+    DateTimeOffset RefreshTokenExpiresAt,
+    CurrentUserDto User
+);

backend/src/TeleWave.Application/Auth/ChangePassword/ChangePasswordCommand.cs

@@ -0,0 +1,6 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.ChangePassword;
+
+public sealed record ChangePasswordCommand(string CurrentPassword, string NewPassword) : ICommand<Result>;

backend/src/TeleWave.Application/Auth/ChangePassword/ChangePasswordCommandHandler.cs

@@ -0,0 +1,27 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.ChangePassword;
+
+public sealed class ChangePasswordCommandHandler(
+    IIdentityService identityService,
+    ICurrentUser currentUser
+) : ICommandHandler<ChangePasswordCommand, Result>
+{
+    public async Task<Result> Handle(
+        ChangePasswordCommand command,
+        CancellationToken cancellationToken
+    )
+    {
+        if (currentUser.UserId is not { } userId)
+            return Result.Failure(AuthErrors.Unauthorized);
+
+        return await identityService.ChangePasswordAsync(
+            userId,
+            command.CurrentPassword,
+            command.NewPassword,
+            cancellationToken
+        );
+    }
+}

backend/src/TeleWave.Application/Auth/ChangePassword/ChangePasswordCommandValidator.cs

@@ -0,0 +1,12 @@
+using FluentValidation;
+
+namespace TeleWave.Application.Auth.ChangePassword;
+
+public sealed class ChangePasswordCommandValidator : AbstractValidator<ChangePasswordCommand>
+{
+    public ChangePasswordCommandValidator()
+    {
+        RuleFor(x => x.CurrentPassword).NotEmpty();
+        RuleFor(x => x.NewPassword).NotEmpty().MinimumLength(8);
+    }
+}

backend/src/TeleWave.Application/Auth/ChangeUserName/ChangeUserNameCommand.cs

@@ -0,0 +1,6 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.ChangeUserName;
+
+public sealed record ChangeUserNameCommand(string NewUserName) : ICommand<Result>;

backend/src/TeleWave.Application/Auth/ChangeUserName/ChangeUserNameCommandHandler.cs

@@ -0,0 +1,26 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.ChangeUserName;
+
+public sealed class ChangeUserNameCommandHandler(
+    IIdentityService identityService,
+    ICurrentUser currentUser
+) : ICommandHandler<ChangeUserNameCommand, Result>
+{
+    public async Task<Result> Handle(
+        ChangeUserNameCommand command,
+        CancellationToken cancellationToken
+    )
+    {
+        if (currentUser.UserId is not { } userId)
+            return Result.Failure(AuthErrors.Unauthorized);
+
+        return await identityService.ChangeUserNameAsync(
+            userId,
+            command.NewUserName,
+            cancellationToken
+        );
+    }
+}

backend/src/TeleWave.Application/Auth/ChangeUserName/ChangeUserNameCommandValidator.cs

@@ -0,0 +1,11 @@
+using FluentValidation;
+
+namespace TeleWave.Application.Auth.ChangeUserName;
+
+public sealed class ChangeUserNameCommandValidator : AbstractValidator<ChangeUserNameCommand>
+{
+    public ChangeUserNameCommandValidator()
+    {
+        RuleFor(x => x.NewUserName).NotEmpty().MinimumLength(3).MaximumLength(64);
+    }
+}

backend/src/TeleWave.Application/Auth/DeleteMyAccount/DeleteMyAccountCommand.cs

@@ -0,0 +1,6 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.DeleteMyAccount;
+
+public sealed record DeleteMyAccountCommand : ICommand<Result>;

backend/src/TeleWave.Application/Auth/DeleteMyAccount/DeleteMyAccountCommandHandler.cs

@@ -0,0 +1,22 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.DeleteMyAccount;
+
+public sealed class DeleteMyAccountCommandHandler(
+    IIdentityService identityService,
+    ICurrentUser currentUser
+) : ICommandHandler<DeleteMyAccountCommand, Result>
+{
+    public async Task<Result> Handle(
+        DeleteMyAccountCommand command,
+        CancellationToken cancellationToken
+    )
+    {
+        if (currentUser.UserId is not { } userId)
+            return Result.Failure(AuthErrors.Unauthorized);
+
+        return await identityService.DeleteUserAsync(userId, cancellationToken);
+    }
+}

backend/src/TeleWave.Application/Auth/Login/LoginCommand.cs

@@ -0,0 +1,6 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.Login;
+
+public sealed record LoginCommand(string UserName, string Password) : ICommand<Result<AuthResult>>;

backend/src/TeleWave.Application/Auth/Login/LoginCommandHandler.cs

@@ -0,0 +1,50 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.Login;
+
+public sealed class LoginCommandHandler(
+    IIdentityService identityService,
+    IJwtTokenService jwtTokenService,
+    IRefreshTokenService refreshTokenService
+) : ICommandHandler<LoginCommand, Result<AuthResult>>
+{
+    public async Task<Result<AuthResult>> Handle(
+        LoginCommand command,
+        CancellationToken cancellationToken
+    )
+    {
+        var credentialsResult = await identityService.ValidateCredentialsAsync(
+            command.UserName,
+            command.Password,
+            cancellationToken
+        );
+        if (!credentialsResult.IsSuccess)
+            return Result.Failure<AuthResult>(credentialsResult.Error);
+
+        var user = credentialsResult.Value;
+        var profile = await identityService.GetProfileAsync(user.Id, cancellationToken);
+        if (profile is null)
+            return Result.Failure<AuthResult>(AuthErrors.InvalidCredentials);
+
+        if (profile.IsBlocked)
+            return Result.Failure<AuthResult>(AuthErrors.Blocked);
+
+        var (accessToken, accessExpiresAt) = jwtTokenService.GenerateAccessToken(
+            new AuthenticatedUser(profile.Id, profile.UserName, profile.Role)
+        );
+        var refreshToken = await refreshTokenService.IssueAsync(profile.Id, cancellationToken);
+
+        var dto = new CurrentUserDto(profile.Id, profile.UserName, profile.Role);
+        return Result.Success(
+            new AuthResult(
+                accessToken,
+                accessExpiresAt,
+                refreshToken.RawToken,
+                refreshToken.ExpiresAt,
+                dto
+            )
+        );
+    }
+}

backend/src/TeleWave.Application/Auth/Login/LoginCommandValidator.cs

@@ -0,0 +1,12 @@
+using FluentValidation;
+
+namespace TeleWave.Application.Auth.Login;
+
+public sealed class LoginCommandValidator : AbstractValidator<LoginCommand>
+{
+    public LoginCommandValidator()
+    {
+        RuleFor(x => x.UserName).NotEmpty();
+        RuleFor(x => x.Password).NotEmpty();
+    }
+}

backend/src/TeleWave.Application/Auth/Logout/LogoutCommand.cs

@@ -0,0 +1,6 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.Logout;
+
+public sealed record LogoutCommand(string RawToken) : ICommand<Result>;

backend/src/TeleWave.Application/Auth/Logout/LogoutCommandHandler.cs

@@ -0,0 +1,15 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.Logout;
+
+public sealed class LogoutCommandHandler(IRefreshTokenService refreshTokenService)
+    : ICommandHandler<LogoutCommand, Result>
+{
+    public async Task<Result> Handle(LogoutCommand command, CancellationToken cancellationToken)
+    {
+        await refreshTokenService.RevokeAsync(command.RawToken, cancellationToken);
+        return Result.Success();
+    }
+}

backend/src/TeleWave.Application/Auth/Me/GetCurrentUserQuery.cs

@@ -0,0 +1,6 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.Me;
+
+public sealed record GetCurrentUserQuery : IQuery<Result<CurrentUserDto>>;

backend/src/TeleWave.Application/Auth/Me/GetCurrentUserQueryHandler.cs

@@ -0,0 +1,26 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.Me;
+
+public sealed class GetCurrentUserQueryHandler(
+    IIdentityService identityService,
+    ICurrentUser currentUser
+) : IQueryHandler<GetCurrentUserQuery, Result<CurrentUserDto>>
+{
+    public async Task<Result<CurrentUserDto>> Handle(
+        GetCurrentUserQuery query,
+        CancellationToken cancellationToken
+    )
+    {
+        if (currentUser.UserId is not { } userId)
+            return Result.Failure<CurrentUserDto>(AuthErrors.Unauthorized);
+
+        var profile = await identityService.GetProfileAsync(userId, cancellationToken);
+        if (profile is null)
+            return Result.Failure<CurrentUserDto>(AuthErrors.Unauthorized);
+
+        return Result.Success(new CurrentUserDto(profile.Id, profile.UserName, profile.Role));
+    }
+}

backend/src/TeleWave.Application/Auth/Refresh/RefreshCommand.cs

@@ -0,0 +1,6 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.Refresh;
+
+public sealed record RefreshCommand(string RawToken) : ICommand<Result<AuthResult>>;

backend/src/TeleWave.Application/Auth/Refresh/RefreshCommandHandler.cs

@@ -0,0 +1,44 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.Refresh;
+
+public sealed class RefreshCommandHandler(
+    IRefreshTokenService refreshTokenService,
+    IIdentityService identityService,
+    IJwtTokenService jwtTokenService
+) : ICommandHandler<RefreshCommand, Result<AuthResult>>
+{
+    public async Task<Result<AuthResult>> Handle(
+        RefreshCommand command,
+        CancellationToken cancellationToken
+    )
+    {
+        var rotated = await refreshTokenService.RotateAsync(command.RawToken, cancellationToken);
+        if (!rotated.IsSuccess)
+            return Result.Failure<AuthResult>(rotated.Error);
+
+        var profile = await identityService.GetProfileAsync(
+            rotated.Value.UserId,
+            cancellationToken
+        );
+        if (profile is null || profile.IsBlocked)
+            return Result.Failure<AuthResult>(AuthErrors.Unauthorized);
+
+        var (accessToken, accessExpiresAt) = jwtTokenService.GenerateAccessToken(
+            new AuthenticatedUser(profile.Id, profile.UserName, profile.Role)
+        );
+
+        var dto = new CurrentUserDto(profile.Id, profile.UserName, profile.Role);
+        return Result.Success(
+            new AuthResult(
+                accessToken,
+                accessExpiresAt,
+                rotated.Value.RawToken,
+                rotated.Value.ExpiresAt,
+                dto
+            )
+        );
+    }
+}

backend/src/TeleWave.Application/Auth/Register/RegisterCommand.cs

@@ -0,0 +1,6 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.Register;
+
+public sealed record RegisterCommand(string UserName, string Password) : ICommand<Result<AuthResult>>;

backend/src/TeleWave.Application/Auth/Register/RegisterCommandHandler.cs

@@ -0,0 +1,46 @@
+using LiteCqrs;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+
+namespace TeleWave.Application.Auth.Register;
+
+public sealed class RegisterCommandHandler(
+    IIdentityService identityService,
+    IJwtTokenService jwtTokenService,
+    IRefreshTokenService refreshTokenService
+) : ICommandHandler<RegisterCommand, Result<AuthResult>>
+{
+    public async Task<Result<AuthResult>> Handle(
+        RegisterCommand command,
+        CancellationToken cancellationToken
+    )
+    {
+        var createResult = await identityService.CreateUserAsync(
+            command.UserName,
+            command.Password,
+            cancellationToken
+        );
+        if (!createResult.IsSuccess)
+            return Result.Failure<AuthResult>(createResult.Error);
+
+        var profile = await identityService.GetProfileAsync(createResult.Value, cancellationToken);
+        if (profile is null)
+            return Result.Failure<AuthResult>(AuthErrors.Unauthorized);
+
+        var (accessToken, accessExpiresAt) = jwtTokenService.GenerateAccessToken(
+            new AuthenticatedUser(profile.Id, profile.UserName, profile.Role)
+        );
+        var refreshToken = await refreshTokenService.IssueAsync(profile.Id, cancellationToken);
+
+        var dto = new CurrentUserDto(profile.Id, profile.UserName, profile.Role);
+        return Result.Success(
+            new AuthResult(
+                accessToken,
+                accessExpiresAt,
+                refreshToken.RawToken,
+                refreshToken.ExpiresAt,
+                dto
+            )
+        );
+    }
+}

backend/src/TeleWave.Application/Auth/Register/RegisterCommandValidator.cs

@@ -0,0 +1,12 @@
+using FluentValidation;
+
+namespace TeleWave.Application.Auth.Register;
+
+public sealed class RegisterCommandValidator : AbstractValidator<RegisterCommand>
+{
+    public RegisterCommandValidator()
+    {
+        RuleFor(x => x.UserName).NotEmpty().MinimumLength(3).MaximumLength(64);
+        RuleFor(x => x.Password).NotEmpty().MinimumLength(8);
+    }
+}