OnlineEdu

Full-stack e-learning platform with role-based access, JWT auth, and 18-controller REST API

A full-stack online education platform built with ASP.NET Core 8.0, featuring a RESTful API backend and MVC frontend. Designed as a portfolio project to demonstrate modern .NET development skills including clean architecture, JWT authentication, role-based authorization, and Entity Framework Core.

---

Screenshots

Admin Panel, Course Listings, Blog, Teacher Profiles, and Student Dashboard are all responsive and theme-consistent.

---

Features

• Role-based access control — Admin, Teacher, Student roles with fine-grained endpoint permissions
• JWT + Cookie authentication — API uses Bearer tokens; WebUI uses secure HttpOnly cookies
• Course management — CRUD, category filtering, homepage visibility toggle, video modules
• Blog system — Category-based blog posts with author profiles
• Teacher profiles — Social media links, course assignments
• Student enrollment — Course registration, duplicate check, "My Courses" view
• Admin panel — Full CRUD for all entities, role assignment, message/subscriber management
• Testimonials, banners, about, contact — Full CMS-style content management
• Swagger UI — Interactive API documentation in development
• AutoMapper — DTO-based clean separation between API and domain models
• FluentValidation — Input validation layer

---

Tech Stack

Backend

Technology	Purpose
ASP.NET Core 8.0 Web API	RESTful API layer
ASP.NET Core 8.0 MVC	Server-rendered frontend
Entity Framework Core 8.0	ORM with code-first migrations
ASP.NET Core Identity	User/role management
JWT Bearer Authentication	Stateless API auth
AutoMapper 13.0	DTO <-> Entity mapping
FluentValidation 11.9	Request validation
Swashbuckle 6.6 (Swagger)	API documentation

Database

Technology	Purpose
Microsoft SQL Server	Primary data store
EF Core Migrations	Schema versioning
Lazy Loading Proxies	Navigation property loading

Frontend

Technology	Purpose
ASP.NET Core MVC Razor	Templated views
Bootstrap / HTML/CSS	Responsive layout
Cookie Authentication	Session management
HttpClient + TokenHandler	API consumption with auth

---

Architecture

OnlineEduMaster/
├── OnlineEdu.API/              # REST API — controllers, mappings, extensions
│   ├── Controllers/            # 18 controllers covering all domain entities
│   ├── Mapping/                # AutoMapper profiles (Entity <-> DTO)
│   └── Extensions/             # Service registration (DI setup)
│
├── OnlineEdu.WebUI/            # MVC Web Application
│   ├── Controllers/            # Public-facing pages (Home, Course, Blog, etc.)
│   ├── Areas/
│   │   ├── Admin/              # Admin panel (full CRUD, role management)
│   │   ├── Teacher/            # Teacher dashboard
│   │   └── Student/            # Student portal
│   ├── Views/                  # Razor views
│   ├── ViewComponents/         # Reusable view components
│   ├── Services/               # HttpClient wrappers for API calls
│   └── Helpers/                # TokenHandler (JWT injection into HttpClient)
│
├── OnlineEdu.Businnes/         # Business Logic Layer
│   ├── Abstract/               # Service interfaces (IGenericService<T>, etc.)
│   ├── Concrete/               # Service implementations (Managers + JwtService)
│   ├── Configurations/         # JwtTokenOptions config model
│   └── Validators/             # FluentValidation + CustomIdentityErrorDescriber
│
├── OnlineEdu.DataAcces/        # Data Access Layer
│   ├── Abstract/               # Repository interfaces
│   ├── Concrete/               # Repository implementations
│   ├── Context/                # OnlineEduContext (IdentityDbContext)
│   └── Migrations/             # EF Core migrations
│
├── OnlineEdu.Entity/           # Domain Models
│   └── Entities/               # AppUser, Course, Blog, CourseRegister, etc.
│
└── OnlineEdu.DTO/              # Data Transfer Objects
    └── DTOs/                   # Create/Update/Result DTOs per entity

Design Patterns Used

• Repository Pattern — IRepository<T> / GenericRepository<T>
• Generic Service Pattern — IGenericService<T> / GenericManager<T>
• DTO Pattern — Separate Create/Update/Result DTOs for each entity
• Decorator Pattern — TokenHandler as DelegatingHandler for HttpClient
• Options Pattern — JwtTokenOptions via IOptions<T>
• Area-based routing — Admin / Teacher / Student separated by MVC Areas

---

Domain Model

AppUser (Identity)
 ├── Courses[]          → teaches (Teacher role)
 ├── CourseRegisters[]  → enrolled in (Student role)
 ├── Blogs[]            → authored by
 └── TeacherSocials[]   → social media links

Course
 ├── CourseCategory
 ├── AppUser (Teacher)
 ├── CourseRegisters[]
 └── CourseVideos[]

Blog
 ├── BlogCategory
 └── AppUser (Writer)

---

API Endpoints (Selected)

Method	Endpoint	Auth	Description
POST	/api/users/login	Public	Login, returns JWT
POST	/api/users/register	Public	Register as Student
GET	/api/users/TeacherList	Public	All teachers
GET	/api/users/Get4Teachers	Public	Last 4 teachers with socials
GET	/api/courses	Public	All courses with categories
GET	/api/courses/GetActiveCourses	Public	Homepage courses
GET	/api/courses/GetCoursesByCategoryId/{id}	Public	Courses by category
POST	/api/courses	Admin/Teacher	Create course
DELETE	/api/courses/{id}	Admin/Teacher	Delete course
GET	/api/courseregisters/GetMyCourses/{userId}	Authenticated	Student's enrolled courses
POST	/api/courseregisters	Authenticated	Enroll in course
GET	/api/roles	Admin	List all roles
POST	/api/roleassigns	Admin	Assign roles to user
GET	/api/blogs	Public	All blogs with categories
GET	/api/blogs/GetLast4Blogs	Public	Latest 4 blog posts

Full API documentation available at /swagger when running in Development mode.

---

Getting Started

Prerequisites

• .NET 8.0 SDK
• SQL Server (LocalDB / Express / Full)
• Visual Studio 2022+ or VS Code

Setup

1. Clone the repository

   git clone https://github.com/yourusername/OnlineEduMaster.git
   cd OnlineEduMaster

2. Configure the database connection

   Edit OnlineEdu.API/appsettings.json and OnlineEdu.WebUI/appsettings.json:

   "ConnectionStrings": {
     "SqlConnection": "Server=YOUR_SERVER;Database=OnlineEduDB;Integrated Security=true;TrustServerCertificate=true"
   }

3. Set your JWT secret via environment variable (recommended for production)

   # On Windows
   setx TokenOptions__Key "your-very-long-secret-key-min-32-chars"
   
   # On Linux/macOS
   export TokenOptions__Key="your-very-long-secret-key-min-32-chars"

4. Apply database migrations

   cd OnlineEdu.API
   dotnet ef database update

5. Seed initial data (optional)

   # Run the seed script against your database
   sqlcmd -S YOUR_SERVER -d OnlineEduDB -E -i seed_data.sql

6. Run the API

   cd OnlineEdu.API
   dotnet run
   # API runs on https://localhost:7071
   # Swagger: https://localhost:7071/swagger

7. Run the Web UI

   cd OnlineEdu.WebUI
   dotnet run
   # Web UI runs on https://localhost:7070

---

Authentication Flow

WebUI Login Form
      │
      ▼
POST /api/users/login (JSON credentials)
      │
      ▼
API: Validates credentials via ASP.NET Core Identity
      │
      ▼
API: Issues JWT (claims: userId, email, username, fullName, roles)
      │
      ▼
WebUI: Stores JWT inside HttpOnly cookie "OnlineEduJwt"
      │
      ▼
WebUI: TokenHandler extracts JWT from cookie → adds Bearer header on each API call

---

Security

• Passwords hashed by ASP.NET Core Identity (PBKDF2)
• JWT signed with HMAC-SHA256
• Cookies: HttpOnly=true, SameSite=Strict, Secure=Always
• RequireHttpsMetadata disabled only in Development
• Role-based authorization on all mutation endpoints
• EF Core parameterized queries (no raw SQL injection surface)

Note for production: Move JWT key and connection strings to environment variables or a secrets manager (Azure Key Vault, AWS Secrets Manager, etc.). Never commit secrets to source control.

---

Project Highlights

This project demonstrates proficiency in:

• N-tier clean architecture with clear separation of concerns (Entity → DataAccess → Business → API → WebUI)
• Generic Repository + Service pattern — write once, use for all entities
• Dual authentication strategy — JWT for stateless API, Cookie for stateful MVC UI
• ASP.NET Core Identity with custom user/role classes and Turkish error messages
• AutoMapper for clean DTO mappings without leaking domain models to API consumers
• EF Core — code-first migrations, lazy loading, LINQ queries with complex includes
• MVC Areas for logical separation of Admin / Teacher / Student panels
• HttpClient factory with custom DelegatingHandler for transparent auth header injection
• FluentValidation for decoupled input validation

---

License

This project is for educational and portfolio purposes.

---

Built with ASP.NET Core 8.0 — demonstrating modern .NET full-stack development