[miticcantonija]

Component and requirement IDs

• Component: Platform.Identity, Platform.Api, frontend
• Requirements: IDN-01 – Account Registration
• Author(s): Antonija Mitić, Nina Buđen, Milica Dukić, Anđela Javor, Jovana Boljanović

Changes

• Implemented domain models, enums and contracts for account registration.
• Added PostgreSQL persistence using Entity Framework Core and database migrations.
• Implemented account registration with email validation, password hashing and duplicate email protection.
• Added administrator-only endpoint POST /api/admin/accounts.
• Integrated authorization through Platform.Access and the CreateAccountPolicy.
• Implemented React administrator form for account creation.
• Added NUnit integration tests using Testcontainers PostgreSQL.
• Integrated Identity module into Platform.Api and resolved merge conflicts with main.

Verification

• dotnet build backend/Platform.Api/Platform.Api.csproj – passed.
• GitHub Actions backend CI – passed.
• GitHub Actions frontend CI – passed.
• PostgreSQL migration successfully applied.
• Verified unique email index in the database.
• Verified duplicate account response (409 Conflict).
• Automated tests cover registration, validation and duplicate email scenarios.

Architecture and data flow

• Administrator enters an email and temporary password in the React form.
• Frontend sends a POST request to /api/admin/accounts.
• API checks authorization through Platform.Access.
• Authorized requests are forwarded to AccountRegistrationService.
• ASP.NET Core Identity validates credentials and hashes the password.
• Entity Framework Core persists the account in PostgreSQL.
• API returns the appropriate HTTP response (201, 400, 401, 403 or 409).

Security checks and negative tests

• Passwords are hashed using ASP.NET Core Identity.
• Minimum password length is 12 characters.
• Email addresses are normalized and validated.
• Unique email constraint prevents duplicate accounts.
• Archived account identifiers cannot be reused.
• Concurrent registrations are covered by an integration test.
• Invalid email and weak password cases are covered by tests.
• Password is excluded from command string representations.
• Frontend clears the password after submission and does not store it in localStorage.
• Account creation requires server-side administrator authorization.
• Development authentication is temporary; production authentication depends on IDN-02.

Dependencies

• .NET 10 and ASP.NET Core Identity
• Entity Framework Core and PostgreSQL
• Platform.Access – authorization and access policies
• Platform.Audit – shared API integration
• NUnit and Testcontainers.PostgreSql – integration testing
• React, TypeScript and Vite – frontend
• IDN-02 – future production authentication and session handling