.NET 10 FSH Starter Kit is Almost there!

[iammukeshm]

Lately, I've been investing quite a lot of hours to revive the FSH .NET Starter Kit project, and upgrade it to the latest and greatest .NET 10!

---

🚀 Cool Features Included

Core Framework (.NET 10)

• Vertical Slice Architecture — Features organized by domain concern with self-contained command/query/endpoint per slice
• Modular System — Drop-in modules via IModule interface with automatic DI registration and endpoint mapping
• CQRS with Mediator — Source-generated Mediator library (not MediatR) for commands/queries with validation pipeline behaviors
• Specification Pattern — Strongly-typed, composable query objects with filtering, includes, ordering, and projections
• DDD Primitives — AggregateRoot, BaseEntity, domain events, soft delete, and audit interfaces baked in

Pre-Built Modules (NuGet-Ready)

• Identity Module — ASP.NET Identity with JWT + refresh tokens, roles/permissions RBAC, user search, profile images, email confirmation, password reset
• Multitenancy Module — Finbuckle-powered tenant isolation, per-tenant databases, provisioning workflows, tenant themes, status tracking
• Auditing Module — Security events, exception logging, activity tracking with queryable endpoints and correlation ID filtering

Building Blocks

• Persistence — EF Core 10 with PostgreSQL (primary) + SQL Server support, domain event interceptors, multi-tenant DbContexts
• Caching — Redis distributed cache with in-memory fallback
• Jobs — Hangfire with PostgreSQL/in-memory storage, outbox dispatcher, telemetry filters
• Mailing — MailKit/MimeKit SMTP integration
• Storage — Local filesystem + AWS S3 providers
• Eventing — Integration events with outbox/inbox pattern for reliable messaging

API & Web

• Minimal APIs — Clean endpoint extensions with versioning (/api/v1/...)
• OpenAPI/Scalar — Auto-generated API docs with Bearer auth transformer
• Rate Limiting — Fixed window rate limiting for auth endpoints
• Security Headers — CSP, HSTS, X-Frame-Options, and more
• CORS — Configurable origin policies

Observability

• OpenTelemetry — Distributed tracing, metrics, and logs with OTLP export
• Serilog — Structured logging with correlation ID, span, environment, and process enrichers
• Health Checks — /health/ready, /health/live, /health/detailed endpoints

Infrastructure

• .NET Aspire — Local orchestration spinning up PostgreSQL + Redis containers automatically
• Terraform Modules — AWS ECS/Fargate, RDS PostgreSQL, ElastiCache Redis, ALB, S3 templates
• OpenAPI Client Generation — NSwag-based C# client generation scripts with drift detection for CI

Blazor UI

• MudBlazor 8.15 — Modern component library integration
• Reusable Components — FshPageHeader, FshUserProfile, FshPagination, FshTable, theme picker, dialogs
• Per-Tenant Theming — Customizable colors, fonts, and styles per tenant
• SSR Support — Cookie-based auth for server-side rendering with token refresh

---

📋 Backlog Items

Security Enhancements

• Multi-Factor Authentication (MFA/2FA) — TOTP, SMS, or authenticator app support
• OAuth2/SAML Federation — External identity provider integration (Google, Azure AD, Okta)
• IP Whitelisting — Restrict access by IP ranges
• API Key Authentication — Alternative auth for service-to-service calls

Eventing & Messaging

• Distributed Event Bus — RabbitMQ/Azure Service Bus/AWS SQS adapters (currently in-memory only)
• Saga/Compensation Pattern — Distributed transaction orchestration
• Event Sourcing — Full event-sourced aggregate support

Testing

• Unit Test Suite — Service and handler unit tests
• Integration Tests — API endpoint integration testing with TestContainers
• Blazor Component Tests — bUnit testing for UI components
• Load/Performance Tests — k6 or NBomber scripts

Frontend/Blazor

• Real-Time Notifications — SignalR hub for live updates
• Offline Support — PWA capabilities with service workers
• Dark Mode — System-aware theme switching
• Localization — Multi-language support with resource files

DevOps & Operations

• Feature Flags — LaunchDarkly or custom feature toggle system
• A/B Testing Framework — Experiment infrastructure
• Metrics Dashboard — Grafana templates for OpenTelemetry metrics
• Database Encryption — Transparent data encryption configuration

Documentation

• Rebuild the documentation website
• Video Tutorials — Getting started and advanced scenarios
• Sample Applications — E-commerce, CRM, and SaaS examples

Additional Modules (Planned)

• Notifications Module — Email, SMS, push notification orchestration
• File Management Module — Document upload, versioning, and preview
• Workflow Module — Simple approval/state machine workflows
• Reporting Module — Report generation and scheduling

[fcantenot]

Great job @iammukeshm !

[ugumerie]

Already using parts of the .net 9 version upgraded to .net 10, great job @iammukeshm

[kallievz]

Great job sir...

Latest got a Redis issue it seems: Timeout on Runtime.

RedisConnectionException: SocketClosed (ReadEndOfStream, 0-read, last-recv: 0) on localhost:64593/Interactive, Flushed/MarkProcessed, last: ECHO, origin: ReadFromPipe, outstanding: 13, last-read: 0s ago, last-write: 0s ago, unanswered-write: 0s ago, keep-alive: 60s, state: ConnectedEstablishing, mgr: 10 of 10 available, last-heartbeat: never, global: 0s ago, v: 2.7.27.49176

[kallievz]

On the DDD Primatives, PK options in ef, can it be dynamic eg : Guid, Long or Int?
On Mailing, Perhaps the Fluent which will cater for SendGrid and SMTP
UI, Maui hybrid with Web? So to enable mobile and offline support on both web and mobile/desktop?

[kallievz]

TenantTheme could be a good option to use Finbuckle.MultiTenant.Options -> https://www.finbuckle.com/MultiTenant/Docs/v10.0.1/Options, could be more like tenant configuration then.

[Duelbat]

This is going to be a game changer. Happy to front up $50.00 and challenge everyone else to do same. This project is not trivial and needs compensation. Well done. 👍✅

[iammukeshm]

Thanks a lot! Do let me know if you have some feature suggestions!

[kallievz]

@iammukeshm , what is the idea behind Groups? Is it to organize users? If so, need to add a check if users linked to group prior to deleting, or is there cascading in effect? I like the idea of it. Could extent when linking user to have optional expiry then. So like a temp admin for a week. After that, user is expired from group, with all associated permissions.

[dsolteszopyn]

Keycloak would be great for auth.