Development

Adding a flow

1. Add a page under the relevant Components/ area (Authentication/, Password/, Profile/, TwoFactor/).
2. Add backend calls to the matching service (AuthService, UserService, PasswordService, TwoFactorService) through the "IdentityApi" HttpClient so Polly resilience applies.
3. Validate inputs with FluentValidation; surface strength feedback via PasswordStrengthIndicator.

Tokens and sessions

TokenStorageService stores tokens under the keys from the Authentication section; ISessionRefreshService refreshes before expiry (TokenExpirationBufferMinutes). Use SessionExpirationHandler to react to session loss in the UI.

Resilience and logging

The "IdentityApi" client is configured with Polly retry + circuit breaker. Serilog provides structured logging - keep new backend calls on the named client to inherit both.

Testing

...UnitTests (21 files): bUnit page tests for each auth/password/profile/2FA page and service tests for AuthService, UserService, PasswordService, TwoFactorService. See the repo docs/Testing.md for coverage details.

See also

• Features
• Configuration