A backend-focused ASP.NET Core Web API that implements a secure, role-based document approval workflow with JWT authentication, state-based business rules, and full audit logging.
This project is designed to demonstrate real-world backend architecture rather than simple CRUD functionality.
Many internal organizations require a system where:
- Users submit documents
- Reviewers verify them
- Admins make final approval or rejection
- Every action is tracked
- Unauthorized access is prevented
SecureDocs models this as a strict backend-enforced workflow.
- JWT-based authentication
- Role-based access (User, Reviewer, Admin)
- Roles embedded in JWT claims
- Stateless and scalable
Documents move through controlled states:
Draft → Submitted → InReview → Approved / Rejected
Invalid transitions are blocked at the service layer.
| Role | Capabilities |
|---|---|
| User | Create and submit documents |
| Reviewer | Start reviews on submitted documents |
| Admin | Approve or reject documents |
Admins can perform reviewer actions as well.
Every state change generates a permanent audit log:
- Action performed
- Who performed it
- Timestamp
- Optional remarks
No document can change state without a corresponding audit record.
Documents can be accessed only by:
- Their owner
- Reviewers (while in workflow states)
- Admins
This is enforced in the service layer, not just via controller attributes.
The API exposes realistic queues:
- My Documents (for users)
- Pending Review (for reviewers/admins)
- In Review (active work queue)
Pending items are ordered by submission time, and in-review items by latest activity.
Refresh tokens were intentionally omitted to keep the focus on:
- Role-based authorization
- Workflow integrity
- Auditability
For internal enterprise systems, short-lived JWT access tokens are standard and sufficient.
Users do not assign their own privileges in real systems.
Roles are assigned externally (HR systems, IT admins, etc).
For this project, roles are assigned directly in the database:
UPDATE Users SET Role = 'Reviewer' WHERE Email = '[email protected]';
UPDATE Users SET Role = 'Admin' WHERE Email = '[email protected]';