You have done an absolutely phenomenal job. By adding user ownership and custom slug validation to your `CreateShortUrl` logic, you've transformed a simple utility into the beginnings of a true, user-centric platform. The "Create" part of CRUD (Create, Read, Update, Delete) is now robust and intelligent. It's time to complete the set. A user who can create links must also be able to see, manage, and remove them. This task is about building out the rest of that essential management toolkit. You will create the API endpoints that will form the backbone of any future user dashboard: one to **List** all of a user's links, one to **Update** a link's destination, and one to **Delete** a link they no longer need. This is where your application truly becomes a service for its users. ### The Principle: User-Scoped Operations A critical security and design principle underpins everything we are about to do: **all operations must be scoped to the authenticated user**. A user should only ever be able to see, update, or delete *their own* links. This isn't just a feature; it's a fundamental security requirement. We will enforce this rule not in the controller, but deep within our application layer's command handlers, treating it as an inviolable business rule. Let's build these features, one by one, following the clean CQRS pattern you've established. *** ### 1. The "List" Endpoint: Show Me My Links The first and most fundamental feature is allowing users to see a list of all the URLs they've created. #### Step 1.1: Define the Response DTO Our API shouldn't return the full `ShortenedUrl` entity. We'll create a specific DTO for this purpose. 1. In `UrlShortener.Application`, navigate to the `Features/ShortUrls/DTOs` folder. 2. Create a new C# file named `UserUrlDto.cs`. ```csharp // UrlShortener.Application/Features/ShortUrls/DTOs/UserUrlDto.cs namespace UrlShortener.Application.Features.ShortUrls.DTOs; ///

/// A DTO representing a shortened URL as seen by its owner. /// This contains the essential information for a user's dashboard view. ///

public class UserUrlDto { public required string ShortCode { get; set; } public required string LongUrl { get; set; } public DateTime CreatedAt { get; set; } } ``` #### Step 1.2: Create the `GetUserUrlsQuery` This query will represent the request to fetch the user's links. It's unique because it doesn't need any input parameters; the user's identity is implicit from their authentication context. 1. Create a new folder: `UrlShortener.Application/Features/ShortUrls/Queries/GetUserUrls`. 2. Inside, create `GetUserUrlsQuery.cs`. ```csharp // UrlShortener.Application/Features/ShortUrls/Queries/GetUserUrls/GetUserUrlsQuery.cs using MediatR; using UrlShortener.Application.Features.ShortUrls.DTOs; namespace UrlShortener.Application.Features.ShortUrls.Queries.GetUserUrls; ///

/// Represents a query to fetch all shortened URLs for the currently authenticated user. /// It implements IRequest, telling MediatR that it expects a List of UserUrlDto in return. ///

public class GetUserUrlsQuery : IRequest> { // This query is parameter-less because the user's identity is derived // from the security context (e.g., the JWT), not from a request parameter. } ``` #### Step 1.3: Implement the `GetUserUrlsQueryHandler` This handler will get the user's ID, query the database for their links, and map the results to our DTO. 1. In the same `GetUserUrls` folder, create `GetUserUrlsQueryHandler.cs`. ```csharp // UrlShortener.Application/Features/ShortUrls/Queries/GetUserUrls/GetUserUrlsQueryHandler.cs using MediatR; using Microsoft.AspNetCore.Http; using Microsoft.EntityFrameworkCore; using System.Security.Claims; using UrlShortener.Application.Interfaces; using UrlShortener.Application.Features.ShortUrls.DTOs; namespace UrlShortener.Application.Features.ShortUrls.Queries.GetUserUrls; public class GetUserUrlsQueryHandler : IRequestHandler> { private readonly IApplicationDbContext _context; private readonly IHttpContextAccessor _httpContextAccessor; public GetUserUrlsQueryHandler(IApplicationDbContext context, IHttpContextAccessor httpContextAccessor) { _context = context; _httpContextAccessor = httpContextAccessor; } public async Task> Handle(GetUserUrlsQuery request, CancellationToken cancellationToken) { // 1. Get the current user's ID from the HttpContext. // This is the same secure mechanism you used in the Create command handler. var userId = _httpContextAccessor.HttpContext?.User?.FindFirstValue(ClaimTypes.NameIdentifier); if (userId is null) { // If there's no user ID, it means this endpoint was somehow called // by an unauthenticated user, which should be prevented by the [Authorize] attribute. // We return an empty list as there are no URLs for a non-existent user. return []; } // 2. Query the database for URLs owned by this specific user. var userUrls = await _context.ShortenedUrls // The .Where() clause is the most important part. It filters the entire table // down to only the records matching the authenticated user's ID. .Where(su => su.UserId == userId) .AsNoTracking() // Read-only query, so no need to track changes. .OrderByDescending(su => su.CreatedAt) // Show the newest links first. // 3. Project the results into our DTO. This ensures we only return // the data the client needs, not the entire entity. .Select(su => new UserUrlDto { ShortCode = su.ShortCode, LongUrl = su.LongUrl, CreatedAt = su.CreatedAt }) .ToListAsync(cancellationToken); return userUrls; } } ``` *** ### 2. The "Update" Endpoint: Change a Link's Destination Now, let's allow users to edit the `LongUrl` of a link they own. #### Step 2.1: Create the `UpdateShortUrlCommand` 1. Create a new folder: `UrlShortener.Application/Features/ShortUrls/Commands/UpdateShortUrl`. 2. Inside, create `UpdateShortUrlCommand.cs`. ```csharp // UrlShortener.Application/Features/ShortUrls/Commands/UpdateShortUrl/UpdateShortUrlCommand.cs using MediatR; using System.Text.Json.Serialization; namespace UrlShortener.Application.Features.ShortUrls.Commands.UpdateShortUrl; public class UpdateShortUrlCommand : IRequest { // The ShortCode will come from the URL route, not the request body. // We use [JsonIgnore] to prevent it from being part of the swagger schema for the body. [JsonIgnore] public required string ShortCode { get; set; } // The new destination URL will come from the request body. public required string NewLongUrl { get; set; } } ``` #### Step 2.2: Implement the `UpdateShortUrlCommandHandler` This handler contains the critical authorization check. 1. In the same folder, create `UpdateShortUrlCommandHandler.cs`. ```csharp // UrlShortener.Application/Features/ShortUrls/Commands/UpdateShortUrl/UpdateShortUrlCommandHandler.cs using MediatR; using Microsoft.AspNetCore.Http; using Microsoft.EntityFrameworkCore; using System.Security.Claims; using UrlShortener.Application.Common.Exceptions; using UrlShortener.Application.Interfaces; namespace UrlShortener.Application.Features.ShortUrls.Commands.UpdateShortUrl; public class UpdateShortUrlCommandHandler : IRequestHandler { private readonly IApplicationDbContext _context; private readonly IHttpContextAccessor _httpContextAccessor; public UpdateShortUrlCommandHandler(IApplicationDbContext context, IHttpContextAccessor httpContextAccessor) { _context = context; _httpContextAccessor = httpContextAccessor; } public async Task Handle(UpdateShortUrlCommand request, CancellationToken cancellationToken) { var userId = _httpContextAccessor.HttpContext?.User?.FindFirstValue(ClaimTypes.NameIdentifier); if (userId is null) { throw new UnauthorizedAccessException("User is not authenticated."); } // 1. Find the URL by its short code. var shortenedUrl = await _context.ShortenedUrls .FirstOrDefaultAsync(su => su.ShortCode == request.ShortCode, cancellationToken); // 2. If it doesn't exist, it's a 'Not Found' error. if (shortenedUrl is null) { throw new NotFoundException(nameof(Domain.Entities.ShortenedUrl), request.ShortCode); } // 3. THE CRITICAL AUTHORIZATION CHECK: // Ensure the found URL actually belongs to the user making the request. if (shortenedUrl.UserId != userId) { // If the IDs don't match, this user is trying to edit someone else's link. // This is a forbidden action. Throw an exception that can be mapped // to a 403 Forbidden or 404 Not Found response in the controller. throw new ForbiddenAccessException("User does not have permission to modify this resource."); } // 4. If authorization passes, update the property and save. shortenedUrl.LongUrl = request.NewLongUrl; await _context.SaveChangesAsync(cancellationToken); } } ``` *** ### 3. The "Delete" Endpoint: Remove My Link Finally, we'll give users the ability to delete a link. #### Step 3.1: Create the `DeleteShortUrlCommand` 1. Create a new folder: `UrlShortener.Application/Features/ShortUrls/Commands/DeleteShortUrl`. 2. Inside, create `DeleteShortUrlCommand.cs`. ```csharp // UrlShortener.Application/Features/ShortUrls/Commands/DeleteShortUrl/DeleteShortUrlCommand.cs using MediatR; namespace UrlShortener.Application.Features.ShortUrls.Commands.DeleteShortUrl; public class DeleteShortUrlCommand : IRequest { public required string ShortCode { get; set; } } ``` #### Step 3.2: Implement the `DeleteShortUrlCommandHandler` This handler will mirror the security checks of the Update handler. 1. In the same folder, create `DeleteShortUrlCommandHandler.cs`. ```csharp // UrlShortener.Application/Features/ShortUrls/Commands/DeleteShortUrl/DeleteShortUrlCommandHandler.cs using MediatR; using Microsoft.AspNetCore.Http; using Microsoft.EntityFrameworkCore; using System.Security.Claims; using UrlShortener.Application.Common.Exceptions; using UrlShortener.Application.Interfaces; namespace UrlShortener.Application.Features.ShortUrls.Commands.DeleteShortUrl; public class DeleteShortUrlCommandHandler : IRequestHandler { private readonly IApplicationDbContext _context; private readonly IHttpContextAccessor _httpContextAccessor; public DeleteShortUrlCommandHandler(IApplicationDbContext context, IHttpContextAccessor httpContextAccessor) { _context = context; _httpContextAccessor = httpContextAccessor; } public async Task Handle(DeleteShortUrlCommand request, CancellationToken cancellationToken) { var userId = _httpContextAccessor.HttpContext?.User?.FindFirstValue(ClaimTypes.NameIdentifier); if (userId is null) { throw new UnauthorizedAccessException("User is not authenticated."); } var shortenedUrl = await _context.ShortenedUrls .FirstOrDefaultAsync(su => su.ShortCode == request.ShortCode, cancellationToken); if (shortenedUrl is null) { // Even if the URL doesn't exist, we don't leak that information. // From the user's perspective, the resource is gone, so the operation is complete. return; } // CRITICAL AUTHORIZATION CHECK if (shortenedUrl.UserId != userId) { throw new ForbiddenAccessException("User does not have permission to delete this resource."); } _context.ShortenedUrls.Remove(shortenedUrl); await _context.SaveChangesAsync(cancellationToken); } } ``` ### 4. Wire It All Up in the Controller You've built all the application logic. Now, let's expose it via the `ShortUrlsController`. For better organization, let's rename the `/api/shorten` endpoint and group all user-management endpoints under a common route. Modify `UrlShortener.Api/Controllers/ShortUrlsController.cs` to add the new endpoints. ```csharp // Add these new 'using' statements using UrlShortener.Application.Features.ShortUrls.Queries.GetUserUrls; using UrlShortener.Application.Features.ShortUrls.Commands.UpdateShortUrl; using UrlShortener.Application.Features.ShortUrls.Commands.DeleteShortUrl; // ... other existing using statements namespace UrlShortener.Api.Controllers; [ApiController] [Route("api/short-urls")] // Let's use a more descriptive route for this controller [Authorize] // Apply authorization to the whole controller public class ShortUrlsController : ControllerBase { private readonly ISender _sender; public ShortUrlsController(ISender sender) { _sender = sender; } // --- START: NEW AND MODIFIED ENDPOINTS --- // Note: The previous POST /api/shorten is now POST /api/short-urls [HttpPost] public async Task CreateShortUrl(CreateShortUrlCommand command) { var result = await _sender.Send(command); return Created($"/api/short-urls/{result.ShortCode}", result); } ///

/// Gets a list of all URLs created by the authenticated user. ///

[HttpGet] public async Task GetUserUrls() { var result = await _sender.Send(new GetUserUrlsQuery()); return Ok(result); } ///

/// Updates the long URL for a shortened URL owned by the authenticated user. ///

[HttpPut("{shortCode}")] [ProducesResponseType(StatusCodes.Status204NoContent)] [ProducesResponseType(StatusCodes.Status404NotFound)] [ProducesResponseType(StatusCodes.Status403Forbidden)] public async Task UpdateShortUrl([FromRoute] string shortCode, [FromBody] UpdateShortUrlCommand command) { command.ShortCode = shortCode; // Map the route parameter to the command await _sender.Send(command); return NoContent(); // 204 is the correct response for a successful update with no content. } ///

/// Deletes a shortened URL owned by the authenticated user. ///

[HttpDelete("{shortCode}")] [ProducesResponseType(StatusCodes.Status204NoContent)] [ProducesResponseType(StatusCodes.Status403Forbidden)] public async Task DeleteShortUrl([FromRoute] string shortCode) { await _sender.Send(new DeleteShortUrlCommand { ShortCode = shortCode }); return NoContent(); // 204 is also correct for a successful deletion. } // --- END: NEW ENDPOINTS --- // The GET /api/analytics/{shortCode} endpoint could remain here or be moved. // Let's keep it for now. Note that its route is now relative to "/api/short-urls". [HttpGet("analytics/{shortCode}")] //... (existing analytics code) } ``` *Note: We've applied `[Authorize]` at the controller level now, as all these actions require an authenticated user. You may also need to adjust your API Key authentication handler to add the `ClaimTypes.NameIdentifier` or switch the default authentication scheme as you move towards JWT.* ### What's Next? You have done it! You've built a complete, secure, user-centric set of management endpoints. Your application now has the core features of a real-world SaaS product. The final piece of the puzzle is to make this all work seamlessly for end-users. Right now, your `[Authorize]` attribute is likely still tied to your API Key scheme. The handlers you just wrote are expecting a user ID from a `ClaimTypes.NameIdentifier` claim, which the API key handler doesn't provide. In the final task of this step, **\"Protect these new endpoints with JWT-based authentication to ensure users can only manage their own links,\"** you will create user registration and login endpoints. When a user logs in, they will receive a JSON Web Token (JWT). You will then configure ASP.NET Core to validate these tokens and use them to populate the `HttpContext.User` with the correct claims, making the handlers you just wrote fully operational. *** ### Further Reading * **REST and HTTP Verbs**: An overview of how to use `GET`, `POST`, `PUT`, and `DELETE` correctly. * [https://www.restapitutorial.com/lessons/httpmethods.html](https://www.restapitutorial.com/lessons/httpmethods.html) * **Authorization in ASP.NET Core**: A deep dive into the authorization framework, including policies and claims-based checks. * [https://learn.microsoft.com/en-us/aspnet/core/security/authorization/introduction](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/introduction) * **HTTP Status Code `204 No Content`**: An explanation of when to use this response code. * [https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/204](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/204) * **Handling Errors in ASP.NET Core Web APIs**: Learn how to create middleware to automatically map exceptions like `NotFoundException` and `ForbiddenAccessException` to the correct HTTP status codes. * [https://learn.microsoft.com/en-us/aspnet/core/web-api/handle-errors](https://learn.microsoft.com/en-us/aspnet/core/web-api/handle-errors)