first user

Author: SecureFromScratch

csharp/recipes_2026/challanges/Recipes/src/Recipes.Api/Controllers/AccountController.cs

@@ -62,7 +62,17 @@ public async Task<IActionResult> Register([FromBody] RegisterRequest req)
    {
       try
       {
-         await m_userService.RegisterUserAsync(req.UserName, req.Password, isAdmin: false);
+
+         if (await m_userService.IsFirstUserAsync())
+         {
+            // Automatically create as admin
+            await m_userService.RegisterFirstAdminAsync(req.UserName, req.Password);
+         }
+         else
+         {
+
+            await m_userService.RegisterUserAsync(req.UserName, req.Password, isAdmin: false);
+         }
          return NoContent();
       }
       catch (ArgumentException ex)

csharp/recipes_2026/challanges/Recipes/src/Recipes.Api/Security/AuthorizationExtensions.cs

@@ -0,0 +1,64 @@
+using Microsoft.AspNetCore.Authorization;
+
+namespace Recipes.Api.Extensions;
+
+public static class AuthorizationExtensions
+{
+    public static IServiceCollection AddAuthorizationPolicies(this IServiceCollection services)
+    {
+        services.AddAuthorization(options =>
+        {
+            // Admin Only Policy
+            options.AddPolicy("AdminOnly", policy =>
+            {
+                policy.RequireAuthenticatedUser();
+                policy.RequireRole("Admin");
+            });
+
+            // User or Admin Policy
+            options.AddPolicy("UserOrAdmin", policy =>
+            {
+                policy.RequireAuthenticatedUser();
+                policy.RequireRole("User", "Admin");
+            });
+
+            // Moderator Policy
+            options.AddPolicy("ModeratorOnly", policy =>
+            {
+                policy.RequireAuthenticatedUser();
+                policy.RequireRole("Moderator");
+            });
+
+            // Staff Policy (Admin or Moderator)
+            options.AddPolicy("StaffOnly", policy =>
+            {
+                policy.RequireAuthenticatedUser();
+                policy.RequireRole("Admin", "Moderator");
+            });
+
+            // Email Verified Policy
+            options.AddPolicy("EmailVerified", policy =>
+            {
+                policy.RequireAuthenticatedUser();
+                policy.RequireClaim("EmailVerified", "true");
+            });
+
+            // Custom Permission Policy
+            options.AddPolicy("CanManageUsers", policy =>
+            {
+                policy.RequireAuthenticatedUser();
+                policy.RequireClaim("Permission", "ManageUsers");
+            });
+
+            // Multiple Requirements Policy
+            options.AddPolicy("AdminWithVerifiedEmail", policy =>
+            {
+                policy.RequireAuthenticatedUser();
+                policy.RequireRole("Admin");
+                policy.RequireClaim("EmailVerified", "true");
+            });
+        });
+
+        return services;
+    }
+}

csharp/recipes_2026/challanges/Recipes/src/Recipes.Api/Security/JwtAuthExtensions.cs

@@ -3,6 +3,7 @@
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.IdentityModel.Tokens;
+using Recipes.Api.Extensions;
 
 namespace Recipes.Api.Security;
 
@@ -38,7 +39,9 @@ public static IServiceCollection AddJwtAuth(this IServiceCollection services, Jw
                 };
             });
 
-        services.AddAuthorization();
+        //services.AddAuthorization();
+        services.AddAuthorizationPolicies();
+
 
         // optional: expose config for other services/controllers
         services.AddSingleton(jwt);

csharp/recipes_2026/challanges/Recipes/src/Recipes.Api/Services/RecipeAssistantService.cs

@@ -57,7 +57,7 @@ public async Task<AppUser> RegisterUserAsync(string userName, string rawPassword
       var user = new AppUser
       {
          UserName = userName,
-         Roles = isAdmin ? "ADMIN,USER" : "USER",
+         Roles = isAdmin ? "Admin,User" : "User",
          Enabled = true
       };