Bahadır Erdun

1public sealed record CreateCustomerCommand(string Name, string Email) : IRequest<Result<Guid>>;23public sealed class CreateCustomerHandler(4    AppDbContext db,5    ICurrentUser user,6    IDateTime clock,7    ILogger<CreateCustomerHandler> log) : IRequestHandler<CreateCustomerCommand, Result<Guid>>8{9    public async Task<Result<Guid>> Handle(CreateCustomerCommand cmd, CancellationToken ct)10    {11        var exists = await db.Customers12            .AnyAsync(c => c.Email == cmd.Email && c.TenantId == user.TenantId, ct);1314        if (exists) return Result<Guid>.Conflict("customer.email.duplicate");1516        var customer = Customer.Create(cmd.Name, cmd.Email, user.TenantId, clock.UtcNow);17        db.Customers.Add(customer);18        await db.SaveChangesAsync(ct);1920        log.LogInformation("customer.created {Id} by {User}", customer.Id, user.Id);21        return Result<Guid>.Ok(customer.Id);22    }23}

1// Program.cs — strict CSRF + cookie policy + security headers2builder.Services.AddAntiforgery(o =>3{4    o.HeaderName           = "X-CSRF-TOKEN";5    o.Cookie.Name         = "__Host-csrf";6    o.Cookie.SameSite     = SameSiteMode.Strict;7    o.Cookie.SecurePolicy = CookieSecurePolicy.Always;8    o.Cookie.HttpOnly     = true;9});1011app.Use(async (ctx, next) =>12{13    ctx.Response.Headers["Strict-Transport-Security"] = "max-age=63072000; includeSubDomains; preload";14    ctx.Response.Headers["Content-Security-Policy"]   = "default-src 'self'; frame-ancestors 'none'";15    ctx.Response.Headers["X-Content-Type-Options"]    = "nosniff";16    ctx.Response.Headers["Referrer-Policy"]           = "strict-origin-when-cross-origin";17    ctx.Response.Headers["Permissions-Policy"]         = "geolocation=(), microphone=(), camera=()";18    await next();19});2021app.UseAuthentication();22app.UseAuthorization();23app.UseAntiforgery();   // after auth, before endpoints2425app.MapControllers().RequireAuthorization();