# QuickApp: an Angular and ASP.NET Core starter built to keep AI tools inside guardrails

> Eben Monney's MIT licensed template ships OpenIddict JWT auth, role and permission management, EF Core migrations and an ai-rules directory, and its README frames the whole thing as a foundation for AI coding tools rather than for humans typing features.

**emonney/QuickApp** — AI-ready reference architecture for Angular / ASP.NET Core projects. A hardened foundation with secure authentication, authorization, role and user management, and consistent patterns designed to be safely extended by AI tools. Stop letting AI hallucinate your auth and DB logic - give it a production-grade foundation to build on.

- Repository: https://github.com/emonney/QuickApp
- Website: https://www.ebenmonney.com/quickapp
- Stars: 1,352 · Forks: 623
- Language: TypeScript
- License: MIT
- Published: 2026-10-06 · Updated: 2026-10-06 · Language: en
- Canonical page: https://hysenlabs.com/projects/emonney-quickapp

## A template with a stated target audience

The README opens by calling QuickApp an opinionated Angular 21 plus ASP.NET Core 10 starter that solves what it describes as the boring, fragile, and security-sensitive parts of a modern web application. Authentication, authorization, role and user management, error handling and architectural consistency are the named targets. The project is MIT licensed, has 1350 stars and 624 forks, and its primary language on GitHub is TypeScript, which is what you would expect from a repository whose client half is the larger one.

Something else stands out in the metadata. The default branch is `master` rather than `main`, and there are 11 open issues on a repository with this much attention. Both are ordinary facts about a long lived template rather than signals of trouble.

The interesting part is who the README is talking to. It names ChatGPT, Copilot, Claude and Cursor directly, and the framing sentence is that AI tools can safely build on top of this foundation. That is a much narrower pitch than the usual boilerplate about rapid development, and it changes what you should look for when you read the code.

## The argument about what AI code gets wrong

The README splits AI behaviour into two lists, and the second list is the pitch. AI is described as good at generating new features, repeating existing patterns, filling in CRUD work, and extending UI and API layers. It is described as not good at designing secure authentication flows, maintaining architectural consistency over time, enforcing authorization rules correctly, or making long-lived projects stable.

QuickApp's contribution, on this reading, is that those four failures are all consequences of missing conventions rather than missing model capability. If the auth flow is already written and the folder layout is already predictable, an AI tool generating a new entity has one obvious place to put a controller, a service, a DTO and a component. The README frames this as giving the tool a set of Laws to follow, and attributes a reliability multiplier to the arrangement. That number is a claim in the README rather than a measurement you can find in the repository, so treat it as the project's pitch and judge the structure yourself.

The workflow the README describes is three steps: start from QuickApp, extend it with prompts, then review rather than rebuild. The example prompts are deliberately boring, asking for an `Invoice` entity that follows the existing `Product` pattern across API, DTO, Angular service and UI, and for role-based access restricting invoice creation and deletion to `Admin` users. Each of those is a request to copy something that already exists, which is the point.

## The backend decisions you inherit

Authentication is OpenIddict over OAuth2 issuing JWT tokens, with refresh token handling and claims management already handled. Roles and permissions are a first class feature rather than an afterthought: full user CRUD, role assignment, permission-based access control, policy-based authorization, resource-based authorization and custom authorization handlers.

The data layer is Entity Framework Core with code first migrations and audit trails, wrapped in repository and Unit of Work patterns. Above that sits a `BaseApiController` giving consistent error handling, AutoMapper integration for DTO and ViewModel mapping, centralized validation with model sanitization, auto-generated Swagger and OpenAPI documentation, and logging and configuration already wired.

Those are the decisions that are expensive to reverse. Swapping OpenIddict for a different token service later means touching every authenticated endpoint, and changing the authorization model after a dozen features depend on it is worse. Adopting them up front is the entire argument of the template, and it is also its main cost, because the repository topics still list `identityserver4` while the README describes OpenIddict, which suggests both names have appeared in this project's history.

## The Angular side and the rules folder

The client half ships route guards for authentication and authorization, a complete admin interface for managing users, roles and permissions, standalone components with lazy loading, Bootstrap 5 theming, and multi-language support. Token handling is automatic rather than manual, with an `EndpointBase` service pattern that refreshes tokens for callers.

The repository tree is short enough to read at a glance: `QuickApp.Core/`, `QuickApp.Server/`, `quickapp.client/`, `QuickApp.sln`, `LICENSE`, `.github/`, and `ai-rules/`. Most of those are self explanatory. The `ai-rules/` directory is the one that gives the README's argument a physical form, since a set of conventions meant to be followed by a coding tool belongs in version control next to the code it describes rather than in a prompt someone retypes.

The README names the patterns such a tool is meant to follow: `BaseEntity`, `BaseApiController`, and the `EndpointBase` service pattern. Those three names are effectively the contract. A request that says follow the existing pattern only works if there is a clear pattern to follow, and the `Product` feature the example prompts reference is the place to check that before committing to the template.

## Getting it running and where it is going

The setup path is four commands, split across the solution and the client:

```bash
git clone https://github.com/emonney/QuickApp.git
cd QuickApp
```

```bash
dotnet restore
cd quickapp.client
npm install
```

Then run the backend with F5 or `dotnet run` and the frontend with `npm start`. The README's instruction for what happens next is to verify that authentication, roles and the base features work before you let anything generate code on top of that foundation.

Release history shows a steady framework upgrade cadence: v9.19.0 in December 2024 moved to Angular 19 with signal inputs, output functions and signal queries, v9.20.0 in October 2025 moved to Angular 20 and updated npm packages, and v10.21.0 in December 2025 is the ASP.NET Core 10 and Angular 21 release. There is also a live demo linked from the README and a Visual Studio Marketplace extension under the name `adentum.QuickApp-ASPNETCoreAngularXProjectTemplate` for people who prefer a project template dialog to a clone. The repository was last pushed on 2026-09-01.

One thing to settle before you start: the README points new projects at NetForge, described as the successor with the same philosophy on a current stack. That version targets .NET 10 with either React 19 or Angular 22, lets you choose SQLite, PostgreSQL or SQL Server, and adds multi-tenancy, audit trails, webhooks and a permissions UI. The author's homepage for QuickApp itself is at ebenmonney.com/quickapp.

## Conclusion

QuickApp's distinguishing feature is that it argues its own architecture out loud. The README spends most of its length on why authentication, authorization and layering should be decided before an AI tool touches them, and the repository carries an `ai-rules/` directory alongside `QuickApp.Core/`, `QuickApp.Server/` and `quickapp.client/`. Judge it on the `Product` pattern it tells you to copy: if that existing feature is clear enough to mirror, the guardrail argument holds, and if it is not, no amount of rules will fix it. Clone it, run `dotnet restore` then `npm install` in `quickapp.client`, and verify authentication and roles work before generating anything. Note that v10.21.0 is the latest release and the author now points new projects at NetForge, so treat this repository as the Angular 21 and ASP.NET Core 10 path rather than the current one.

## FAQ

### What is QuickApp?

An opinionated Angular 21 and ASP.NET Core 10 starter template, MIT licensed, that provides authentication, authorization, role and user management, error handling and a consistent project structure so that AI coding tools can extend an application without inventing those layers.

### Which authentication approach does QuickApp use?

OpenIddict with OAuth2 and JWT tokens, including refresh token handling and claims management. Custom authorization handlers, policy based authorization and resource based authorization are all included on top of it.

### What is the ai-rules directory in the QuickApp repository?

It sits alongside QuickApp.Core, QuickApp.Server and quickapp.client at the repository root. It holds the conventions the README describes as Laws for AI tools to follow, so that generated code matches the existing BaseEntity, BaseApiController and EndpointBase patterns.

### How do I run QuickApp locally after cloning it?

Run dotnet restore at the solution root, then cd quickapp.client and run npm install. Start the backend with F5 or dotnet run and the frontend with npm start, then confirm authentication and roles work before extending anything.

### Is QuickApp still the recommended starting point for new projects?

The README points new work at NetForge as QuickApp's successor, offering the same approach on .NET 10 with React 19 or Angular 22, a choice of SQLite, PostgreSQL or SQL Server, and multi-tenancy, webhooks and a permissions UI included. QuickApp remains the Angular 21 and ASP.NET Core 10 path.

## Sources

- [emonney/QuickApp on GitHub](https://github.com/emonney/QuickApp)
- [License: MIT](https://github.com/emonney/QuickApp/blob/master/LICENSE)
- [Project website](https://www.ebenmonney.com/quickapp)
- [README](https://github.com/emonney/QuickApp/blob/master/README.md)
- [Releases](https://github.com/emonney/QuickApp/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/emonney-quickapp