Czar.Cms: the ASP.NET Core 2.2 CMS built to teach a permission model

A tutorial series where the code is the appendix

The repository description states the point plainly: it is the source code for a .NET Core practical project CMS tutorial series, with a permission design that is streamlined yet feature rich, and a content management design that lets you build an ASP.NET Core 2.2 website system. It adds that the project is to be refactored with EF Core and asks readers to look forward to it.

So the repository is not a CMS product. It is the code that accompanies a multi-chapter article series, and the chapters are the primary artefact. The README lays out the plan: an introductory part aimed at readers who have barely touched .NET Core, a design part, a development part, a testing part and a deployment part. The introductory part carries six chapters, from the opening and table of contents through a quick tour of ASP.NET Core, an explanation of the configuration files and dependency injection, a Git introduction, Dapper, and Vue. The design part has four chapters covering a minimal user and role permission design, a minimal content management design, an architecture design in plain language, and a development framework design. The development part has seven chapters covering the database and entity code generator, a Dapper CRUD wrapper with a repository code generator, the MVC project structure with a third party UI, protection against cross-site request forgery, the layer-by-layer wiring of create, read, update and delete, user login with a captcha, and a separate piece on FluentValidation.

The author says the tutorial is written in an agile way, roughly three articles a week, and that the structure is expected to change as the series goes deeper.

The audience is a reader new to .NET Core, and the source exists so that the articles can point at working code rather than snippets. The author also points readers who already know .NET Core to a different series on unified identity authentication, described as having a higher threshold.

The stack, and what each piece is doing there

The README lists the technical stack in one line: ASP.NET Core 2.2, AutoFac, AutoMapper, FluentValidation, Dapper, LayUI, Redis and SqlServer or MySQL. Every one of those choices is worth a sentence.

Dapper rather than Entity Framework is the most consequential choice, and the tutorial chapters make the reasoning explicit. The design chapters dismiss the code-first and database-first debate in favour of designing the schema first with a tool and then developing against it, and the development chapters include a database and entity code generator plus a Dapper CRUD wrapper with a repository code generator. In other words, the schema is the source of truth and the data access layer is generated, which is a defensible position for a system with a permission model this regular, and one that explains why an EF Core refactor is described as pending rather than done.

AutoFac is the IoC container and AutoMapper does object mapping, which together are the conventional ASP.NET Core layering tools. FluentValidation handles input validation, and the dedicated chapter on it suggests the author treats validation as a first-class concern rather than an afterthought.

LayUI is the admin interface, a Chinese front end framework, and Redis is the cache. On the database side, the tutorials are demonstrated on SqlServer 2008R2 or later, with the note that MySQL and Oracle users can adapt the SQL statements.

The tooling section names Visual Studio 2017 or Visual Studio Code for editing, Power Design for database design, and git for source control, with the author's remark that the series is aimed at people who have not met .NET Core at all.

The permission model is the design the series is actually about

Two of the four design chapters are about permissions and content, and the screenshots in the README are all administration screens rather than end user pages: login, the home page, role management, role editing, user management, user editing, a user list with a locked user, and the lock screen.

That is the shape of the project. It is a content management back office with a user and role model, and the content side is described as a minimal design, meaning the smallest model that supports the feature set, not a general purpose content framework.

The screenshots show two things the prose only implies. The user list has a lock action, so accounts can be disabled rather than deleted, and the lock screen is a separate confirmation step. And role editing is a distinct screen from role management, so the model distinguishes roles as entities that are edited, which is what you need for a permission system where the role list is meaningful on its own.

The README closes the screenshots by saying that only these features are implemented for now, with the rest to be shown later. That is a useful calibration for anyone reading the code: the repository is a work in progress that follows a chapter list, not a finished system with a feature set to audit.

The architecture chapter is described as a plain language design, and the framework chapter as a development framework design, which together suggest the layering is: a database designed up front, a code generator producing entities and repositories, a Dapper-based data layer, an MVC application with a third party UI, and a permission and login layer on top.

The security chapters are where the code is worth reading

Two chapters in the development part stand out for a different reason from the rest, and they are the reason to read this repository at all.

The first is the chapter on preventing cross-site request forgery, XSRF and CSRF. Its position in the sequence, between the MVC project structure chapter and the layer integration chapter, means it is applied to the application rather than discussed in the abstract, and it sits in the same list as the login and captcha chapter. A CMS with a role and permission model and a web admin interface is exactly the shape of application where a missing anti-forgery token turns a read-only viewer into a content editor, so the fact that it is a numbered chapter rather than a paragraph is a point in the project's favour.

The second is the login and captcha chapter, which is where the authentication story lives, and the separate FluentValidation chapter, which is where the input rules live.

The FluentValidation piece is worth a note of its own, because it is written as a practical share rather than a numbered part of the series, and it appears alongside the login chapter. Validating input in one place, at the edge, with a declarative schema, is the pattern the ASP.NET Core ecosystem settled on, and a tutorial series that arrives at it in chapter seventeen rather than chapter one is making a deliberate point about ordering.

The generator chapters are the other half of what is worth reading, and for a different reason. A database and entity code generator and a Dapper CRUD wrapper with a repository generator are infrastructure, and infrastructure is where a tutorial reader learns how the layers connect. The development chapter on the MVC project structure and the third party UI then shows how the generated pieces meet the hand written ones.

What is in the repository, and what is not

The top level of the repository is small: .gitignore, .vscode/, Czar.Cms.sln, LICENSE, README.md, database/, pdm/ and src/.

The solution file tells you it is a multi-project solution rather than a single web project, and src/ is where the layers live. database/ is the schema and the design artefacts, which is consistent with the design-first approach the chapters describe, and it is the first place to look if you want to understand the permission model without reading the code. pdm/ is the package metadata, so the project is managed with PDM rather than the older NuGet-only workflow.

The .vscode/ directory is committed, which is a small signal about the intended workflow, since the tooling section recommends Visual Studio Code and includes a dedicated article on using it for .NET Core.

What is not there is as informative as what is. There is no Dockerfile, no CI configuration visible in the top level, and the deployment part of the series is two chapters about Windows deployment and running an ASP.NET Core program as a Windows service, with the rest marked as to be updated. The testing part is entirely to be updated, which means the unit and integration test chapters the series promised were never written, and the repository has no tests directory at the top level either.

That is the clearest single limitation of this repository, and it is a documentation gap rather than a code gap. There is no visible test suite, so the code in src/ is verified by the fact that the author was able to demonstrate the running screens, not by anything a reader can execute.

The source is also mirrored on Gitee, the Chinese Git host, alongside GitHub, which is a normal choice for a project aimed at Chinese readers and worth knowing about if you need to reach the code from a network where GitHub is slow.

Where Czar.Cms is the wrong starting point

The first and decisive problem is the framework version. The stack is ASP.NET Core 2.2, which has been out of support for years, and the tutorial predates the current .NET naming, the current dependency injection defaults, and the current Razor and minimal hosting model. Starting a new project from this code means adopting a generation of ASP.NET Core that no longer receives security updates, and the EF Core refactor mentioned in the project description would be the beginning of a port rather than a small change.

The second is that this is a tutorial artefact, and the README says so. The testing chapter is unwritten, the deployment chapter is partial, and the author states that only the screens shown are implemented. A team evaluating a CMS needs a feature set, an upgrade path and a test suite, and none of those are what this repository is.

The third is the content design. A minimal content model and a minimal permission model are the right scope for a teaching series that has to get to a working screen in a chapter, and they are not the right scope for a system that has to model a real editorial workflow, multi-tenancy, or a permission model with resource-level and record-level rules.

The alternative worth comparing is not another tutorial codebase, it is a current official template with a working identity provider bolted on. The ASP.NET Core Razor Pages or MVC templates ship with authentication, authorization, antiforgery handling and a project layout, and the effort to add a role model to that is smaller than porting a 2.2-era CMS forward. The difference in approach is that this repository teaches layering through a full application with generated data access, whereas the official template teaches layering through something that already works, and the lesson you want from a CMS codebase, which is how the layers talk to each other, is available in both.

The case for this repository is narrow and real. If you are learning ASP.NET Core in 2019-era conventions, or you read Chinese, or you want to see a permission model designed from the schema up with code generation underneath it, this is a well-organised worked example that costs nothing to read.

Editorial conclusion

Czar.Cms fits a developer who wants a worked example of how an ASP.NET Core application is layered, with an entity generator and a repository generator that remove the boilerplate, and who is willing to read the accompanying blog series rather than the code alone. It is the wrong choice for anything starting today, since the stack targets ASP.NET Core 2.2 and the project description says an EF Core refactor is planned, and it is the wrong choice for a team that wants a maintained CMS rather than a teaching artefact. Before you rely on any of it, read the database/ folder to see the schema the generators assume, and treat the CSRF, login and captcha chapters as the parts worth porting, since that is where the security-relevant decisions live.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Project website
4. README
5. yilezhu/Czar.Cms on GitHub