Ngân hàng câu hỏi ASP.NET MVC và Web API

HTTP Request
    ↓
Controller (nhận, xử lý)
    ↓
Model (lấy/tính toán data)
    ↓
Controller (chọn view + truyền data)
    ↓
View (render HTML)
    ↓
HTTP Response

Browser Request
    ↓
1. UrlRoutingModule           — match URL với route table
    ↓
2. MVC Route Handler          — xác nhận đây là MVC request
    ↓
3. MvcHandler + ControllerFactory — tạo instance Controller
    ↓
4. Action Invoker             — chọn Action method phù hợp
    ↓
5. Model Binding              — map request data → action parameters
    ↓
6. Action Filters (OnActionExecuting) — trước khi action chạy
    ↓
7. Action Method              — business logic, trả ActionResult
    ↓
8. Action Filters (OnActionExecuted) — sau khi action chạy
    ↓
9. Result Execution (View/JSON/Redirect)
    ↓
10. Result Filters            — sau khi result render
    ↓
Response

Request
    ↓
Kestrel Server
    ↓
Middleware Pipeline (UseRouting → UseAuth → UseEndpoints)
    ↓
Endpoint Routing               — chọn controller/action
    ↓
Model Binding                  — bind route/query/body
    ↓
Action Filters (IActionFilter)
    ↓
Action Method
    ↓
Result Filters (IResultFilter)
    ↓
IActionResult.ExecuteAsync()   — render view/JSON
    ↓
Response

// Program.cs / RouteConfig.cs (MVC 5)
app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");

[Route("api/users")]
public class UsersController : ControllerBase {
    [HttpGet("{id:int}")]           // GET /api/users/42
    public IActionResult Get(int id) { ... }
    
    [HttpPost]                      // POST /api/users
    public IActionResult Create(CreateUserDto dto) { ... }
}

[HttpGet("{id:int}")]          // id phải là số nguyên
[HttpGet("{slug:alpha}")]       // slug chỉ chứa chữ cái
[HttpGet("{age:range(1,120)}")] // age từ 1 đến 120
[HttpGet("{id:guid}")]          // id phải là GUID
[HttpGet("{name:minlength(3)}")] // name >= 3 ký tự

return View();                          // ViewResult — render HTML
return View("MyView", model);           // ViewResult với view name + model
return Ok(data);                        // 200 JSON (Web API)
return Created(uri, data);              // 201 Created
return NoContent();                     // 204 No Content
return BadRequest("invalid");           // 400
return NotFound();                      // 404
return Unauthorized();                  // 401
return Forbid();                        // 403
return Redirect("/home");               // 302 Redirect
return RedirectToAction("Index");       // Redirect tới action
return Json(obj);                       // JSON (MVC 5 style)
return File(bytes, "image/png");        // File response
return Content("text", "text/plain");   // Plain text
return StatusCode(429);                 // Custom status

// IActionResult — không biết return gì
public IActionResult GetUser(int id) {
    var u = _service.Get(id);
    if (u == null) return NotFound();
    return Ok(u);
}

// ActionResult<T> — rõ ràng hơn, Swagger biết type
public ActionResult<UserDto> GetUser(int id) {
    var u = _service.Get(id);
    if (u == null) return NotFound();
    return u;        // implicit Ok(u)
}

[HttpPut("{id}")]
public IActionResult Update(
    int id,                          // FromRoute
    [FromQuery] bool notify,         // FromQuery
    [FromBody] UpdateUserDto dto)    // FromBody
{ ... }

Authorization → Resource → [Action → ActionMethod → Action] → [Result → ResultMethod → Result] → Exception

// 1. Global — áp cho tất cả
builder.Services.AddControllers(options => {
    options.Filters.Add<GlobalExceptionFilter>();
});

// 2. Controller — áp cho tất cả action trong controller
[ServiceFilter(typeof(LoggingFilter))]
public class UsersController : ControllerBase { }

// 3. Action — chỉ action đó
[HttpGet]
[TypeFilter(typeof(RateLimitFilter))]
public IActionResult GetAll() { }

@* Comment *@
@{ var name = "Alice"; }       @* Code block *@
<p>Hello @name</p>             @* Output biến *@
@if (Model.IsAdmin) {
    <span>Admin</span>
}
@foreach (var item in Model.Items) {
    <li>@item.Name</li>
}
@Html.ActionLink("Click", "Index", "Home")   @* HTML helper *@
<a asp-controller="Home" asp-action="Index">Click</a>  @* Tag helper *@

// Controller
ViewData["Name"] = "Alice";
ViewBag.Age = 25;
TempData["Success"] = "Saved!";

// View
<p>@ViewData["Name"]</p>
<p>@ViewBag.Age</p>
@if (TempData["Success"] != null) {
    <div class="alert">@TempData["Success"]</div>
}

// ViewComponent
public class CartSummaryViewComponent : ViewComponent {
    private readonly ICartService _cart;
    public CartSummaryViewComponent(ICartService cart) => _cart = cart;
    public IViewComponentResult Invoke() => View(_cart.GetSummary());
}

// Gọi trong View
@await Component.InvokeAsync("CartSummary")
// Hoặc
<vc:cart-summary />

<!-- _Layout.cshtml -->
<!DOCTYPE html>
<html>
<head>
    <title>@ViewBag.Title</title>
    @await RenderSectionAsync("styles", required: false)
</head>
<body>
    <nav>...</nav>
    @RenderBody()          @* Content của page con *@
    @await RenderSectionAsync("scripts", required: false)
</body>
</html>

@{
    Layout = "_Layout";
    ViewBag.Title = "Home";
}
@section styles {
    <link rel="stylesheet" href="~/css/home.css" />
}
<h1>Welcome</h1>

public class CreateUserDto {
    [Required(ErrorMessage = "Name is required")]
    [StringLength(100, MinimumLength = 2)]
    public string Name { get; set; } = "";
    
    [Required]
    [EmailAddress]
    public string Email { get; set; } = "";
    
    [Range(18, 120)]
    public int Age { get; set; }
    
    [Phone]
    public string? Phone { get; set; }
    
    [Url]
    public string? Website { get; set; }
    
    [RegularExpression(@"^[A-Z]{2,}$", ErrorMessage = "Code phải là chữ hoa")]
    public string? Code { get; set; }
}

// Manual check (không dùng [ApiController])
if (!ModelState.IsValid)
    return BadRequest(ModelState);

// FluentValidation — cho business rule phức tạp
public class CreateUserValidator : AbstractValidator<CreateUserDto> {
    public CreateUserValidator(IUserRepository repo) {
        RuleFor(x => x.Email).EmailAddress()
            .MustAsync(async (email, ct) => !await repo.ExistsAsync(email))
            .WithMessage("Email already taken");
        
        RuleFor(x => x.Age).GreaterThanOrEqualTo(18);
    }
}

Accept: application/json          → trả JSON
Accept: application/xml           → trả XML (nếu support)
Accept: text/csv                  → trả CSV (custom formatter)

// Thêm XML support
builder.Services.AddControllers()
    .AddXmlSerializerFormatters();

// Custom formatter
builder.Services.AddControllers(options => {
    options.OutputFormatters.Add(new CsvOutputFormatter());
});

// Dùng Asp.Versioning.Http package

// 1. URL versioning (phổ biến nhất)
[ApiVersion("1.0")]
[Route("api/v{version:apiVersion}/users")]
public class UsersV1Controller : ControllerBase { }

[ApiVersion("2.0")]
[Route("api/v{version:apiVersion}/users")]
public class UsersV2Controller : ControllerBase { }

// 2. Header versioning
// Request: Api-Version: 2.0

// 3. Query string
// Request: /api/users?api-version=2.0

// nuxt.config:
builder.Services.AddApiVersioning(opt => {
    opt.DefaultApiVersion = new ApiVersion(1, 0);
    opt.AssumeDefaultVersionWhenUnspecified = true;
    opt.ReportApiVersions = true;           // header: api-supported-versions
}).AddApiExplorer(opt => {
    opt.GroupNameFormat = "'v'VVV";
    opt.SubstituteApiVersionInUrl = true;
});

// Program.cs
builder.Services.AddRateLimiter(opt => {
    // Fixed window — 10 req / 10s per IP
    opt.AddFixedWindowLimiter("fixed", o => {
        o.PermitLimit = 10;
        o.Window = TimeSpan.FromSeconds(10);
        o.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
        o.QueueLimit = 5;
    });
    
    // Sliding window — smoothes out traffic
    opt.AddSlidingWindowLimiter("sliding", o => {
        o.PermitLimit = 100;
        o.Window = TimeSpan.FromMinutes(1);
        o.SegmentsPerWindow = 4;
    });
    
    // Token bucket — cho burst
    opt.AddTokenBucketLimiter("token", o => {
        o.TokenLimit = 100;
        o.ReplenishmentPeriod = TimeSpan.FromSeconds(1);
        o.TokensPerPeriod = 10;
    });
    
    opt.RejectionStatusCode = 429;    // Too Many Requests
});

app.UseRateLimiter();

// Áp dụng per-endpoint
[EnableRateLimiting("fixed")]
[HttpGet]
public IActionResult GetAll() { }

builder.Services.AddOutputCache(opt => {
    opt.AddBasePolicy(b => b.Expire(TimeSpan.FromMinutes(5)));
    opt.AddPolicy("ShortCache", b => b.Expire(TimeSpan.FromSeconds(30)));
});

app.UseOutputCache();

// Action
[HttpGet]
[OutputCache(Duration = 60)]
public IActionResult GetProducts() { }

// Với vary by query
[OutputCache(Duration = 120, VaryByQueryKeys = new[] { "category", "page" })]
public IActionResult GetByCategory(string category, int page = 1) { }

// Combine in-memory (L1) + Redis (L2) + stampede protection
builder.Services.AddHybridCache();

// Inject
public class UserService {
    private readonly HybridCache _cache;
    public UserService(HybridCache cache) => _cache = cache;
    
    public async Task<User?> GetAsync(int id, CancellationToken ct = default) {
        return await _cache.GetOrCreateAsync(
            $"user:{id}",
            async token => await _db.Users.FindAsync(id, token),
            cancellationToken: ct);
    }
}

// Minimal API — ít code hơn, nhanh hơn ~5-10% throughput
var app = WebApplication.Create();

app.MapGet("/users/{id:int}", async (int id, IUserService service) =>
    await service.GetByIdAsync(id) is User u ? Results.Ok(u) : Results.NotFound());

app.MapPost("/users", async (CreateUserDto dto, IUserService service) => {
    var created = await service.CreateAsync(dto);
    return Results.Created($"/users/{created.Id}", created);
});

// Nhóm route có prefix + shared middleware
var users = app.MapGroup("/api/v1/users").RequireAuthorization();

users.MapGet("/", async (IUserService s) => await s.GetAllAsync());
users.MapGet("/{id:int}", async (int id, IUserService s) => {
    var u = await s.GetByIdAsync(id);
    return u is not null ? Results.Ok(u) : Results.NotFound();
});
users.MapPost("/", async (CreateUserDto dto, IUserService s) => {
    var created = await s.CreateAsync(dto);
    return Results.Created($"/api/v1/users/{created.Id}", created);
});

app.MapPost("/users", CreateUser)
    .AddEndpointFilter<ValidationFilter<CreateUserDto>>();

public class ValidationFilter<T> : IEndpointFilter where T : class {
    public async ValueTask<object?> InvokeAsync(
        EndpointFilterInvocationContext ctx, EndpointFilterDelegate next) {
        var dto = ctx.Arguments.OfType<T>().FirstOrDefault();
        if (dto is null) return Results.BadRequest("Invalid body");
        // Validate...
        return await next(ctx);
    }
}

// Middleware thứ tự BẮT BUỘC:
app.UseAuthentication();   // 1. Populate User
app.UseAuthorization();    // 2. Check User

// [Authorize] attribute
[Authorize]                                    // chỉ require login
[Authorize(Roles = "Admin,Manager")]           // require role
[Authorize(Policy = "MinAge18")]               // require policy
[AllowAnonymous]                               // bỏ qua auth

// Program.cs
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(opt => {
        opt.TokenValidationParameters = new TokenValidationParameters {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = config["Jwt:Issuer"],
            ValidAudience = config["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(config["Jwt:Key"]!))
        };
    });

builder.Services.AddAuthorization(opt => {
    opt.AddPolicy("AdminOnly", p => p.RequireRole("Admin"));
    opt.AddPolicy("MinAge18", p => p.RequireClaim("age", "18", "19", "20"));
    opt.AddPolicy("PremiumUser", p =>
        p.Requirements.Add(new PremiumRequirement()));
});

// Custom requirement
public class PremiumRequirement : IAuthorizationRequirement {}
public class PremiumHandler : AuthorizationHandler<PremiumRequirement> {
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext ctx, PremiumRequirement req) {
        if (ctx.User.HasClaim("subscription", "premium"))
            ctx.Succeed(req);
        return Task.CompletedTask;
    }
}

// Dùng
[Authorize(Policy = "PremiumUser")]
public IActionResult PremiumContent() { }

builder.Services.AddCors(opt => opt.AddPolicy("default", policy =>
    policy.WithOrigins("https://app.com", "http://localhost:3000")
          .AllowAnyHeader()
          .AllowAnyMethod()
          .AllowCredentials()));

app.UseCors("default");  // Phải TRƯỚC UseAuthentication

builder.Services.AddResponseCompression(opt => {
    opt.EnableForHttps = true;      // cẩn thận BREACH attack với sensitive data
    opt.Providers.Add<BrotliCompressionProvider>();
    opt.Providers.Add<GzipCompressionProvider>();
});

app.UseResponseCompression();

builder.Services.AddHealthChecks()
    .AddSqlServer(config.GetConnectionString("Default")!)
    .AddRedis(config.GetConnectionString("Redis")!)
    .AddCheck<CustomHealthCheck>("custom");

app.MapHealthChecks("/health", new HealthCheckOptions {
    ResponseWriter = UIResponseWriter.WriteHealthCheckUIResponse
});

// Check endpoint liveness/readiness riêng
app.MapHealthChecks("/health/live", new HealthCheckOptions {
    Predicate = _ => false  // chỉ check app alive, không check DB
});

// Chuẩn hoá error response
builder.Services.AddProblemDetails();

// Kết quả khi BadRequest:
{
    "type": "https://httpstatuses.com/400",
    "title": "Bad Request",
    "status": 400,
    "detail": "Name is required",
    "instance": "/api/users",
    "traceId": "00-abc123..."
}

// .NET 9+: Microsoft.AspNetCore.OpenApi
builder.Services.AddOpenApi();

app.MapOpenApi();    // GET /openapi/v1.json

// Với metadata
app.MapGet("/users/{id}", GetUser)
    .WithName("GetUser")
    .WithSummary("Get user by ID")
    .WithDescription("Returns user or 404")
    .Produces<UserDto>(200)
    .Produces(404)
    .WithTags("Users");

// Global.asax / FilterConfig.cs
filters.Add(new HandleErrorAttribute());
// Dùng customErrors trong web.config

// Middleware — app-level
app.UseExceptionHandler("/error");
app.UseDeveloperExceptionPage();   // Dev only

// Problem Details middleware (NET 8+)
app.UseExceptionHandler();         // Auto ProblemDetails
app.UseStatusCodePages();

// Custom exception middleware
app.UseMiddleware<GlobalExceptionMiddleware>();

// Filter level
services.AddControllers(o => o.Filters.Add<GlobalExceptionFilter>());

// Web API — nhận JSON
[HttpPost]
public IActionResult Create([FromBody] CreateUserDto dto) { }

// MVC form submit + file
[HttpPost]
public IActionResult Upload([FromForm] IFormFile file, [FromForm] string desc) { }

// ❌ Sync — block thread khi có I/O
[HttpGet("{id}")]
public IActionResult Get(int id) {
    var u = _db.Users.Find(id);    // block!
    return Ok(u);
}

// ✅ Async — giải phóng thread khi chờ DB/HTTP
[HttpGet("{id}")]
public async Task<ActionResult<UserDto>> Get(int id) {
    var u = await _db.Users.FindAsync(id);
    return u is null ? NotFound() : Ok(u);
}

// PDF/Excel file
[HttpGet("{id}/invoice")]
public async Task<IActionResult> GetInvoice(int id) {
    var bytes = await _service.GenerateInvoicePdfAsync(id);
    return File(bytes, "application/pdf", $"invoice-{id}.pdf");
}

// Stream (tốt hơn cho file lớn)
[HttpGet("{id}/report")]
public async Task<IActionResult> GetReport(int id) {
    var stream = await _service.GetReportStreamAsync(id);
    return File(stream, "application/octet-stream", "report.xlsx");
}

// Redirect to blob storage
[HttpGet("{id}/image")]
public IActionResult GetImage(int id) {
    var url = _storage.GetSignedUrl($"images/{id}.jpg");
    return Redirect(url);
}

// Custom model binder
public class DateRangeModelBinder : IModelBinder {
    public Task BindModelAsync(ModelBindingContext ctx) {
        var from = ctx.ValueProvider.GetValue("from").FirstValue;
        var to = ctx.ValueProvider.GetValue("to").FirstValue;
        if (DateTime.TryParse(from, out var f) && DateTime.TryParse(to, out var t)) {
            ctx.Result = ModelBindingResult.Success(new DateRange(f, t));
        }
        return Task.CompletedTask;
    }
}

// Register
[ModelBinder(typeof(DateRangeModelBinder))]
public class DateRange { ... }

// Action
[HttpGet("report")]
public IActionResult Report(DateRange range) { }  // ?from=2026-01-01&to=2026-12-31

public class QueryParams {
    public int Page { get; set; } = 1;
    public int Size { get; set; } = 20;
    public string? SortBy { get; set; }
    public bool SortDesc { get; set; }
    public string? Search { get; set; }
}

[HttpGet]
public async Task<ActionResult<PagedResult<UserDto>>> GetAll([FromQuery] QueryParams q) {
    var query = _db.Users.AsNoTracking();
    if (!string.IsNullOrEmpty(q.Search))
        query = query.Where(u => u.Name.Contains(q.Search));
    var total = await query.CountAsync();
    var items = await query
        .OrderBy(u => u.Name)
        .Skip((q.Page - 1) * q.Size)
        .Take(q.Size)
        .Select(u => new UserDto { ... })
        .ToListAsync();
    return Ok(new PagedResult<UserDto>(items, total, q.Page, q.Size));
}

// Middleware approach (recommend)
public class GlobalExceptionMiddleware {
    private readonly RequestDelegate _next;
    private readonly ILogger<GlobalExceptionMiddleware> _logger;
    
    public GlobalExceptionMiddleware(RequestDelegate next, ILogger<GlobalExceptionMiddleware> logger) {
        _next = next; _logger = logger;
    }
    
    public async Task InvokeAsync(HttpContext ctx) {
        try {
            await _next(ctx);
        }
        catch (NotFoundException ex) {
            ctx.Response.StatusCode = 404;
            await ctx.Response.WriteAsJsonAsync(new { error = ex.Message });
        }
        catch (ValidationException ex) {
            ctx.Response.StatusCode = 422;
            await ctx.Response.WriteAsJsonAsync(new { errors = ex.Errors });
        }
        catch (Exception ex) {
            _logger.LogError(ex, "Unhandled exception");
            ctx.Response.StatusCode = 500;
            await ctx.Response.WriteAsJsonAsync(new { error = "Internal server error" });
        }
    }
}

// Cũ — .NET 5 trở về
// Startup.cs
public class Startup {
    public void ConfigureServices(IServiceCollection services) {
        services.AddControllers();
    }
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env) {
        app.UseRouting();
        app.UseEndpoints(endpoints => endpoints.MapControllers());
    }
}

// Mới — .NET 6+, minimal hosting
// Program.cs
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddControllers();
var app = builder.Build();
app.MapControllers();
app.Run();

// Đăng ký nhiều implementation cùng interface, phân biệt bằng key
builder.Services.AddKeyedSingleton<IPaymentGateway, StripeGateway>("stripe");
builder.Services.AddKeyedSingleton<IPaymentGateway, VnPayGateway>("vnpay");

// Inject
public class CheckoutService {
    public CheckoutService([FromKeyedServices("stripe")] IPaymentGateway gateway) { }
}

// Hoặc resolve runtime
var gateway = app.Services.GetRequiredKeyedService<IPaymentGateway>("vnpay");

public class GlobalExceptionHandler : IExceptionHandler {
    public async ValueTask<bool> TryHandleAsync(
        HttpContext ctx, Exception ex, CancellationToken ct) {
        var problem = new ProblemDetails {
            Status = ex is NotFoundException ? 404 : 500,
            Title = ex.Message,
            Instance = ctx.Request.Path
        };
        ctx.Response.StatusCode = problem.Status!.Value;
        await ctx.Response.WriteAsJsonAsync(problem, ct);
        return true;        // true = đã handle, false = next handler
    }
}

// Register
builder.Services.AddExceptionHandler<GlobalExceptionHandler>();
builder.Services.AddProblemDetails();
app.UseExceptionHandler();

// Unit test controller trực tiếp — mock service
public class UsersControllerTests {
    [Fact]
    public async Task GetById_Returns404_WhenNotFound() {
        var mockService = new Mock<IUserService>();
        mockService.Setup(s => s.GetByIdAsync(999)).ReturnsAsync((UserDto?)null);
        
        var controller = new UsersController(mockService.Object);
        var result = await controller.Get(999);
        
        Assert.IsType<NotFoundResult>(result.Result);
    }
}

// Integration test — WebApplicationFactory
public class ApiTests : IClassFixture<WebApplicationFactory<Program>> {
    private readonly HttpClient _client;
    public ApiTests(WebApplicationFactory<Program> factory) {
        _client = factory.CreateClient();
    }
    
    [Fact]
    public async Task GetUsers_Returns200() {
        var response = await _client.GetAsync("/api/users");
        response.EnsureSuccessStatusCode();
    }
}