Getting started with MiStorage

• Access: membership of the MiStorage project in the micampdev Azure DevOps organisation, which holds both repositories.
• Nothing else. No cloud account, payment gateway or mail account is needed locally: card charging is off (PhoenixGate:Enabled is false) and Development writes outgoing mail to disk.

cd mistorage-backend
openssl rand -base64 48    # one way to make a signing key: 32 bytes or more
dotnet user-secrets set "ConnectionStrings:DefaultConnection" "Host=localhost;Database=mistorage;Username=postgres;Password=<your-password>"
dotnet user-secrets set "Jwt:SecretKey" "<the key you generated>"
dotnet user-secrets list

Any key can also come from an environment variable, with __ in place of each colon (ConnectionStrings__DefaultConnection, Jwt__SecretKey). Environment variables win over user-secrets.

dotnet ef database update    # create the database and apply every migration
dotnet ef migrations list     # all 19 listed, none marked (Pending)

• dotnet ef runs the app's startup checks to find the connection, so set the two secrets first. It runs as Development, reads your user-secret, and creates mistorage on your server if it does not exist yet.
• The 19 migrations run from InitialPostgres to AddApplicationFieldPolicy. They seed three HQ roles (SuperAdmin, Admin, Manager), their permissions, the default system settings and the archived subscription plans.
• No user is seeded. You create the first one through the API below.
• The API never migrates on startup. After pulling a new migration, stop the API and run dotnet ef database update again.

dotnet run                           # http profile: http://localhost:5179
dotnet run --launch-profile https    # adds https://localhost:7206

Startup checks its configuration in one pass and stops with a list of everything that is missing (see Troubleshooting below). The payment workers log that they are idle, because the gateway is switched off.

API=http://localhost:5179

# 1. Is the API up, and can it reach the database?
curl -s $API/api/health

# 2. Register the first HQ user. The first account on an empty database becomes SuperAdmin.
curl -s -X POST $API/api/auth/register -H "Content-Type: application/json" \
  -d '{"firstName":"Ada","lastName":"Lovelace","email":"ada@example.com","password":"<your-password>","confirmPassword":"<your-password>"}'

# 3. Sign in, then copy data.accessToken from the response
curl -s -X POST $API/api/auth/login -H "Content-Type: application/json" \
  -d '{"email":"ada@example.com","password":"<your-password>"}'
TOKEN=<paste data.accessToken here>

# 4. A protected endpoint (SystemUser policy): who am I?
curl -s $API/api/auth/me -H "Authorization: Bearer $TOKEN"

# 5. Create a location, then read its storefront without a token
curl -s -X POST $API/api/customer -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"companyName":"Demo Storage","contactFirstName":"Ada","contactLastName":"Lovelace","contactEmail":"ada@example.com","subdomain":"demo"}'
curl -s $API/api/public/demo

{
  "success": true,
  "message": "Login successful.",
  "data": {
    "accessToken": "<jwt>",
    "accessTokenExpiration": "2026-10-27T15:30:35Z",
    "user": {
      "id": "<guid>",
      "email": "ada@example.com",
      "role": "SuperAdmin",
      "permissions": ["Dashboard:View", "Users:View", "..."]
    }
  },
  "errors": null
}

• Passwords must be 8 to 128 characters, and confirmPassword must match. Anything else answers 400 with an error per field.
• The access token lasts 15 minutes. Sign-in also sets the HTTP-only mistorage-refresh-token cookie, which curl drops unless you keep a cookie jar, so simply sign in again when the token runs out.
• Creating a location answers 201. Customer is the API's name for a location. The new one is Active at once and gets an Owner login for its contact email. api/public/demo then returns its profile and size guide, with no units yet.
• Prefer a browser? Open Scalar at http://localhost:5179/scalar/v1 and send the same requests there, with the token as a bearer token for the protected ones.

NEXT_PUBLIC_API_URL=http://localhost:5179
API_URL=http://localhost:5179

npm install
npm run dev     # http://localhost:3000

Open http://localhost:3000/login and sign in as the HQ user you registered. The location you created is under Locations, and Manage Facility on its page opens that location's console. Its storefront is at /s/demo.

dotnet test         # backend: 249 xUnit tests, no database needed

npx tsc --noEmit    # web app: type check
npm run lint        # web app: eslint
npm run build       # web app: production build

• The backend tests run on EF's InMemory provider, so they need no PostgreSQL and finish in about 15 seconds. A green run says nothing about real SQL: raw SQL, deletes and column types need a real database to be believed.
• The web app has no test framework. tsc, eslint and next build are the whole safety net. At 5f50dea the type check is clean and lint reports 51 problems (8 errors), all of them older than this guide.