Changed the encription key for response

Marco.Pms.Services/Controllers/AppMenuController.cs

@@ -17,6 +17,7 @@ namespace Marco.Pms.Services.Controllers
 {
     [Authorize]
     [ApiController]
+    [EncryptResponse]
     [Route("api/[controller]")]
     public class AppMenuController : ControllerBase
     {

Marco.Pms.Services/Controllers/AttendanceController.cs

@@ -26,6 +26,7 @@ namespace MarcoBMS.Services.Controllers
 {
     [Authorize]
     [ApiController]
+    [EncryptResponse]
     [Route("api/[controller]")]
     public class AttendanceController : ControllerBase
     {

Marco.Pms.Services/Controllers/AuthController.cs

@@ -22,6 +22,7 @@ using System.Text;
 namespace MarcoBMS.Services.Controllers
 {
     [ApiController]
+    [EncryptResponse]
     [Route("api/[controller]")]
     public class AuthController : ControllerBase
     {

Marco.Pms.Services/Controllers/CollectionController.cs

@@ -28,9 +28,11 @@ using Invoice = Marco.Pms.Model.Collection.Invoice;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
+
     public class CollectionController : ControllerBase
     {
         private readonly IDbContextFactory<ApplicationDbContext> _dbContextFactory;

Marco.Pms.Services/Controllers/DashboardController.cs

@@ -16,8 +16,9 @@ using System.Globalization;
 namespace Marco.Pms.Services.Controllers
 {
     [Authorize]
-    [Route("api/[controller]")]
     [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class DashboardController : ControllerBase
     {
         private readonly ApplicationDbContext _context;

Marco.Pms.Services/Controllers/DirectoryController.cs

@@ -7,9 +7,10 @@ using Microsoft.AspNetCore.Mvc;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [ApiController]
-    [Route("api/[controller]")]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
 
     public class DirectoryController : ControllerBase
     {

Marco.Pms.Services/Controllers/DocumentController.cs

@@ -24,9 +24,10 @@ using Document = Marco.Pms.Model.DocumentManager.Document;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class DocumentController : ControllerBase
     {
         private readonly IDbContextFactory<ApplicationDbContext> _dbContextFactory;

Marco.Pms.Services/Controllers/EmployeeController.cs

@@ -26,9 +26,10 @@ using System.Net;
 
 namespace MarcoBMS.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
 
     public class EmployeeController : ControllerBase
     {

Marco.Pms.Services/Controllers/ExpenseController.cs

@@ -7,9 +7,10 @@ using Microsoft.AspNetCore.Mvc;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class ExpenseController : ControllerBase
     {
         private readonly UserHelper _userHelper;

Marco.Pms.Services/Controllers/FeatureController.cs

@@ -6,14 +6,16 @@ using Marco.Pms.Model.ViewModels.Master;
 using Marco.Pms.Services.Helpers;
 using MarcoBMS.Services.Helpers;
 using MarcoBMS.Services.Service;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
 namespace MarcoBMS.Services.Controllers
 {
-    [Route("api/[controller]")]
+    [Authorize]
     [ApiController]
-    // [Authorize]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class FeatureController : ControllerBase
     {
         private readonly ApplicationDbContext _context;

Marco.Pms.Services/Controllers/FileController.cs

@@ -4,8 +4,9 @@ using Microsoft.AspNetCore.Mvc;
 
 namespace MarcoBMS.Services.Controllers
 {
-    [Route("api/[controller]")]
     [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class FileController : ControllerBase
     {
         private readonly ApplicationDbContext _context;

Marco.Pms.Services/Controllers/ForumController.cs

@@ -19,6 +19,7 @@ namespace Marco.Pms.Services.Controllers
 {
     [Authorize]
     [ApiController]
+    [EncryptResponse]
     [Route("api/[controller]")]
     public class ForumController : ControllerBase
     {

Marco.Pms.Services/Controllers/ImageController.cs

@@ -18,9 +18,10 @@ using System.Text.Json;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class ImageController : ControllerBase
     {
         private readonly IDbContextFactory<ApplicationDbContext> _dbContextFactory;

Marco.Pms.Services/Controllers/LogController.cs

@@ -8,8 +8,9 @@ using System.Text.Json;
 namespace Marco.Pms.Services.Controllers
 {
     [Authorize]
-    [Route("api/[controller]")]
     [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class LogController : ControllerBase
     {
         private readonly ILogger<LogController> _logger;

Marco.Pms.Services/Controllers/MarketController.cs

@@ -14,8 +14,9 @@ using Microsoft.EntityFrameworkCore;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [Route("api/[controller]")]
     [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class MarketController : ControllerBase
     {
         private readonly IDbContextFactory<ApplicationDbContext> _dbContextFactory;

Marco.Pms.Services/Controllers/MasterController.cs

@@ -20,8 +20,9 @@ using Microsoft.EntityFrameworkCore;
 namespace Marco.Pms.Services.Controllers
 {
     [Authorize]
-    [Route("api/[controller]")]
     [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class MasterController : ControllerBase
     {
         private readonly ApplicationDbContext _context;

Marco.Pms.Services/Controllers/OrganizationController.cs

@@ -8,9 +8,10 @@ using Microsoft.EntityFrameworkCore;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class OrganizationController : ControllerBase
     {
         private readonly IDbContextFactory<ApplicationDbContext> _dbContextFactory;

Marco.Pms.Services/Controllers/PaymentController.cs

@@ -7,8 +7,9 @@ using Microsoft.AspNetCore.Mvc;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [Route("api/[controller]")]
     [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class PaymentController : ControllerBase
     {
         private readonly UserHelper _userHelper;

Marco.Pms.Services/Controllers/ProjectController.cs

@@ -13,9 +13,10 @@ using MongoDB.Driver;
 
 namespace MarcoBMS.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class ProjectController : ControllerBase
     {
         private readonly IProjectServices _projectServices;

Marco.Pms.Services/Controllers/ReportController.cs

@@ -17,9 +17,10 @@ using System.Net.Mail;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class ReportController : ControllerBase
     {
         private readonly IDbContextFactory<ApplicationDbContext> _dbContextFactory;

Marco.Pms.Services/Controllers/RolesController.cs

@@ -20,9 +20,10 @@ using System.Data;
 #nullable disable
 namespace MarcoBMS.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class RolesController : ControllerBase
     {
         private readonly ApplicationDbContext _context;

Marco.Pms.Services/Controllers/ServiceProjectController.cs

@@ -10,9 +10,10 @@ using Microsoft.AspNetCore.Mvc;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [ApiController]
-    [Route("api/[controller]")]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class ServiceProjectController : Controller
     {
         private readonly IServiceProject _serviceProject;

Marco.Pms.Services/Controllers/TaskController.cs

@@ -24,9 +24,10 @@ using Document = Marco.Pms.Model.DocumentManager.Document;
 namespace MarcoBMS.Services.Controllers
 {
 
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class TaskController : ControllerBase
     {
         private readonly ApplicationDbContext _context;

Marco.Pms.Services/Controllers/TenantController.cs

@@ -30,9 +30,10 @@ using System.Text.Json;
 
 namespace Marco.Pms.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
     public class TenantController : ControllerBase
     {
         private readonly IDbContextFactory<ApplicationDbContext> _dbContextFactory;

Marco.Pms.Services/Controllers/UserController.cs

@@ -14,9 +14,10 @@ using System.Net.Mail;
 
 namespace MarcoBMS.Services.Controllers
 {
-    [Route("api/[controller]")]
-    [ApiController]
     [Authorize]
+    [ApiController]
+    [EncryptResponse]
+    [Route("api/[controller]")]
 
     public class UserController : ControllerBase
     {

Marco.Pms.Services/Extensions/EncryptResponseAttribute.cs

@@ -0,0 +1,134 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Serialization;
+using System.Security.Cryptography;
+using System.Text;
+
+public class EncryptResponseAttribute : TypeFilterAttribute
+{
+    public EncryptResponseAttribute() : base(typeof(EncryptResponseFilter))
+    {
+    }
+
+    private class EncryptResponseFilter : IAsyncResultFilter
+    {
+        // 32-byte Key
+        //private readonly string _keyBase64 = "h9J4kL2mN5pQ8rS1tV3wX6yZ0aB7cD9eF1gH3jK5mN6=";
+        private readonly string _keyBase64 = "u4J7p9Qx2hF5vYtLz8Kq3mN1sG0bRwXyZcD6eH8jFQw=";
+
+        public async Task OnResultExecutionAsync(ResultExecutingContext context, ResultExecutionDelegate next)
+        {
+            // 1. EXECUTE THE CONTROLLER FIRST
+            // We let the controller run to populate context.Result
+            // Note: We are intercepting *before* the response goes to the client.
+
+            try
+            {
+                if (context.Result is ObjectResult objectResult && objectResult.Value != null)
+                {
+                    // 2. SERIALIZE (Safe Settings)
+                    var settings = new JsonSerializerSettings
+                    {
+                        ContractResolver = new CamelCasePropertyNamesContractResolver(),
+                        ReferenceLoopHandling = ReferenceLoopHandling.Ignore,
+                        NullValueHandling = NullValueHandling.Ignore
+                    };
+
+                    var plainJson = JsonConvert.SerializeObject(objectResult.Value, settings);
+
+                    // 3. ENCRYPT ASYNC (Prevents Thread Blocking 502)
+                    var encryptedText = await EncryptAsync(plainJson);
+
+                    // 4. RETURN CONTENT RESULT
+                    // Use ContentResult to send raw text. 
+                    // OkObjectResult would try to JSON-serialize the string again (adding quotes).
+                    context.Result = new ContentResult
+                    {
+                        Content = encryptedText,
+                        ContentType = "text/plain",
+                        StatusCode = 200
+                    };
+                }
+            }
+            catch (Exception ex)
+            {
+                // FAIL-SAFE LOGGING
+                Console.WriteLine($"Encryption Crashed: {ex.Message}");
+                // We do NOT modify context.Result here. 
+                // The original unencrypted ObjectResult will flow through to the client.
+                // This ensures the user gets DATA, not a 502.
+            }
+
+            await next();
+        }
+
+        private async Task<string> EncryptAsync(string plainText)
+        {
+            if (string.IsNullOrEmpty(plainText)) return plainText;
+
+            using var aes = Aes.Create();
+            aes.Key = Convert.FromBase64String(_keyBase64);
+            aes.GenerateIV();
+            aes.Mode = CipherMode.CBC;
+            aes.Padding = PaddingMode.PKCS7;
+
+            // 1. Convert string to bytes directly (Avoids StreamWriter encoding issues)
+            var plainBytes = Encoding.UTF8.GetBytes(plainText);
+
+            using var ms = new MemoryStream();
+
+            // 2. Write IV (16 bytes)
+            ms.Write(aes.IV, 0, aes.IV.Length);
+
+            using (var encryptor = aes.CreateEncryptor(aes.Key, aes.IV))
+            using (var cs = new CryptoStream(ms, encryptor, CryptoStreamMode.Write))
+            {
+                // 3. Write Data
+                await cs.WriteAsync(plainBytes, 0, plainBytes.Length);
+
+                // 4. CRITICAL: Flush the final block (Padding) to the MemoryStream
+                // Without this, Dart receives incomplete data and throws "Invalid Padding"
+                cs.FlushFinalBlock();
+            }
+
+            // 5. Convert full stream to Base64
+            return Convert.ToBase64String(ms.ToArray());
+        }
+
+        //private async Task<string> EncryptAsync(string plainText)
+        //{
+        //    if (string.IsNullOrEmpty(plainText)) return plainText;
+
+        //    using var aes = Aes.Create();
+        //    aes.Key = Convert.FromBase64String(_keyBase64);
+        //    aes.GenerateIV();
+        //    aes.Mode = CipherMode.CBC;
+        //    aes.Padding = PaddingMode.PKCS7;
+
+        //    // We do NOT use 'using' on the MemoryStream here yet, 
+        //    // because we need to read from it after the CryptoStream finishes.
+        //    using var ms = new MemoryStream();
+
+        //    // Write IV first (16 bytes)
+        //    ms.Write(aes.IV, 0, aes.IV.Length);
+
+        //    using (var encryptor = aes.CreateEncryptor(aes.Key, aes.IV))
+        //    using (var cs = new CryptoStream(ms, encryptor, CryptoStreamMode.Write))
+        //    using (var sw = new StreamWriter(cs))
+        //    {
+        //        // CRITICAL FIX: Use Async Write
+        //        await sw.WriteAsync(plainText);
+
+        //        // Flush the writer, but do not close the underlying streams yet via 'using' exit
+        //        await sw.FlushAsync();
+        //    }
+
+        //    // At this point, CryptoStream is closed (disposed by using block), 
+        //    // causing the final block to be flushed to MemoryStream.
+        //    // MemoryStream is technically closed, but .NET allows ToArray() on closed MemoryStreams.
+
+        //    return Convert.ToBase64String(ms.ToArray());
+        //}
+    }
+}