Update README, solution, and add coding guidelines

Updated README.md to clarify `/api/auth/qrcode` usage and adjusted a link to the correct line range. Modified TwoFactorAuthenticationSample.sln to include new solution items: `.github\copilot-instructions.md` and `README.md`. Made a minor change in Program.cs to safely access the `Name` property using the null-forgiving operator. Added `copilot-instructions.md` with comprehensive coding guidelines and best practices.

Author: marcominerva

.github/copilot-instructions.md

@@ -0,0 +1,84 @@
+## General
+
+- Make only high confidence suggestions when reviewing code changes.
+- Always use the latest version C#, currently C# 13 features.
+- Write code that is clean, maintainable, and easy to understand.
+- Only add comments rarely to explain why a non-intuitive solution was used. The code should be self-explanatory otherwise.
+- Don't add the UTF-8 BOM to files unless they have non-ASCII characters.
+- Never change global.json unless explicitly asked to.
+- Never change package.json or package-lock.json files unless explicitly asked to.
+- Never change NuGet.config files unless explicitly asked to.
+
+## Code Style
+
+### Formatting
+
+- Apply code-formatting style defined in `.editorconfig`.
+- Use primary constructors where applicable.
+- Prefer file-scoped namespace declarations and single-line using directives.
+- Insert a newline before the opening curly brace of any code block (e.g., after `if`, `for`, `while`, `foreach`, `using`, `try`, etc.).
+- Ensure that the final return statement of a method is on its own line.
+- Use pattern matching and switch expressions wherever possible.
+- Prefer using collection expressions when possible
+- Use `is` pattern matching instead of `as` and null checks
+- Use `nameof` instead of string literals when referring to member names.
+- Prefer `?.` if applicable (e.g. `scope?.Dispose()`).
+- Use `ObjectDisposedException.ThrowIf` where applicable.
+- Use `ArgumentNullException.ThrowIfNull` to validate input parameters.
+- If you add new code files, ensure they are listed in the csproj file (if other files in that folder are listed there) so they build.
+
+### Nullable Reference Types
+
+- Declare variables non-nullable, and check for `null` at entry points.
+- Always use `is null` or `is not null` instead of `== null` or `!= null`.
+- Trust the C# null annotations and don't add null checks when the type system says a value cannot be null.
+
+## Architecture and Design Patterns
+
+### Asynchronous Programming
+
+- Provide both synchronous and asynchronous versions of methods where appropriate.
+- Use the `Async` suffix for asynchronous methods.
+- Return `Task` or `ValueTask` from asynchronous methods.
+- Use `CancellationToken` parameters to support cancellation.
+- Avoid async void methods except for event handlers.
+- Call `ConfigureAwait(false)` on awaited calls to avoid deadlocks.
+
+### Error Handling
+
+- Use appropriate exception types. 
+- Include helpful error messages.
+- Avoid catching exceptions without rethrowing them.
+
+### Performance Considerations
+
+- Be mindful of performance implications, especially for database operations.
+- Avoid unnecessary allocations.
+- Consider using more efficient code that is expected to be on the hot path, even if it is less readable.
+
+### Implementation Guidelines
+
+- Write code that is secure by default. Avoid exposing potentially private or sensitive data.
+- Make code NativeAOT compatible when possible. This means avoiding dynamic code generation, reflection, and other features that are not compatible with NativeAOT. If not possible, mark the code with an appropriate annotation or throw an exception.
+
+## Documentation
+
+- Include XML documentation for all public APIs. Mention the purpose, intent, and 'the why' of the code, so developers unfamiliar with the project can better understand it. If comments already exist, update them to meet the before mentioned criteria if needed. Use the full syntax of XML Doc Comments to make them as awesome as possible including references to types. Don't add any documentation that is obvious for even novice developers by reading the code.
+- Add proper `<remarks>` tags with links to relevant documentation where helpful.
+- For keywords like `null`, `true` or `false` use `<see langword="*" />` tags.
+- Include code examples in documentation where appropriate.
+- Overriding members should inherit the XML documentation from the base type via `/// <inheritdoc />`.
+
+## Markdown
+- Use Markdown for documentation files (e.g., README.md).
+- Use triple backticks for code blocks, JSON snippets and bash commands, specifying the language (e.g., ```csharp, ```json and ```bash).
+
+## Testing
+
+- When adding new unit tests, strongly prefer to add them to existing test code files rather than creating new code files.
+- We use xUnit SDK v3 for tests.
+- Do not emit "Act", "Arrange" or "Assert" comments.
+- Use NSubstitute for mocking in tests.
+- Copy existing style in nearby files for test method names and capitalization.
+- When running tests, if possible use filters and check test run counts, or look at test logs, to ensure they actually ran.
+- Do not finish work with any tests commented out or disabled that were not previously commented out or disabled.

README.md

@@ -11,12 +11,12 @@ A sample that showcases how to implement Two-Factor authentication in a Web API
 
 - Call `/api/auth/register` to register a new user
 - Call `/api/auth/login` to get a user token (this is not the JWT and expires after 5 minutes)
-- Call `/api/auth/qrcode` with the user token to get the QR Code to add the account to the Authenticator app (note: the QR Code can be obtain only once, this is by design in this sample)
+- Call `/api/auth/qrcode?token={userToken}` with the user token as query parameter to get the QR Code to add the account to the Authenticator app (note: the QR Code can be obtained only once, this is by design in this sample)
 - Call `/api/auth/validate` with the user token and the OTP code to get the actual JWT
 
 The built-in support for Two-Factor authentication in ASP.NET Core lacks some features. We may want to handle the other options that are provided by the [RFC 6238](http://tools.ietf.org/html/rfc6238), for example:
 
 - Getting the time step of OTP verification to check that the code has only been validated once
 - Defining the window of time steps that are considered [acceptable](http://tools.ietf.org/html/rfc6238#section-5.2) for validation
 
-In this case, it is possible to take a look to [Otp.Net](https://github.com/kspearrin/Otp.NET) and use it to implement the [OTP verification](https://github.com/marcominerva/TwoFactorAuthenticationSample/blob/master/TwoFactorAuthenticationSample/Program.cs#L169-L174).
+In this case, it is possible to take a look to [Otp.Net](https://github.com/kspearrin/Otp.NET) and use it to implement the [OTP verification](https://github.com/marcominerva/TwoFactorAuthenticationSample/blob/master/TwoFactorAuthenticationSample/Program.cs#L164-L169).

TwoFactorAuthenticationSample.sln

@@ -10,7 +10,9 @@ EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{8318F92C-DC77-448B-9C8B-7784D580D488}"
 	ProjectSection(SolutionItems) = preProject
 		.editorconfig = .editorconfig
+		.github\copilot-instructions.md = .github\copilot-instructions.md
 		Directory.Build.props = Directory.Build.props
+		README.md = README.md
 	EndProjectSection
 EndProject
 Global

TwoFactorAuthenticationSample/Program.cs

@@ -179,7 +179,7 @@
 
 app.MapGet("/api/me", (ClaimsPrincipal user) =>
 {
-    return TypedResults.Ok(new User(user.Identity!.Name));
+    return TypedResults.Ok(new User(user.Identity!.Name!));
 })
 .RequireAuthorization();