diff --git a/src/BackendTutorial/Controllers/V1/TutorialController.cs b/src/BackendTutorial/Controllers/V1/TutorialController.cs
index 979789a..285dcb6 100644
--- a/src/BackendTutorial/Controllers/V1/TutorialController.cs
+++ b/src/BackendTutorial/Controllers/V1/TutorialController.cs
@@ -1,14 +1,22 @@
 using Asp.Versioning;
 using BackendTutorial.Events;
 using Infrastructure;
+using Infrastructure.Attributes;
 using Infrastructure.EventBus;
+using Infrastructure.HttpUserContext;
+using Infrastructure.Security;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace BackendTutorial.Controllers.V1;
 
 [ApiVersion("1.0")]
 [Route("tutorial/{version:apiVersion}")]
-public class TutorialController(ILogger<TutorialController> logger, IEventBus eventBus) : DefaultControllerBase
+public class TutorialController(
+    ILogger<TutorialController> logger,
+    IEventBus eventBus,
+    IUserContext<long> userContext
+) : DefaultControllerBase
 {
     [HttpGet("hello")]
     public async Task<MessageData<string>> HelloAsync()
@@ -17,11 +25,34 @@ public class TutorialController(ILogger<TutorialController> logger, IEventBus ev
         return await Task.Run(() => Succeed<string>("hello world"));
     }
 
-    [HttpPost("send")]
+    [HttpPost("send"), Idempotency(nameof(message))]
     public async Task<MessageData<string>> SendAsync(string message)
     {
         eventBus.Publish(new HelloWorldEvent(message));
         await Task.CompletedTask;
         return Succeed<string>("sent message");
     }
+
+    [HttpPost("token")]
+    public async Task<MessageData<JwtTokenInfo>> GetJwtTokenInfoAsync()
+    {
+        //mock 
+        userContext.Id = 89757L;
+        userContext.Username = "test";
+        userContext.Name = "test";
+        userContext.Email = "test@test.com";
+        userContext.RoleNames = ["consumer"];
+        userContext.RoleIds = ["89757"];
+        var jwtInfo = userContext.GenerateTokenInfo();
+        await Task.CompletedTask;
+        return Succeed(jwtInfo);
+    }
+
+    [Authorize(Policy = "authorize")]
+    [HttpGet("authorize")]
+    public async Task<MessageData> AuthorizeAsync()
+    {
+        await Task.CompletedTask;
+        return Succeed();
+    }
 }
\ No newline at end of file