I am building my first ASP.NET Web API Microservices and I am wondering what are the best practices when it comes to access modifiers for classes in each API, so that classes can only access the classes within their API.
Currently, I've made all my classes for each API internal, where possible. I think the only classes that are public are the controllers. Other than this - the concrete class, which contains the db CRUD operations, is internal. Every class with business logic, security logic (authentication, authorization), too. Also, for my business logic classes I chose more granular approach - I use CQRS design patterns and I have many interfaces. The interfaces are left public because, when injected into the controller classes and change the controller constructor to internal it stops working. So all controller injected classes are left public.