wallymathieu / auctions-api-csharp Goto Github PK

https://endjin.com/blog/2022/09/bye-bye-azure-functions-hello-azure-container-apps-part-2-migrating-from-azure-functions-to-asp-net-core

Perhaps there is the point around cost.

If you assume that the web API should be able to be scaled vertically in app services then it makes sense to avoid background services and workers in the API.

https://github.com/khellang/Scrutor

We get the following error when trying to migrate the DB using SqlLite as the database:

SQLite Error 1: 'AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY'.

• Make sure that migrations can be run against an empty db
• Make sure that different Api spec can be run against say testcontainer

https://github.com/testcontainers/testcontainers-dotnet/blob/main/docs/examples/aspnet.md

It is not uncommon to want to use CDN for static or relatively static content.

The test authorization should register as an authorization scheme in order for standard API behaviour to work.

CREATE TABLE [dbo].[Auctions](
	[AuctionId] [bigint] IDENTITY(1,1) NOT NULL,
	[Options_ReservePrice] [bigint] NOT NULL,
	[Options_MinRaise] [bigint] NOT NULL,
	[Options_TimeFrame] [time](7) NOT NULL,
	[EndsAt] [datetimeoffset](7) NULL,
	[StartsAt] [datetimeoffset](7) NOT NULL,
	[Title] [nvarchar](200) NOT NULL,
	[Expiry] [datetimeoffset](7) NOT NULL,
	[User] [nvarchar](2000) NOT NULL,
	[Currency] [int] NOT NULL
) ON [PRIMARY]
GO
ALTER TABLE [dbo].[Auctions] ADD  CONSTRAINT [PK_Auctions] PRIMARY KEY CLUSTERED 
(
	[AuctionId] ASC
)WITH (STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ONLINE = OFF, OPTIMIZE_FOR_SEQUENTIAL_KEY = OFF) ON [PRIMARY]
GO

CREATE TABLE [dbo].[Bids](
	[Id] [bigint] IDENTITY(1,1) NOT NULL,
	[User] [nvarchar](2000) NOT NULL,
	[Amount_Value] [bigint] NOT NULL,
	[Amount_Currency] [int] NOT NULL,
	[At] [datetimeoffset](7) NOT NULL,
	[TimedAscendingAuctionAuctionId] [bigint] NULL
) ON [PRIMARY]
GO
ALTER TABLE [dbo].[Bids] ADD  CONSTRAINT [PK_Bids] PRIMARY KEY CLUSTERED 
(
	[Id] ASC
)WITH (STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ONLINE = OFF, OPTIMIZE_FOR_SEQUENTIAL_KEY = OFF) ON [PRIMARY]
GO
CREATE NONCLUSTERED INDEX [IX_Bids_TimedAscendingAuctionAuctionId] ON [dbo].[Bids]
(
	[TimedAscendingAuctionAuctionId] ASC
)WITH (STATISTICS_NORECOMPUTE = OFF, DROP_EXISTING = OFF, ONLINE = OFF, OPTIMIZE_FOR_SEQUENTIAL_KEY = OFF) ON [PRIMARY]
GO
ALTER TABLE [dbo].[Bids]  WITH CHECK ADD  CONSTRAINT [FK_Bids_Auctions_TimedAscendingAuctionAuctionId] FOREIGN KEY([TimedAscendingAuctionAuctionId])
REFERENCES [dbo].[Auctions] ([AuctionId])
GO
ALTER TABLE [dbo].[Bids] CHECK CONSTRAINT [FK_Bids_Auctions_TimedAscendingAuctionAuctionId]
GO

NOTE:
TimedAscendingAuctionAuctionId should be AuctionId

[Amount_Currency] [int] NOT NULL, should be nvarchar.

2023-05-01 16:57:27        ---> Microsoft.Azure.WebJobs.Script.Workers.WorkerProcessExitException: dotnet exited with code 133 (0x85)
2023-05-01 16:57:27        ---> System.Exception: assertion failed [result.value != EEXIST]: VmTracker attempted to allocate existing mapping

See docker/roadmap#384

Hexagonal architecture is a common architecture pattern. For line of business application, matching a common pattern can helpful since it allows you use something a bit more standard.

In order to allow users to connect to the API you need an identity provider that can handle authentication and serve up user information to the API. Sample identity providers are:

• Identity Server
• Azure AD B2C
• KeyCloak
• auth0

and many others. It would be preferable to have a situation where you can have a pluggable identity provider that you use in PROD.

In order to have easy time developing the API you need to make it easy for the developers to do DEV-authenticated requests.

Potential solutions:

• Impersonification: either by having JWT token generator or part of the identity provider
• Dev only API keys (often frowned upon)
• "Principal" header as seen with x-ms-client-principal.
• Payload part of JWT token in "x-jwt-payload". I've seen decoded JWT tokens in Envoy and NGinx

In order to verify that the API returns the correct result when there is no auction, make sure to add tests that verify the default expected behaviour (that the endpoint returns 404 not found).

Right now the tests against the Web API only tests the case of the non "async" style code flow. Since the App is configurable to be able to do both queue based "async" style and "sync" style.

In order to make the API more useful it would make sense to let "async" flow return 202 Accepted with a response id (either a temporary ID or an ID that gets generated immediately in the controller) that can be used to query the API for further status of resource creation/update.

For client applications it would make more sense to use web socket based server sent events since then you can avoid having your own web clients waste your resources by doing something akin to DDOS.

Take inspiration from

https://github.com/Azure-Samples/todo-csharp-cosmos-sql
https://github.com/Azure-Samples/todo-csharp-sql-swa-func

Looks interesting : https://github.com/martinothamar/Mediator

Use internationalization of content through some means

Alternatives:

• i18n json
• resx
• PO-file

https://learn.microsoft.com/en-us/sql/t-sql/data-types/rowversion-transact-sql?view=sql-server-ver15
should use timestamp to avoid consistency issues.

https://learn.microsoft.com/en-us/azure/architecture/guide/architecture-styles/web-queue-worker

• queue using azure storage queue
• cache using redis
• database using sql server
• worker in function app

In order to protect secrets you should provide a secrets provider that deals with secrets and can rotate passwords. One way of doing that is by using KeyVault in Azure.
See source code from reliable-web-app-pattern-dotnet that seems to have nicely documented template of how it should look:
https://github.com/Azure/reliable-web-app-pattern-dotnet/blob/main/infra/resources.bicep#L68-L207

https://github.com/Azure-Samples/todo-csharp-cosmos-sql/blob/main/infra/main.bicep#L91-L99

https://learn.microsoft.com/en-us/azure/architecture/guide/architecture-styles/event-driven