SluijsensandClaude Sonnet 5
cfb06b28b6
Continuous Integration / config (pull_request) Successful in 12s
Continuous Integration / changes (pull_request) Successful in 22s
Continuous Integration / backend-build (pull_request) Successful in 5m53s
Continuous Integration / vulnerability-scan (pull_request) Successful in 5m46s
Continuous Integration / frontend-prepare (pull_request) Successful in 1m54s
Continuous Integration / backend-test (pull_request) Successful in 7m37s
Continuous Integration / frontend-build (pull_request) Successful in 2m14s
Continuous Integration / frontend-test (pull_request) Successful in 4m59s
Continuous Integration / frontend-lint (pull_request) Successful in 2m2s
Continuous Integration / publish-production (pull_request) Skipped
Continuous Integration / deploy-production (pull_request) Skipped
Continuous Integration / publish-test (pull_request) Successful in 7m34s
Continuous Integration / deploy-test (pull_request) Skipped
Implements Unit 2 "Offerings" (backend module, admin CRUD UI with drag-and-drop reordering, public GET /api/v1/offerings endpoint) and executes the feature's D-15 CI/CD cutover, switching the deploy pipeline's build/publish target from SlpModularCms.Api to SlpModularCms.Api.SlpSoftware. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FWyStNL2ZsjrS7FLd7xvvN
1.7 KiB
1.7 KiB
Tech Stack Decisions — Unit: Offerings
New Backend Technology: None
No new package, library, or infrastructure is introduced for this unit. Offerings reuses the existing stack end-to-end:
- EF Core + Pomelo MySql provider against the existing MariaDB instance (same server, isolated logical database per environment, same pattern as every other module)
- ASP.NET Core rate limiting middleware (already registered via
AddCmsRateLimiting) — extended with one new named policy, not a new mechanism - Standard
ILogger<T>structured logging — extended with routineLogInformationcalls inOfferingsService, not a new logging mechanism (see NFR-OFF-03's explicit rejection of extendingSecurityEvents) - xUnit + FluentAssertions + NSubstitute + coverlet for tests — same as every existing module's test project
Rate Limiting Policy Addition
Per NFR-OFF-01 (NFR Requirements Q1 = A), one new named policy is added to the existing AddCmsRateLimiting extension:
| Policy Name | Applies To | Config Section | Notes |
|---|---|---|---|
offerings-public |
GET /api/v1/offerings (public, anonymous) only |
RateLimiting:OfferingsPublic (new) |
Follows the exact PermitLimit/WindowSeconds shape used by RateLimiting:Login/RateLimiting:Refresh/RateLimiting:SentryTunnel. FixedWindowLimiter, matching the existing policies' limiter type. |
Admin CRUD endpoints (POST/PUT/DELETE on /api/v1/offerings) get no dedicated policy in this unit — they're already behind AdminOnly authentication (Q1 = A explicitly scoped rate limiting to the public endpoint only).
Exact PermitLimit/WindowSeconds default values are deferred to Code Generation Planning, to be set generous enough not to affect legitimate anonymous website traffic.