phenix-locationservice-api
Tiny ASP.NET Core 2.2 read-only API that searches the location/place tree (region, country, destination, place) via a single stored procedure for Phenix location lookups.
Health score
0 to 100 across seven weighted factors; nothing is hidden. Green is 75 and above, amber 50 to 74, red below 50. How scoring works.
Facts
| Languages | csharp |
| Frameworks | ASP.NET Core 2.2 |
| Runtimes | .NET Framework 4.6.1 |
| Tests / CI | some / CI in place |
| Last commit | 2021-01-07 |
| Owner | Owner unknown (mapping to be curated) |
| Domain | Content and destinations (system generated; curate in repo-owners.json to override) |
| Product area | Phenix |
| Hosted | On-prem Deployed to our own machines
|
| Releases | 3 release pipeline(s): \marketing\phenix-locationservice-api CI; \marketing\phenix-locationservice-api Stealth; \marketing\phenix-locationservice-api develop |
| Integration | rest, jwt |
| Source | Open in Azure DevOps |
Risk flags
Each flag links to its glossary definition.
Dependencies in context
Entanglement
loose No binding mechanisms apply: this system needs no untangling work.
Depends on / used by
Capability duplication
Part of the Location lookup family (retire): Dormant since 2021 with plaintext credentials
Migration playbooks
Generated from this repo's assessment data: what is feasible, what blocks it, and the steps in order. Ratings: green means actionable now, amber means sequence other work first, red means blocked, grey means not applicable.
ZDD adoption
Not applicableNot a deployed service (libraries, database definitions, desktop apps) or a retirement candidate not worth the investment. Retirement or consolidation candidate; do not invest in ZDD adoption.
SQL Server exit
Retire insteadThis repo is a retirement or consolidation candidate. Do not invest in a database migration; execute the retirement and the SQL Server dependency disappears with it.
Containerisation
Retire insteadThis repo is a retirement or consolidation candidate; containerising it would be investment in something we intend to switch off.
Recommended actions
Rotate the credentials committed to phenix-locationservice-api
Risk flags indicate credentials or keys in source (plaintext-credentials). Rotate now and enable secret scanning in CI; this is independent of all other work.
Impact: Closes a live security exposure at near-zero cost
proposedRetire phenix-locationservice-api
Dormant since 2021 with plaintext credentials. Part of the Location lookup consolidation: Confirm remaining consumers of phenix-locationservice-api, move them to phenix-place-repository, retire the legacy service and rotate its exposed credentials.
Impact: A migration never paid for, a pipeline decommissioned and an attack surface removed
proposedAssessment notes
phenix-locationservice-api
Purpose
A read-only location search API: one ReadController backed by a query-handler/repository pair that calls the dbo.LocationPlaceTree_SELECT stored procedure and returns place-tree rows (PlaceId, Region, CountryDestinationTree, Place). Effectively a thin lookup service for Phenix location autocomplete/search.
Tech stack
C# ASP.NET Core 2.2 MVC hosted on .NET Framework 4.6.1 (SDK-style csproj), Autofac DI, Swashbuckle 1.0 Swagger with API versioning, PhenixAuthLib JWT middleware for auth, raw System.Data.SqlClient data access (no ORM, no ConnectionBroker).
Deployment
prod_application with 3 releases. Build pipelines phenix-locationservice-api CI / release; release pipelines under \marketing\ (CI, Stealth, develop). YAML build exists (src/azure-pipelines.yml using the shared InternalOSS azure-pipelines-templates dotnet-core job). Deploys to IIS via PowerShell scripts in deployment/ including Dbdeploy-based SQL schema/script deployment and a Slack webhook notification.
Dependencies
No internal estate NuGet packages — only Microsoft/Autofac/Swashbuckle packages plus PhenixAuthLib (auth library, not an estate repo). External: New Relic (app name configured in live settings), Slack incoming webhook from deployment scripts.
Data stores
SQL Server BlogLocationsDatabase (connection string named Phenix) on per-environment servers (testqasql, preproductionsql, phenixsql). Access is stored-procedure only. Every environment's appsettings file checks in the same webuser/webuser SQL credentials in plain text.
Integration points
Inbound REST with JWT bearer auth (PhenixAuthLib middleware). No outbound service calls — a commented-out block referencing UserAccountService WCF endpoints suggests earlier plans that were never realised.
Code health
One xUnit test file (LocationPlaceTreeHandlerTests) covering the query handler with Moq — minimal coverage, none for the repository or controller. README is untouched Azure DevOps boilerplate. Dormant: last commit 2021-01-07, over five years ago, yet still released to production.
Modernisation risks
ASP.NET Core 2.2 on .NET Framework 4.6.1 is doubly end-of-life. Plaintext SQL credentials committed for all environments. The service is a single stored-procedure lookup — a strong candidate to fold into a larger .NET 8 location/place service (see phenix-place-repository) rather than upgrade in place. Medium priority: low change risk, but the surface it serves overlaps other place/location services.