tc-permissions-api
ASP.NET Core 8 API that decides whether a user/team may view or edit an entity (booking, quote, customer), backed by MongoDB permission records with team-aware role expansion.
Health score
0 to 100 across seven weighted factors; nothing is hidden. Green is 75 and above, amber 50 to 74, red below 50. How scoring works.
Facts
| Languages | csharp |
| Frameworks | ASP.NET Core 8, MediatR 12, FluentValidation 11, Swashbuckle/NSwag, GraphQL.Client |
| Runtimes | .NET 8 |
| Tests / CI | some / CI in place |
| Last commit | 2025-06-10 |
| Owner | Owner unknown (mapping to be curated) |
| Domain | Identity and access (system generated; curate in repo-owners.json to override) |
| Product area | Shared platform |
| Hosted | On-prem Deployed to our own machines
|
| Releases | 1 release pipeline(s): tc-permissions-api |
| Integration | rest, graphql, jwt |
| Source | Open in Azure DevOps |
Dependencies in context
Entanglement
loose No binding mechanisms apply: this system needs no untangling work.
Migration playbooks
Generated from this repo's assessment data: what is feasible, what blocks it, and the steps in order. Ratings: green means actionable now, amber means sequence other work first, red means blocked, grey means not applicable.
ZDD adoption
Ready with guardrailsClose: the deployment path exists, but specific checks are needed first, typically raising tests, auditing serialized data, or respecting a shared schema with expand and contract. Test coverage is thin; ZDD shifts the safety net onto automation.
- 1 system(s) depend on this repo; during a rolling deploy they will talk to old and new versions at once, so responses must stay compatible
- Adopt the four-stage discipline from the ZDD engineering standard: pre-deployment compatibility, deployment, feature activation behind a flag, post-release cleanup.
- Raise automated test coverage first: ZDD trades the end-of-sprint manual gate for continuous automated confidence, so the tests are the entry ticket.
- Make every change dual-version safe: backwards-compatible APIs (new major version for breaking wire changes), expand and contract for any schema change, and consumers tolerant of unknown fields.
- Audit serialized data: anything in Redis, queues or shared caches must deserialize cleanly across adjacent versions.
- Wrap behaviour changes in feature flags so code deploys dark and release becomes a business decision, not a deployment event.
- Route deployments through the Workflow Engine's automated drain, deploy, health-check, return cycle (the path proven by the first automated production run in mid-2026).
- Verify with area-scoped regression rather than the whole-platform cycle, and watch error rates after rollout with automated rollback on alert.
SQL Server exit
Not applicableNo SQL Server dependency is recorded for this repo. Nothing to migrate.
Containerisation
Ready to containeriseModern runtime, no hosted legacy transport: this service can follow the estate's proven container path (Dockerfile, shared pipeline template, ECS via Terraform).
- Add a Dockerfile and make the app read all configuration from environment variables and the secrets manager, never from machine-local files.
- Log to stdout and expose a health check endpoint so ECS can supervise it.
- Adopt the shared ci.yml pipeline template with the container parameters (awsRegion, containerAfterBuild, ecsTerraformRepo), which is exactly how the estate's existing AWS services deploy.
- Define the service in the Terraform repo, deploy to a non-production environment, then shift traffic and disarm the deployment-group release pipeline.
Recommended actions
No specific actions for this repo. It either needs only normal maintenance, or its work is covered by an estate-level action. See the full programme.
Assessment notes
tc-permissions-api
Purpose
Central permissions decision point for the Phenix estate: single or batched requests of {teamId, salesPersonId, entityType, entityId, action} are evaluated against permission documents in MongoDB, with role expansion, team lookups via the teams API, and Phenix-booking-to-team resolution via the Accounts GraphQL API. It publishes TC.Permissions.Contract and an NSwag-generated TC.Permissions.Api.Client for consumers (e.g. tc-gift-registry).
Tech stack
C# on .NET 8, layered solution (API, Application, DataAccess, Contract, Api.Client, TeamsApiIntegration, AccountsGraphQLIntegration). MediatR handlers with validation and in-memory caching pipeline behaviours, FluentValidation, Asp.Versioning, Swashbuckle plus checked-in swagger spec, PhenixAuth JWT plus a TC API-key filter, TC.ConnectionBroker (Api/HttpClient/Mongo), health checks for the database, teams API and GraphQL endpoint.
Deployment
Included as prod_application with 1 release: release pipeline tc-permissions-api from build tc-permissions-api. YAML CI via shared templates (SDK 8.x) building the API and packing the Contract and Api.Client packages. Per-environment appsettings (qa, training, preproduction, live, liveproviderqa, datafixqa); IIS web.config present, New Relic app naming under the Phenix API umbrella.
Dependencies
Internal: TC.ConnectionBroker.* (tc-connectionbroker), TC.Exceptions.WebApiClient.AspNetCore (webapi-exceptions), TC.Teams.Contracts (teams-service) for team membership, and the TC Accounts GraphQL API for booking-to-team resolution (source repo not identifiable in included.json). External: New Relic APM.
Data stores
Owns the Permissions MongoDB database plus a permissions_logs Mongo database for request/response logging, accessed through brokered Mongo connections.
Integration points
REST/JSON API (versioned, Swagger, generated client) secured with PhenixAuth JWT and an API-key filter; outbound REST to the teams API and outbound GraphQL to the Accounts API.
Code health
Two test projects (Application unit tests and API integration tests) totalling ~29 xunit tests — real but modest coverage for an authorisation-critical service. README documents the request model and design (copied from the development-guides wiki). Last commit 2025-06-10; head-office salesperson IDs are hardcoded in appsettings.
Modernisation risks
Low on stack (modern .NET 8, YAML CI). The risk profile is operational rather than technical: it is an authorisation service other repos depend on (high fan-in via its client package), so its modest test coverage and the hardcoded head-office ID list in configuration deserve hardening; caching behaviour on permission queries also needs care around staleness after permission updates.