tc-public-assets-api
.NET 8 API managing public-website asset storage in S3 — issuing pre-signed upload/download URLs across four buckets with per-caller access management — plus a Thumbor container for on-the-fly image resizing.
Health score
0 to 100 across seven weighted factors; nothing is hidden. Green is 75 and above, amber 50 to 74, red below 50. How scoring works.
Facts
| Languages | csharp |
| Frameworks | ASP.NET Core 8, MediatR, Thumbor |
| Runtimes | .NET 8 |
| Tests / CI | good / CI in place |
| Last commit | 2026-05-29 |
| Owner | Owner unknown (mapping to be curated) |
| Domain | Content and destinations (system generated; curate in repo-owners.json to override) |
| Product area | Shared platform |
| Hosted | AWS Deployed to AWS
|
| Releases | 0 release pipeline(s): |
| Integration | rest, jwt |
| Source | Open in Azure DevOps |
Dependencies in context
Entanglement
loose No binding mechanisms apply: this system needs no untangling work.
Depends on / used by
Migration playbooks
Generated from this repo's assessment data: what is feasible, what blocks it, and the steps in order. Ratings: green means actionable now, amber means sequence other work first, red means blocked, grey means not applicable.
ZDD adoption
No excuseNothing technical is holding this repo on the three-week release. It either already deploys without downtime (AWS) or is a modern, well-tested service the automated stealth path can carry today. Already deploys as a container to AWS, which releases without downtime today. Separating it from the three-week release is a process decision, not a technical one.
- 1 system(s) depend on this repo; during a rolling deploy they will talk to old and new versions at once, so responses must stay compatible
- Adopt the four-stage discipline from the ZDD engineering standard: pre-deployment compatibility, deployment, feature activation behind a flag, post-release cleanup.
- Make every change dual-version safe: backwards-compatible APIs (new major version for breaking wire changes), expand and contract for any schema change, and consumers tolerant of unknown fields.
- Audit serialized data: anything in Redis, queues or shared caches must deserialize cleanly across adjacent versions.
- Wrap behaviour changes in feature flags so code deploys dark and release becomes a business decision, not a deployment event.
- Use ECS rolling deployments with health checks gating traffic, and take this service off the three-week release train.
- Verify with area-scoped regression rather than the whole-platform cycle, and watch error rates after rollout with automated rollback on alert.
SQL Server exit
Not applicableNo SQL Server dependency is recorded for this repo. Nothing to migrate.
Containerisation
Already containerisedIts pipelines already build containers and deploy to AWS. Nothing to do here.
Recommended actions
No specific actions for this repo. It either needs only normal maintenance, or its work is covered by an estate-level action. See the full programme.
Assessment notes
tc-public-assets-api
Purpose
Asset-storage service for the public/CX platform: an AssetsController with MediatR commands issues pre-signed S3 upload and download URLs across four configured buckets (Public_Assets, Public_BlogVideos, Public_DocumentationBucket, Public_TcCalendar), applying shared-access rules so, for example, MyTC may read backoffice-documentation uploads; it also serves image-resizer (Thumbor) configuration with signed URLs. A separate Thumbor container (beeyev/thumbor-s3 with face/feature detectors) does the actual image resizing from S3. A TC.Public.Assets.Api.Client/Contracts NuGet pair is published for consumers (used by repos such as tc-gift-registry), plus a command-line Uploader utility.
Tech stack
Modern C# on .NET 8 (Api, Application, Abstractions, Uploader, shared Client/Contracts): MediatR, FluentResults, FluentValidation, Mapster, Scrutor, MimeKit, Swashbuckle, TC.Cognito.Auth.Client and JWT identity, TC.ConnectionBroker (Api/Aws/HttpClient) for S3 access, AWSSDK S3/SSM, TC rulesets/StyleCop. Thumbor itself is a two-line Dockerfile over a public image.
Deployment
No classic release pipelines (release_count 0); two build pipelines: tc-public-assets-api (azure-pipeline.yaml, shared InternalOSS/azure-pipelines-templates ci.yml, SDK 8.x, packs the Contracts and Api.Client packages, builds the API container in namespace cx-public, ECS via aws-public-tc-apps tfvars, functional area public) and tc-public-assets-api - thumbor (build-thumbor.yaml, docker template building the tc-public-assets-thumbor image). Five per-environment appsettings map bucket targets to qa/preprod/prod URLs.
Dependencies
Internal packages: TC.ConnectionBroker.* (tc-connectionbroker), TC.Diagnostics.HealthChecks (tc-diagnostics-portal). Runtime consumers include mytc-api and backoffice-documentation callers via the shared-access configuration. External: AWS S3/SSM, Cognito service auth, the Thumbor image-processing engine.
Data stores
Four S3 buckets via ConnectionBroker targets: Public_Assets (default), Public_BlogVideos, Public_DocumentationBucket (raw aws-public-infra-*-documents bucket) and Public_TcCalendar. No database.
Integration points
Inbound REST (Swagger, Cognito/JWT-authenticated callers with per-bucket access management); pre-signed S3 URLs handed to clients; Thumbor-signed image URLs. No message bus.
Code health
Good: five test projects (unit tests per layer plus Testcontainers/Docker.DotNet-based integration tests) totalling ~221 xUnit facts/theories; the CI template runs the unit-test selection. README is untouched boilerplate. Last commit 2026-05-29.
Modernisation risks
Low. Modern .NET 8 with strong tests and fully YAML/Terraform deployment. Minor items: a Thumbor URL-signing key sits in the base appsettings.json (paired with a localhost endpoint, so likely a dev default, but worth moving out of source); the Thumbor container tracks a third-party public image (beeyev/thumbor-s3:7.7) that needs deliberate version/security management; and the access-management rules that govern cross-service document sharing live only in per-environment config.