Live at nej.software, proxied through Cloudflare with forwarded-headers trust configured so Serilog logs the real client IP rather than Cloudflare's edge IP.

Foundational / Layering

• N-tier, one-directional: Entities → Data → Business → Api/Web. Entities has zero framework deps. Only Data touches EF Core/Dapper. Tradeoff: compiler-enforced boundaries over convention-based discipline.
• Web references Data directly too (not just Business) — needed for Program.cs to register AppDbContext/Identity stores. Tradeoff: a hosting concern, not a layering violation — accepted as pragmatic.
• CQRS-lite: EF Core for transactional writes, Dapper for read-heavy/paginated queries, behind the same hand-written IRepository<T>/IUnitOfWork interfaces. Tradeoff: real-world dual-ORM pattern over a single-ORM "simpler" build, chosen because it's what the spec was actually testing.
• GetQueryable() added to IRepository<T> after Business-layer services were found bypassing the repository (injecting AppDbContext directly) to support paging. Tradeoff: extended the abstraction rather than accept the leak — verified via full-codebase grep, not just claimed.
• /Shop's public listing stayed EF-based, not migrated to Dapper, despite being read-heavy. Tradeoff: known, accepted inconsistency — flagged as a backlog item, not silently ignored.
• FK cascade behavior set per-relationship: Restrict on convergent paths (Product, Brand, cross-user Review edges), Cascade on single paths (Order→User, Cart→User). Tradeoff: SQL Server hard-rejects multi-cascade-path migrations — this was deliberate design, not discovered by accident.
• IDesignTimeDbContextFactory kept separate from runtime DI, since a class library has no Program.cs of its own for dotnet ef to resolve against.

Auth / Security

• ASP.NET Core Identity, two roles (Customer/Admin) — not custom session auth. Tradeoff: required by spec; also composes with JWT for the Api project in a way session auth wouldn't.
• Google OAuth for Customer login only — Admin is Identity-only, no external redirect surface at all. Tradeoff: deliberate security separation over auth-method uniformity.
• Admin accounts only via seed or in-app promotion — public registration always assigns Customer, never user-selectable. Tradeoff: closes a privilege-escalation path entirely, at the cost of no self-service admin signup (by design).
• Promotion screen blocks promoting Google-only accounts (no local password) to Admin, since Admin login has no OAuth path — would create an unreachable admin.
• RBAC enforced server-side via [Authorize(Roles=...)] at controller/Area level, not just hidden nav links. Real bug this caught: an Admin could originally add items to Cart via direct URL navigation, since CartController only had a plain [Authorize] — fixed to Roles = "Customer".
• Manage Users is server-side searched + paginated (Dapper LIKE + OFFSET/FETCH), explicitly rejecting a .Users.ToList() pattern seen in a reference project, which breaks at real scale.
• Customer soft-delete (IsActive flag), not hard delete — no cascading removal of Orders/Reviews/Addresses/Cart/Favorites. Tradeoff: preserves historical/financial data integrity over a "clean" full account wipe; email stays permanently claimed (not freed for re-registration) as the simpler of two workable options.
• Login blocked for soft-deleted accounts across every auth surface — standard Identity, Google OAuth, and the separate JWT-based Api — via a CustomSignInManager.CanSignInAsync override plus an explicit IsActive check added to the Api's direct password-check path once that gap was found.
• Role-aware inactivity session timeout: 15 min Admin, 30 min Customer, sliding, via OnValidatePrincipal (not a second cookie scheme). Tradeoff: more complex than splitting schemes, but avoids duplicating Identity's cookie infrastructure for a difference of degree, not kind.
• "Remember Me" and inactivity timeout are orthogonal — a persisted login still respects the idle timeout; persistence ≠ exemption.
• No hardcoded secrets, anywhere, ever — User Secrets locally, environment variables in production. Motivated by two prior reference projects found with live API keys committed to source.

Commerce Domain

• No real payment gateway — Payment/Transaction rows are real and correctly linked, but the payment itself is simulated (SweetAlert2 confirmation + cosmetic method dropdown). Tradeoff: full schema honesty without production payment-processing complexity/risk, appropriate for a demo.
• Persistent, DB-backed cart (Cart/CartItem tables) tied to UserId — not session, not client-only storage. Tradeoff: two extra tables for a cart that survives logout/device-switch, the industry-standard pattern for logged-in commerce.
• Cart requires authenticated Customer — no guest cart, no cart-merge-on-login. Tradeoff: sidesteps the hardest part of real cart systems (merge-conflict resolution) since anonymous browsing was already fine without it.
• Anonymous Add-to-Cart intent preserved through the login redirect (both standard and Google paths) — a small UX fix, not full guest-cart persistence.
• Checkout requires a pre-existing saved Address — no inline address form at checkout. Forced "My Address" to become fully functional earlier than planned, closing a dependency gap proactively.
• Stock re-validated at checkout completion, not just at add-to-cart — prevents overselling from stale cart state.
• Order + OrderItems + stock decrement + Payment + Transaction + cart-clear as one Unit-of-Work transaction — all-or-nothing. This is the concrete proof-of-understanding for why UoW matters, not just that it exists.
• New orders default to Processing, never auto-advance to Completed — a real bug (found and fixed) where checkout was hardcoding the terminal status; status changes are admin-only, manual, by design (no automation in this phase).
• Real shipping-fee logic: free at ≥$70 subtotal, flat $1.99 fee below it, $0 for a genuinely empty cart — replaced an earlier hardcoded fake "Free Shipping" label with no underlying calculation.
• Add-to-Cart race condition fixed at two levels: a client-side request-in-flight guard (prevents duplicate rapid-click requests) and an atomic SQL-level quantity increment server-side (fixes the underlying read-then-write lost-update bug, which would have persisted even with perfect client-side debouncing alone).

Cross-Cutting

• IMemoryCache applied selectively (Product/Category reads), with explicit invalidation on writes — not blanket-cached everywhere. Tradeoff: demonstrates the requirement meaningfully rather than risking missed-invalidation bugs from over-applying it.
• Serilog, SQL Server sink, generic request logging + explicit business-event logging as separate concerns, over a hand-rolled logger. Chosen for structured, well-known tooling over reinventing one.
• Static-asset requests demoted to Debug level, kept out of the DB sink entirely — a real bug where every CSS/JS/image request was logged at Information, exploding the log table (500+ pages) for zero signal.
• 30-day automatic log retention via a lightweight IHostedService, not a new job-scheduler dependency.
• Dashboard's log panel converted to AJAX partial refresh, once usage volume made a full-page reload on every pagination click a real cost, not just a cosmetic nitpick.
• QuestPDF + ClosedXML + QRCoder, with explicit Community-license-tier awareness (QuestPDF.Settings.License = LicenseType.Community).
• QR code deep-links to the existing Track Order tab — deliberately not a new cargo-tracking UI, to keep the payment/fulfillment simulation honest about being a demo rather than implying real logistics.
• AutoMapper as one flat MappingProfile, not one class per entity — accepted deviation from an original per-entity instruction, since splitting further would be over-engineering at this project's actual size.
• Scalar + Microsoft.AspNetCore.OpenApi for API docs, Swashbuckle deliberately dropped — proved incompatible with .NET 10's newer minimal-hosting OpenAPI pipeline.
• Hugging Face content moderation on reviews: translation (Helsinki-NLP/opus-mt-tr-en, always applied regardless of input language, no detection step) → toxicity scoring (unitary/toxic-bert) → auto Approved/Hidden/Pending, with a manual admin override — no separate moderation queue. Uses IHttpClientFactory, not raw HttpClient, avoiding socket exhaustion. A real endpoint migration bug was found and fixed (the old api-inference.huggingface.co domain stopped resolving; moved to router.huggingface.co), and a real EF Core default-value bug was found and fixed (silently downgrading every new Approved review to Pending).
• AI/chatbot integration explicitly declined, despite being spec-allowed as optional — deliberate scope control given the project's already-large required surface area.
• Cloudflare-aware forwarded-headers middleware, added at deployment time, with a fix to ensure Serilog logs the real client IP (not Cloudflare's edge IP) once headers are trusted.

Frontend / Process

• Template used as visual reference only — hand-ported into Razor, none of its React/JSX reused directly; confirmed the template itself had zero real backend logic.
• Product catalog built asset-driven — inventory the actual images first, name products to match what they depict, not the reverse (which produced a mismatch once and was corrected).
• Phased, narrowly-scoped build order with explicit approval gates between phases.
• Visual claims require actual screenshot evidence, not just a text report — established after several real bugs (a debug banner, mismatched images, a cart quantity bug) were reported "fixed" in text while still visibly broken.
• Root-cause diagnosis required before patching, not guess-and-check — this pattern directly found and fixed several real, non-obvious bugs across the project (the HF endpoint failure, the ReviewStatus default-value collision, a CSS min-width:0 grid-sizing bug recurring in two separate places, the dual-cause Add-to-Cart race condition).
• SMTP/email (confirmation, forgot-password, email-change) explicitly deferred, contingent on remaining time post-deployment — a deliberate scope decision, not an oversight.