From d0c3d79fbc55b7005404961fd58c9354208618ca Mon Sep 17 00:00:00 2001 From: TekH Date: Fri, 2 Oct 2026 13:32:21 +0200 Subject: [PATCH] Refactor DI, PDF rendering, and improve security/UX Centralized dependency injection registrations into dedicated extension methods/modules to reduce startup composition sprawl and improve maintainability. Refactored `PdfRenderController.cs` and client service contract to replace JSON/base64 `byte[]` transport with binary streaming (`application/octet-stream` or multipart) for improved memory and latency performance with large PDFs. Introduced a DevExpress toast-based notification system using `DxToastProvider` and `IToastNotificationService` for consistent, actionable feedback across sender/receiver flows. Standardized request-to-domain mapping with AutoMapper/profile conventions or reflection/source-generator-based mappers to eliminate manual mapping drift and enforce consistency across services. Addressed SQL injection vulnerabilities by replacing dynamic SQL string composition with parameterized queries. Conducted a repo- wide audit and added CI guardrails to prevent reintroduction. Refined UX for `EnvelopeSenderPage.razor` to enforce deterministic row double-click behavior (preview OR edit) and aligned row action buttons/tooltips to eliminate ambiguous navigation. --- AGENTS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/AGENTS.md b/AGENTS.md index e75e29c4..823a5f9d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -249,6 +249,7 @@ Manual testing workflow: - Establish a DevExpress toast-based notification architecture using `DxToastProvider` + `IToastNotificationService` (tab/page-scoped provider strategy, standardized `ToastOptions` factory, and severity-to-style mapping) so sender/receiver flows show consistent, non-duplicated, actionable feedback. - Eliminate manual property-by-property request→domain mapping drift (example: `CreateEnvelopeCommandHandler`) by introducing a standardized mapping policy (AutoMapper/profile conventions or reflection/source-generator based mapper) and enforcing it across envelope workflows; this needs to be solved in the shared company Core library level so all services get the same guardrails by default. - P1 security workstream: remove dynamic SQL string composition/interpolation from active save/create/update paths (`string.Format`, `$"...{input}..."`, `ToSqlParam`) and migrate to parameterized queries only; treat this as a potential SQL injection vulnerability (stability + security risk), execute repo-wide audit, and add CI guardrails to block reintroduction. +- Alternative UX design (Server component): in `EnvelopeGenerator.Server/EnvelopeGenerator.Server/Components/Pages/EnvelopeSenderPage.razor`, enforce deterministic row double-click behavior as exactly one action (preview OR edit), and keep row action buttons/tooltips aligned with the same rule to eliminate ambiguous navigation. ## Database