dmolinari
a3d6214d09
Composes the audit emission layer per design #D-8:
SIGCM2.Infrastructure/Audit/AuditLogger.cs (IAuditLogger):
- Enriches from IAuditContext (ActorUserId/ActorRoleId/Ip/UserAgent/CorrelationId).
- Sanitizes metadata via JsonSanitizer + AuditOptions.SanitizedKeys.
- Persists via IAuditEventRepository.InsertAsync.
- Fail-closed: throws AuditContextMissingException when ActorUserId is null.
- Translates Guid.Empty correlation id to null (DB column is nullable; Empty
indicates 'no middleware ran').
- Uses System.DateTime.UtcNow for occurredAt.
SIGCM2.Infrastructure/Audit/SecurityEventLogger.cs (ISecurityEventLogger):
- NOT fail-closed: null ActorUserId is valid (login failures, anonymous
permission.denied events).
- Ip/UserAgent pulled from IAuditContext; metadata sanitized the same way.
- Persists via ISecurityEventRepository.
DI: AddScoped for both loggers in AddInfrastructure.
Tests (Strict TDD, mocks for IAuditContext/IAuditEventRepository/
ISecurityEventRepository):
- AuditLoggerTests (6): happy path with full context, fail-closed null actor,
metadata sanitization, null metadata pass-through, repo-throws-bubbles-up
(critical for TransactionScope rollback), custom SanitizedKeys from options.
- SecurityEventLoggerTests (4): login.success with context, login.failure
with null actor + attemptedUsername, metadata sanitization,
permission.denied with both actor and attemptedUsername null.
Two initial failures were fixed by replacing 'null' literal arguments in
NSubstitute Received(...) assertions with Arg.Is<T?>(x => x == null) —
NSubstitute does not always match null literals when mixed with Arg.Any<T>().
Suite: 378/378 Application.Tests + 141/141 Api.Tests = 519/519 passing.
Refs: sdd/udt-010-auditoria-trazabilidad/{spec#REQ-AUD-4 #REQ-SEC-2/3, design#D-8, tasks#B6}
SIG-CM 2.0
Sistema de gestión comercial — migración del sistema legacy (VB6) a una plataforma web moderna.
Stack
- Backend: .NET 10 · C# 13 · ASP.NET Core · Clean Architecture · Dapper 2.x · SQL Server 2022 · JWT RS256 · Serilog · FluentValidation · xUnit + NSubstitute
- Frontend: React 19 · TypeScript 5 strict · Vite 6 · Tailwind 4 · Zustand · React Router 7 · TanStack Query · Axios · Vitest + RTL
- Infra: Docker · Gitea Actions · Obsidian (documentación interna) · SQL Server
Estructura
src/api/ # Backend .NET (Clean Architecture)
SIGCM2.Api/ controllers, filters, Program.cs
SIGCM2.Application/ commands, handlers, validators, abstractions
SIGCM2.Domain/ entities, exceptions, domain security
SIGCM2.Infrastructure/ persistence (Dapper), security, DI
src/web/ # Frontend React 19 (Vite + TS strict)
src/features/ feature modules (auth, users, …)
src/components/ shared UI + layout
src/tests/ Vitest suites
database/
migrations/ .sql con orden Vxxx
seeds/ datos iniciales
schemas/ definiciones auxiliares
tests/
SIGCM2.Api.Tests/ integration (TestWebAppFactory + SQL Server)
SIGCM2.Application.Tests/ unit (handlers, validators)
SIGCM2.TestSupport/ fixtures compartidas
Obsidian/ # Source of truth funcional (IGNORADO por git)
STATUS.md roadmap y estado de UDTs
INSTRUCCIONES_IA.md SOP del agente de IA
02-ARQUITECTURA.../ specs por módulo
Cómo correr
Requisitos
- .NET 10 SDK
- Node 20+
- SQL Server 2019+ (local o remoto)
Backend
cd src/api/SIGCM2.Api
dotnet run
Config en appsettings.json (DB: SIGCM2, usuario desarrollo, server TECNICA3). Para tests de integración se usa SIGCM2_Test.
Frontend
cd src/web
npm install
npm run dev
Tests
# Backend
dotnet test tests/SIGCM2.Application.Tests # unit
dotnet test tests/SIGCM2.Api.Tests # integration (requiere SIGCM2_Test)
# Frontend
cd src/web && npx vitest run
Convenciones
- Ramas:
feature/UDT-XXXdesdemain. - Commits:
tipo(módulo): descripción—feat,fix,docs,refactor,test,chore,security. - Orden de trabajo por UDT: BD → Backend → Frontend.
- Desarrollo guiado por Spec-Driven Development (SDD) + Strict TDD.
- Follow-ups / deuda técnica se registran como issues de Gitea con label
followup.