Webority.Delivery.AspNetCore 0.24.6

Webority.Delivery.AspNetCore

How a Webority Razor head ships its bytes:

• Brotli-first response compression, so Cloudflare delivers Brotli instead of passing IIS gzip through.
• Static files with the fleet cache policy: versioned files a year (never immutable), unversioned files an hour in the browser and a month at the edge, the version marker never stored.
• Cloudflare edge-cache headers: the origin decides what the edge may cache; anonymous, cookie-free pages are cacheable, everything else is no-store.

services.AddWeborityDelivery();

app.UseWeborityDelivery();                     // replaces UseResponseCompression + UseStaticFiles
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseWeborityCloudflareCache(cacheOptions);  // Cloudflare-fronted heads

Endpoints that own their caching carry [OwnCacheControl].

Static assets can also be served from Cloudflare R2, opt-in per head. Without the StaticAssets section, deployables.json and static-build.json, every file is served from the site as before, and asp-append-version writes ?v= with 12 hex characters of the file's sha256. A head with <WeborityStaticAssets>true</WeborityStaticAssets> links authored files through IStaticAssets.Url("<key>"). With StaticAssets:BuildOrigin set, every asp-append-version URL for a file in the release's static-build.json points at /_static/<head>/<set>/. A setting the head's files cannot honour fails at startup. Add IStaticAssets.CspSources to the CSP, and never add MapStaticAssets.

A host without pages (Azure Functions, a worker) links authored files through the Webority.Delivery package and AddWeborityStaticAssets.

API heads answer every failure as an RFC 9457 problem details body in the fleet profile (application/problem+json: type, title, status, detail, code, traceId, plus errors on a validation failure), and expose an honest /health:

services.AddWeborityErrorHandling(options =>
{
    options.ProblemTypeBaseUri = new Uri("https://api.example.com/problems/");
    options.AddProblemType("invoice_locked", 409, "This invoice is locked.");
    options.Map<InvoiceLockedException>("invoice_locked", "This invoice is locked.");
});
services.AddWeborityIdempotency<AppDbContext>();   // opt-in: [Idempotent] POST/PATCH run once per Idempotency-Key
services.AddWeborityMinAppVersion();               // opt-in: announces Min-App-Version, never refuses

app.UseWeborityErrorHandling();                // first in the pipeline
app.UseWeborityMinAppVersion();                // after UseCors
app.UseWeborityIdempotency();                  // after UseAuthorization
endpoints.MapWeborityHealth();                 // anonymous, no-store, never rate limited

return this.Failure("employee_only", "Only employees can open this.");

Clients read detail and code. A reused Idempotency-Key with a different request answers 422.

Preconditions and retirement, each opt-in per endpoint:

Response.SetEntityTag(version);                // read: ETag
[RequireIfMatch]                               // write: 428 without If-Match, 400 when unusable, 412 on a clash
[DeprecatedEndpoint("2026-11-01", SunsetOn = "2027-05-01")]   // Deprecation and Sunset headers

Every DateTimeOffset in a JSON body is written as UTC ending in Z. Our own headers carry no X- prefix (WeborityHeaders); the analyzer rule WEB006 flags one written with it.

The package's analyzer checks API code in the build (WEB001 ProblemDetails, WEB002 anonymous or string error bodies, WEB003 a local exception handler, WEB004 exception text in a response, WEB005 an action or page handler with no authorization attribute, WEB006 an X- header of our own) against a per-project ceiling in .webority/baselines/api-rules-baseline.json that only shrinks. With no file every finding fails; dotnet build --no-incremental -p:WeborityApiRulesSeed=true prints each project's counts (WEB102) to seed it. The analyzer targets netstandard2.0 and needs Microsoft.CodeAnalysis.CSharp 4.14.0 or later.

services.AddWeborityHealthChecks<AppDbContext>() registers the database and data-protection checks; query.ToPagedDataObjectAsync(page, pageSize, ct) returns the fleet paged list { items, page, pageSize, totalCount, totalPages }. A request derived from PagedListRequest exposes ResolvedPage (1 when absent or below 1) and ResolvedPageSize (20 when absent or below 1, never over 100) for services that page without a queryable; the defaults are the public constants PagedListRequest.DefaultPageSize and PagedListRequest.MaxPageSize, the same ones the helper uses.

Server-side DataTables lists bind the 1.10 POST and reach only the members a handler names:

services.AddWeborityDataTables();

public async Task<IActionResult> OnPostRowsAsync(IDataTablesRequest request, CancellationToken ct)
{
    var rows = db.Partners.Select(p => new { p.Code, p.FirmName, p.ContactEmail });
    int filtered = await rows.ApplySearch(request, "code,firmName,contactEmail").CountAsync(ct);
    var page = rows.ApplySearch(request, "code,firmName,contactEmail")
        .ApplySorting(request, "code,firmName")
        .ApplyPaging(request);
    return new DataTablesJsonResult(request.CreateResponse(await rows.CountAsync(ct), filtered, await page.ToListAsync(ct)));
}