# aermie/devsecops architecture

> Architecture diagram of the GitHub repository aermie/devsecops, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/aermie/devsecops
- Repository: https://github.com/aermie/devsecops

## Overview

This repository is an intentionally insecure DevSecOps demonstration, with a self-contained eShopOnWeb-derived commerce application. The application’s main user-facing areas are the storefront, basket and checkout, account/order management, and catalog administration; its public API and persistence/identity infrastructure support those areas. The excerpts establish several internal service and data-access relationships, but do not expose most page-handler and endpoint calls, so those links are omitted or marked unverified rather than inferred.

Main entry points: [`Application-Source-Code/src/PublicApi/Program.cs`](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/PublicApi/Program.cs) (Public API), [`Application-Source-Code/src/Web/Pages/Basket/Checkout.cshtml.cs`](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Web/Pages/Basket/Checkout.cshtml.cs) (Basket and Checkout), [`Application-Source-Code/src/ApplicationCore/Services/OrderService.cs`](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/ApplicationCore/Services/OrderService.cs) (Order Service), [`Application-Source-Code/src/Infrastructure/Data/EfRepository.cs`](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Data/EfRepository.cs) (EF Repository)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_experience["Web Experiences"]
  node_storefront["Storefront<br/>[Index.cshtml.cs]"]
  node_basketcheckout["Basket and Checkout<br/>[Checkout.cshtml.cs]"]
  node_accountorders["Account and Orders"]
  node_adminui["Catalog Admin UI<br/>[List.razor.cs]"]
end

subgraph group_commerce["Commerce Services"]
  node_catalogservice["Catalog Services"]
  node_basketservice["Basket Service<br/>[BasketService.cs]"]
  node_orderservice["Order Service<br/>[OrderService.cs]"]
  node_orderdomain["Order Domain<br/>[Order.cs]"]
end

subgraph group_api["API and Identity"]
  node_publicapi["Public API<br/>[Program.cs]"]
  node_catalogendpoints["Catalog Endpoints"]
  node_authendpoints["Authentication Endpoints"]
  node_admincatalog["Admin Catalog Client"]
  node_httpservice["HTTP Client<br/>[HttpService.cs]"]
  node_tokenservice["Token Claims"]
end

subgraph group_data["Persistence"]
  node_identitydb[("Identity Store")]
  node_catalogdb[("Commerce Store<br/>[CatalogContext.cs]")]
  node_repository["EF Repository<br/>[EfRepository.cs]"]
  node_basketquery["Basket Query"]
  node_identityuser["Application User<br/>[ApplicationUser.cs]"]
end

node_shopper(("Shopper"))
node_admin(("Catalog Admin"))

node_shopper -.->|"browses"| node_storefront
node_shopper -.->|"checks out"| node_basketcheckout
node_shopper -.->|"manages account"| node_accountorders
node_admin -.->|"manages catalog"| node_adminui
node_adminui -.->|"uses"| node_admincatalog
node_admincatalog -->|"sends requests"| node_httpservice
node_httpservice -.->|"calls API"| node_publicapi
node_publicapi -.->|"maps endpoints"| node_catalogendpoints
node_publicapi -->|"registers repository"| node_repository
node_repository -->|"uses context"| node_catalogdb
node_publicapi -->|"registers claims service"| node_tokenservice
node_tokenservice -->|"looks up user"| node_identityuser
node_publicapi -->|"configures identity store"| node_identitydb
node_basketservice -->|"uses repository"| node_repository
node_basketquery -->|"queries baskets"| node_catalogdb
node_basketcheckout -.->|"uses basket logic"| node_basketservice
node_basketcheckout -.->|"places order"| node_orderservice
node_orderservice -.->|"creates orders"| node_orderdomain
node_storefront -.->|"loads catalog"| node_catalogservice
node_accountorders -.->|"reads orders"| node_orderservice

click node_storefront "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Web/Pages/Index.cshtml.cs"
click node_basketcheckout "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Web/Pages/Basket/Checkout.cshtml.cs"
click node_accountorders "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Web/Controllers/ManageController.cs"
click node_adminui "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/BlazorAdmin/Pages/CatalogItemPage/List.razor.cs"
click node_catalogservice "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Web/Services/CatalogItemViewModelService.cs"
click node_basketservice "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/ApplicationCore/Services/BasketService.cs"
click node_orderservice "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/ApplicationCore/Services/OrderService.cs"
click node_orderdomain "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/ApplicationCore/Entities/OrderAggregate/Order.cs"
click node_publicapi "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/PublicApi/Program.cs"
click node_catalogendpoints "https://github.com/aermie/devsecops/tree/main/Application-Source-Code/src/PublicApi/CatalogItemEndpoints"
click node_authendpoints "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/PublicApi/AuthEndpoints/AuthenticateEndpoint.cs"
click node_admincatalog "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/BlazorAdmin/Services/CatalogItemService.cs"
click node_httpservice "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/BlazorAdmin/Services/HttpService.cs"
click node_tokenservice "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Identity/IdentityTokenClaimService.cs"
click node_identitydb "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Identity/AppIdentityDbContext.cs"
click node_catalogdb "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Data/CatalogContext.cs"
click node_repository "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Data/EfRepository.cs"
click node_basketquery "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Data/Queries/BasketQueryService.cs"
click node_identityuser "https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Identity/ApplicationUser.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_storefront,node_basketcheckout,node_accountorders,node_adminui toneBlue
class node_catalogservice,node_basketservice,node_orderservice,node_orderdomain toneAmber
class node_publicapi,node_catalogendpoints,node_authendpoints,node_admincatalog,node_httpservice,node_tokenservice toneMint
class node_identitydb,node_catalogdb,node_repository,node_basketquery,node_identityuser toneRose
class node_shopper,node_admin toneIndigo
```

## Components

### Web Experiences

- [Storefront](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Web/Pages/Index.cshtml.cs): `Application-Source-Code/src/Web/Pages/Index.cshtml.cs`
- [Basket and Checkout](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Web/Pages/Basket/Checkout.cshtml.cs): `Application-Source-Code/src/Web/Pages/Basket/Checkout.cshtml.cs`
- [Account and Orders](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Web/Controllers/ManageController.cs): `Application-Source-Code/src/Web/Controllers/ManageController.cs`
- [Catalog Admin UI](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/BlazorAdmin/Pages/CatalogItemPage/List.razor.cs): `Application-Source-Code/src/BlazorAdmin/Pages/CatalogItemPage/List.razor.cs`

### Commerce Services

- [Catalog Services](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Web/Services/CatalogItemViewModelService.cs): `Application-Source-Code/src/Web/Services/CatalogItemViewModelService.cs`
- [Basket Service](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/ApplicationCore/Services/BasketService.cs): `Application-Source-Code/src/ApplicationCore/Services/BasketService.cs`
- [Order Service](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/ApplicationCore/Services/OrderService.cs): `Application-Source-Code/src/ApplicationCore/Services/OrderService.cs`
- [Order Domain](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/ApplicationCore/Entities/OrderAggregate/Order.cs): `Application-Source-Code/src/ApplicationCore/Entities/OrderAggregate/Order.cs`

### API and Identity

- [Public API](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/PublicApi/Program.cs): `Application-Source-Code/src/PublicApi/Program.cs`
- [Catalog Endpoints](https://github.com/aermie/devsecops/tree/main/Application-Source-Code/src/PublicApi/CatalogItemEndpoints): `Application-Source-Code/src/PublicApi/CatalogItemEndpoints`
- [Authentication Endpoints](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/PublicApi/AuthEndpoints/AuthenticateEndpoint.cs): `Application-Source-Code/src/PublicApi/AuthEndpoints/AuthenticateEndpoint.cs`
- [Admin Catalog Client](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/BlazorAdmin/Services/CatalogItemService.cs): `Application-Source-Code/src/BlazorAdmin/Services/CatalogItemService.cs`
- [HTTP Client](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/BlazorAdmin/Services/HttpService.cs): `Application-Source-Code/src/BlazorAdmin/Services/HttpService.cs`
- [Token Claims](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Identity/IdentityTokenClaimService.cs): `Application-Source-Code/src/Infrastructure/Identity/IdentityTokenClaimService.cs`

### Persistence

- [Identity Store](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Identity/AppIdentityDbContext.cs): `Application-Source-Code/src/Infrastructure/Identity/AppIdentityDbContext.cs`
- [Commerce Store](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Data/CatalogContext.cs): `Application-Source-Code/src/Infrastructure/Data/CatalogContext.cs`
- [EF Repository](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Data/EfRepository.cs): `Application-Source-Code/src/Infrastructure/Data/EfRepository.cs`
- [Basket Query](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Data/Queries/BasketQueryService.cs): `Application-Source-Code/src/Infrastructure/Data/Queries/BasketQueryService.cs`
- [Application User](https://github.com/aermie/devsecops/blob/main/Application-Source-Code/src/Infrastructure/Identity/ApplicationUser.cs): `Application-Source-Code/src/Infrastructure/Identity/ApplicationUser.cs`

### Other components

- **Shopper**
- **Catalog Admin**

## Connections

- Shopper → Storefront: browses
- Shopper → Basket and Checkout: checks out
- Shopper → Account and Orders: manages account
- Catalog Admin → Catalog Admin UI: manages catalog
- Catalog Admin UI → Admin Catalog Client: uses
- Admin Catalog Client → HTTP Client: sends requests (evidence: `Application-Source-Code/src/BlazorAdmin/Services/CatalogItemService.cs`)
- HTTP Client → Public API: calls API
- Public API → Catalog Endpoints: maps endpoints
- Public API → EF Repository: registers repository (evidence: `Application-Source-Code/src/PublicApi/Program.cs`)
- EF Repository → Commerce Store: uses context (evidence: `Application-Source-Code/src/Infrastructure/Data/EfRepository.cs`)
- Public API → Token Claims: registers claims service (evidence: `Application-Source-Code/src/PublicApi/Program.cs`)
- Token Claims → Application User: looks up user (evidence: `Application-Source-Code/src/Infrastructure/Identity/IdentityTokenClaimService.cs`)
- Public API → Identity Store: configures identity store (evidence: `Application-Source-Code/src/PublicApi/Program.cs`)
- Basket Service → EF Repository: uses repository (evidence: `Application-Source-Code/src/ApplicationCore/Services/BasketService.cs`)
- Basket Query → Commerce Store: queries baskets (evidence: `Application-Source-Code/src/Infrastructure/Data/Queries/BasketQueryService.cs`)
- Basket and Checkout → Basket Service: uses basket logic
- Basket and Checkout → Order Service: places order
- Order Service → Order Domain: creates orders (evidence: `Application-Source-Code/src/ApplicationCore/Services/OrderService.cs`)
- Storefront → Catalog Services: loads catalog
- Account and Orders → Order Service: reads orders