|
1 | 1 | # SPA Architecture Plan (Angular + .NET 8 API) |
2 | 2 |
|
3 | | -## Architecture decisions |
4 | | -- Use Angular standalone-first feature architecture (no new NgModules). |
5 | | -- Keep clear boundaries: `core` (cross-cutting), `shared` (pure UI primitives), `features` (domain pages/use-cases). |
6 | | -- Keep API contract strict by maintaining backend-aligned DTO/request models under `core/api/models`. |
7 | | -- Use typed API clients per backend feature under `core/api/clients`. |
8 | | -- Use route-level lazy loading for each feature page group. |
9 | | -- Use Signals for local UI state and RxJS streams for async/server workflows. |
10 | | - |
11 | | -## Proposed folder structure |
12 | | -- `src/app/core/config`: environment/config injection tokens. |
13 | | -- `src/app/core/auth`: OIDC PKCE flow, auth facade, role extraction. |
14 | | -- `src/app/core/http`: interceptors (auth bearer, problem-details mapping, retry policy). |
15 | | -- `src/app/core/api`: typed models + API clients (projects, taskitems, activity, dashboard, users). |
16 | | -- `src/app/core/realtime`: SignalR clients and event mappers. |
17 | | -- `src/app/features/dashboard`: dashboard shell + summary cards + activity feed. |
18 | | -- `src/app/features/kanban`: project board, drag/drop interactions, task update workflows. |
19 | | -- `src/app/features/search`: cross-entity filters/search views. |
20 | | -- `src/app/shared/ui`: reusable presentational components (cards, chips, loaders, empty states). |
21 | | -- `src/app/shared/utils`: pure helpers/formatters with tests. |
22 | | - |
23 | | -## State strategy |
24 | | -- Feature facades own page state and orchestration. |
25 | | -- Keep state close to feature; avoid global store until needed. |
26 | | -- Use explicit `load/error/empty` view models for each screen. |
27 | | -- Use optimistic updates only where backend conflict risk is low; otherwise apply server-authoritative updates. |
28 | | - |
29 | | -## Routing and authorization |
30 | | -- Public routes: login + auth callback. |
31 | | -- Protected routes: dashboard, board, search. |
32 | | -- Route data declares required capabilities; guard checks token roles. |
33 | | -- UI capability helpers control action visibility but API remains final authority. |
34 | | - |
35 | | -## API contract alignment rules |
36 | | -- No frontend-only enum/value inventions. |
37 | | -- Patch payloads use omitted vs `null` semantics exactly as API contract defines. |
38 | | -- Date query filters use ISO-8601 UTC. |
39 | | -- ProblemDetails (`application/problem+json`) mapped to typed client errors. |
40 | | - |
41 | | -## Planned commit slices |
42 | | -1. Foundation: typed API models/clients + environment/config plumbing. |
43 | | -2. Auth: OIDC code+PKCE login/callback/logout + auth guard/interceptor. |
44 | | -3. Dashboard: server summary + activity history + SignalR live feed. |
45 | | -4. Kanban read model: project selector + grouped task columns from API. |
46 | | -5. Kanban mutations: patch task status/assignee/due date with optimistic UX safeguards. |
47 | | -6. Search/filter page: users/projects/tasks filters + pagination. |
48 | | -7. Quality pass: unit tests for core clients/facades + component tests for key flows. |
49 | | -8. Cleanup pass: remove legacy dummy services/components and dead CSS. |
50 | | - |
51 | | -## Backend gap found during alignment |
52 | | -- `GET /api/projects/{id}` currently requires `CanManageProjects` policy, which excludes `User` role at authorization layer. |
53 | | -- This appears to conflict with documented matrix intention where `User` should have scoped project read access. |
| 3 | +## Current architecture status |
| 4 | +- Angular standalone-first architecture is active (no feature NgModules used in runtime). |
| 5 | +- Clear boundaries are in place: |
| 6 | + - `core`: auth, api clients/models, config, layout, realtime, preferences. |
| 7 | + - `shared`: shared module + reusable cross-feature UI. |
| 8 | + - `features`: page-level domain slices. |
| 9 | +- API contracts are typed and aligned under `core/api/models` and consumed through `core/api/clients`. |
| 10 | +- RxJS is used for async/server orchestration; Signals/computed are used for local/session/preferences state. |
| 11 | + |
| 12 | +## Implemented folder structure |
| 13 | +- `src/app/core/config`: app environment token + runtime config plumbing. |
| 14 | +- `src/app/core/auth`: OIDC PKCE auth service + guards (`auth`, `admin`, `managerOrAdmin`). |
| 15 | +- `src/app/core/http`: query param/url helpers and HTTP integration utilities. |
| 16 | +- `src/app/core/api`: typed DTOs + API clients (`projects`, `taskitems`, `activity`, `dashboard`, `users`). |
| 17 | +- `src/app/core/realtime`: SignalR hub integration for activity feed/log updates. |
| 18 | +- `src/app/core/preferences`: persisted app preferences service (density/date/notification/kanban defaults). |
| 19 | +- `src/app/features`: dashboard, projects, tasks, search, calendar, activity, profile, settings, docs, admin. |
| 20 | + |
| 21 | +## Routing and authorization (implemented) |
| 22 | +- Public routes: |
| 23 | + - `/` (landing) |
| 24 | + - `/login` |
| 25 | + - `/callback` |
| 26 | +- Protected routes: |
| 27 | + - dashboard/workspaces/delivery/activity/account/about. |
| 28 | +- Role-restricted routes: |
| 29 | + - `/admin` -> `Administrator`. |
| 30 | + - `/activity/log` -> `Administrator` or `ProjectManager`. |
| 31 | + |
| 32 | +## Sidebar information architecture (current) |
| 33 | +- Overview: Dashboard |
| 34 | +- Workspaces: All Projects, Project Details, Project Members, Create Project, Kanban |
| 35 | +- Delivery: All Tasks, My Tasks, Create Task |
| 36 | +- Activity: My Activity, Activity Log, Calendar, Search & Filters |
| 37 | +- Account: Profile & Security, Settings |
| 38 | +- Administration: Admin Dashboard |
| 39 | +- About: Project Docs |
| 40 | + |
| 41 | +## Core feature status |
| 42 | +- Auth foundation: |
| 43 | + - OIDC Authorization Code + PKCE, callback handling, guarded routes. |
| 44 | +- Dashboard: |
| 45 | + - Summary KPIs + activity history + SignalR live updates + preview fallback. |
| 46 | +- Kanban: |
| 47 | + - Project picker, grouped status columns, drag/drop, create/edit dialogs, optimistic patch flows. |
| 48 | +- Search & filters: |
| 49 | + - Cross-entity filtering flows aligned with current API clients. |
| 50 | +- Project tools: |
| 51 | + - All Projects, Project Details, Project Members. |
| 52 | +- Task tools: |
| 53 | + - All Tasks, My Tasks, Create Task. |
| 54 | +- Activity tools: |
| 55 | + - My Activity (personal timeline) + Activity Log (admin/pm audit). |
| 56 | +- Account: |
| 57 | + - Profile & Security, Settings (persisted app preferences). |
| 58 | + |
| 59 | +## Contract alignment rules (enforced) |
| 60 | +- Frontend uses backend enums/contracts from typed models (no ad-hoc enum invention). |
| 61 | +- Patch semantics preserve omitted vs `null` behavior. |
| 62 | +- Date values sent to API follow ISO conventions. |
| 63 | +- Problem Details responses are surfaced consistently at UI layer. |
| 64 | + |
| 65 | +## Quality and cleanup status |
| 66 | +- Legacy scaffold artifacts removed: |
| 67 | + - unused dummy services (`ProjectService`, `TaskItemService`, `LoginService`) and associated specs. |
| 68 | + - empty unused feature modules (`projects.module.ts`, `task-item.module.ts`). |
| 69 | +- UI consistency pass completed across major pages: |
| 70 | + - header card + kpi cards + main content card patterns. |
| 71 | + - PrimeNG built-in table filter strategy on table-centric pages. |
| 72 | + |
| 73 | +## Known backend/API gaps worth addressing |
| 74 | +- Activity endpoint filtering: |
| 75 | + - Current contract used by SPA does not expose server-side actor/type/date filters. |
| 76 | + - Activity Log currently applies these filters client-side after fetching feed data. |
| 77 | +- Authorization matrix check: |
| 78 | + - `GET /api/projects/{id}` policy should be verified against intended `User` read capabilities. |
0 commit comments