dotnet/eShop

This system is a reference e-commerce application built on .NET 10 and .NET Aspire, orchestrating a microservices architecture that includes Catalog, Ordering, Basket, Identity, and Webhooks services. It provides a multi-platform storefront via a Blazor WebApp and a .NET MAUI Hybrid mobile app, supporting features like semantic search, AI-powered shopping assistance, and real-time order tracking. The platform handles the full shopping lifecycle, from product browsing and cart management to checkout, payment processing, and webhook notifications, backed by PostgreSQL, Redis, and RabbitMQ.

The checkout page is now available at /checkout, allowing authenticated users to review and submit their shipping address (street, city, state, zip code, and country) before placing an order. The form pre-populates fields from the user's HTTP claims when available, validates that the shopping cart is not empty, and redirects to the orders page upon successful submission. The layout is styled with design tokens and includes responsive adjustments for smaller screens.

src/WebApp/Components/Pages/Checkout · high confidence

This change introduces two new PowerShell scripts to the build pipeline. The \queue-all.ps1\ script automates the creation of Azure Container Registry (ACR) build tasks for all eShop microservices (including Basket, Catalog, Identity, Ordering, and various Web/API Gateway services), linking them to specific Dockerfiles and Git branches. The \create-manifests.ps1\ script generates and pushes Docker multi-architecture manifests, allowing images to be tagged with platform-specific variants (linux-master, win-master, etc.) and unified under common tags (latest, master, dev) for easier consumption.

build · high confidence

This change introduces several new configuration files to support the 1ES build environment and developer machine provisioning. It adds CredScan suppressions for dummy credentials, TSA (Test Service Agent) options for the eShop project, and two WinGet configuration files (for Visual Studio and VS Code) that automate the setup of development environments by installing required tools like .NET SDK, Azure CLI, Docker, and specific VS/VS Code extensions.

.config · high confidence

The Catalog API now includes the Entity Framework Core infrastructure to manage its PostgreSQL database, including the \CatalogContext\, entity configurations for brands, types, and items, and a seed script that populates initial data and generates AI embeddings when enabled. The database schema supports vector embeddings (via the \vector(384)\ Postgres extension) for AI features, uses identity columns for primary keys, and includes an \IntegrationEventLog\ table to support reliable event publishing.

src/Catalog.API/Infrastructure · high confidence

The Catalog API now includes integration event infrastructure to coordinate with the Order service, specifically handling order status changes. It introduces event handlers for \OrderStatusChangedToAwaitingValidation\ and \OrderStatusChangedToPaid\ events. When an order enters the validation phase, the catalog service checks product availability and publishes either a stock confirmation or rejection event. Upon payment, it deducts the ordered units from the catalog inventory. This logic is supported by new event records (e.g., \OrderStockConfirmedIntegrationEvent\, \ProductPriceChangedIntegrationEvent\) and a dedicated service (\CatalogIntegrationEventService\) that ensures atomic persistence of catalog changes alongside event logging.

src/Catalog.API/IntegrationEvents · high confidence

The src/EventBus directory now provides the foundational abstractions for the application's eventing system, including the IEventBus and IIntegrationEventHandler interfaces, the IntegrationEvent base record, and configuration via EventBusSubscriptionInfo. It introduces a registration mechanism using .NET keyed services (AddKeyedTransient) to support multiple handlers for a single event type, along with extension methods to configure JSON serialization options and map event types for the underlying message broker.

src/EventBus · high confidence

The Identity.API service is introduced as the new authentication and authorization component for the eShop platform. It is built on ASP.NET Core Identity for user management and Duende IdentityServer4 for OpenID Connect and OAuth 2.0 capabilities. The service configures an \ApplicationUser\ model that extends the default identity user to include payment card details (number, security code, expiration, holder name) and a full shipping address. IdentityServer is set up with in-memory stores for API resources (orders, basket, webhooks), API scopes, and clients (including web, mobile/MAUI, and Swagger UI clients). The database layer uses Entity Framework Core with PostgreSQL, featuring an initial migration that creates the standard Identity tables alongside the custom user profile fields. The application is configured to automatically apply database migrations on startup and uses a cookie policy to ensure compatibility with modern browser security requirements.

src/Identity.API · high confidence

This change introduces the core domain layer for the Ordering service, establishing the foundational structure for managing orders and buyers. It defines the \Order\ and \Buyer\ aggregates, including their associated entities like \OrderItem\, \Address\, and \PaymentMethod\, along with the \OrderStatus\ enum to track the lifecycle of an order. The implementation also includes repository interfaces (\IOrderRepository\, \IBuyerRepository\) for data access, domain events (such as \OrderStartedDomainEvent\ and \OrderStatusChangedToPaidDomainEvent\) to signal state changes, and base classes for entities and value objects to support the domain-driven design pattern.

src/Ordering.Domain · high confidence

The eShop application now uses .NET Aspire for local development and deployment orchestration. The AppHost project defines the full service topology, including Redis, RabbitMQ, and PostgreSQL (with pgvector) as infrastructure dependencies, and wires up the API and web projects with health checks and environment references. It introduces a Yarp-based Mobile BFF reverse proxy that routes catalog, ordering, and identity traffic while handling API versioning. Additionally, the host supports optional AI integrations via Microsoft Foundry (GPT-4.1-mini and text-embedding-3-small) or local Ollama (llama3.1 and all-minilm) for chat and semantic search capabilities, controlled by configuration flags.

src/eShop.AppHost · high confidence

The src/EventBusRabbitMQ module introduces a new RabbitMQ event bus implementation that integrates with OpenTelemetry for distributed tracing. It adds configuration options for subscription client names and retry counts, registers the event bus via dependency injection, and implements message publishing and consumption with automatic trace context propagation and semantic convention tagging for RabbitMQ operations.

src/EventBusRabbitMQ · high confidence

The WebApp now includes the core service layer for shopping and order management. Users can add items to and manage their shopping basket via a new \BasketService\ and \BasketState\ that coordinate with the Basket API and Catalog. The checkout flow is supported by \BasketCheckoutInfo\ and \OrderingService\, which submit orders to the Ordering API. Additionally, users receive real-time order status updates through \OrderStatusNotificationService\ and its integration event handlers, while product images are served directly from the WebApp via \ProductImageUrlProvider\.

src/WebApp/Services · high confidence

This change introduces the core application logic for the Ordering service, establishing a CQRS architecture with MediatR. It adds command handlers for the full order lifecycle (create, cancel, ship, and status updates like paid or stock-confirmed) and corresponding integration event handlers to react to external system signals. The implementation includes pipeline behaviors for validation, logging, and database transactions, as well as domain event handlers to synchronize order state with buyer and payment information.

src/Ordering.API/Application · high confidence

This change introduces the initial infrastructure layer for the Ordering API, including a database seeder to populate predefined card types (Amex, Visa, MasterCard) and an identity service implementation that retrieves the current user's identity and name from the HTTP context.

src/Ordering.API/Infrastructure · high confidence

This change introduces the initial codebase for the eShop application, adding a new \IntegrationEventLogEF\ library that provides Entity Framework Core-based persistence for integration events. This includes the \IntegrationEventLogEntry\ model, an \EventStateEnum\ to track publication status (NotPublished, InProgress, Published, PublishedFailed), and an \IntegrationEventLogService\ to manage saving, retrieving, and updating the state of events within database transactions, supported by a \ResilientTransaction\ utility for connection resiliency. Additionally, it adds the \WebAppComponents\ library, specifically introducing an \ItemHelper\ utility for generating item URLs and global Razor imports for the web UI layer.

src/IntegrationEventLogEF, src/WebAppComponents, src/WebAppComponents/Item · high confidence

This change introduces the \src/HybridApp\ project, a cross-platform mobile application built with .NET MAUI and Blazor. It provides a native storefront experience featuring a catalog browsing page with brand and type filtering, pagination, and detailed product views. The app utilizes a shared Blazor component library for the UI, connects to a local mobile backend-for-frontend (BFF) service for data, and includes the necessary platform-specific configurations for Android, iOS, MacCatalyst, Windows, and Tizen.

src/HybridApp · high confidence

The Webhooks API microservice is now available, providing a versioned REST API (v1) for managing webhook subscriptions. Users can create, read, and delete subscriptions for specific event types, including product price changes and order status updates (paid, shipped). The service integrates with an event bus to listen for these domain events and automatically dispatches notifications to registered destination URLs. It includes built-in validation for subscription requests and a grant URL testing mechanism to verify that destination endpoints are accessible and correctly configured before saving.

src/Basket.API, src/Webhooks.API · high confidence

This change introduces the initial version of the eShop WebApp, establishing the core application structure and configuration. It sets up an ASP.NET Core Razor Components application with interactive server rendering, integrates service defaults for health checks and logging, and configures the HTTP pipeline including HTTPS redirection and antiforgery protection. A key functional addition is the configuration of a URL forwarder that routes product image requests to the CatalogApi, allowing the API to remain private while serving images through the WebApp. The app also includes standard configuration files for development and production environments, defining settings for logging, allowed hosts, event bus subscription names, and session cookie lifetime.

src/ClientApp, src/WebApp · high confidence

The repository is initialized with the foundational structure for the eShop reference application, including the solution file (eShop.slnx), project definitions, and a global.json pinning the SDK to version 10.0.302. It introduces .NET Aspire as the orchestration layer, configured via an AppHost project and an aspire.config.json file, and sets up Playwright for end-to-end browser testing. The commit also establishes development standards through .editorconfig and .markdownlint.json, adds CI/CD pipelines (ci.yml), and provides essential documentation such as README.md, CONTRIBUTING.md, and CODE-OF-CONDUCT.md.

(repo-wide) · high confidence

This change introduces the foundational extension methods and service registrations for the Ordering API. It adds DI configuration for the OrderingContext (using Npgsql), integration event services, MediatR behaviors (logging, validation, transaction), and RabbitMQ event bus subscriptions. Additionally, it includes utility extensions for mapping BasketItems to OrderItemDTOs, safe LINQ projection handling, and structured logging for order status and payment updates.

src/Ordering.API/Extensions · high confidence

Added the ICatalogAI interface and CatalogAI service implementation to generate vector embeddings for catalog items and text. This new capability allows the catalog API to produce embeddings using an injected IEmbeddingGenerator, supporting downstream AI features like semantic search or recommendations, while gracefully handling cases where the AI provider is not configured.

src/Catalog.API/Services · high confidence

The application now includes two new background services: the OrderProcessor, which monitors for orders in a grace period and publishes confirmation events, and the PaymentProcessor, which handles stock-confirmation events to simulate payment success or failure. These services are wired to a RabbitMQ event bus and use PostgreSQL for order data, enabling the asynchronous processing of the order-to-payment workflow.

src/OrderProcessor · high confidence

The Catalog API now includes a complete set of domain models (CatalogItem, CatalogBrand, CatalogType, CatalogFacets) and supporting infrastructure (PaginatedItems, PaginationRequest, CatalogServices). Notably, CatalogItem now features an optional Vector embedding property and inventory management methods (AddStock, RemoveStock), while CatalogServices explicitly injects an ICatalogAI service, indicating the introduction of AI-driven capabilities within the catalog domain.

src/Catalog.API/Model · high confidence

The WebAppComponents library now includes a new CatalogService implementation that communicates with the backend catalog API endpoints (such as items, brands, types, and facets) via HttpClient, alongside the ICatalogService interface defining these capabilities. Additionally, an IProductImageUrlProvider interface is introduced to abstract product image URL generation, and a PriceFormatter utility is added to standardize monetary display formatting using invariant culture.

src/WebAppComponents/Services · high confidence

This change adds a new \eShop.ServiceDefaults\ library that standardizes cross-cutting concerns for eShop services. It provides default health checks, OpenTelemetry instrumentation (logging, metrics, tracing), and service discovery configuration. Authentication is standardized via JWT Bearer tokens with automatic access token propagation to downstream HTTP calls. Additionally, it integrates ASP.NET API Versioning and configures Scalar for API documentation, enabling versioned OpenAPI documents with OAuth2 security schemes and deprecation metadata.

src/eShop.ServiceDefaults · high confidence

A new AI-powered shopping assistant is now available in the web application, allowing users to interact with a chatbot that can answer questions about the AdventureWorks catalog, search for products using semantic relevance, and add items directly to the shopping cart. The assistant is presented as a floating panel with a draggable header and resizable window, featuring a persistent launcher button with animated eyes. It leverages the Microsoft.Extensions.AI framework to connect to an underlying AI model (configured via Microsoft Foundry or Ollama) and processes markdown-formatted responses to display product images within the chat interface.

src/WebApp/Components/Chatbot · high confidence

This change introduces the core user-facing pages for account management and order tracking. The new Login page handles authentication redirects and return URLs, while the Logout page provides the necessary endpoint for session termination. The Orders page displays a user's purchase history, including order numbers, dates, totals, and status badges (with specific styling for paid and cancelled states), and features an empty state for new users. Additionally, the OrdersRefreshOnStatusChange component enables real-time updates to the order list by subscribing to status change notifications and refreshing the view when an order's status changes.

src/WebApp/Components/Pages/User · high confidence

The Ordering API now includes ASP.NET API Versioning, which adds 'api-supported-versions' and 'api-deprecated-versions' headers to all responses and exposes the Orders endpoint as versioned API V1. The service entry point (Program.cs) is established with standard middleware, including Problem Details and default OpenAPI support, while configuration files define connection strings for PostgreSQL and RabbitMQ, logging levels, and Identity scopes for Swagger UI authentication.

src/Ordering.API · high confidence

The Catalog API has been refactored to support API versioning (v1 and v2) and includes new endpoints for semantic search and improved filtering. Users can now access catalog items via versioned routes (e.g., /api/catalog/v1/items, /api/catalog/v2/items) and utilize a new v2 semantic search endpoint (/api/catalog/v2/items/withsemanticrelevance) for AI-driven item discovery. The API also exposes facets for brand and type counts to support dynamic filtering in the storefront, and maintains existing CRUD operations for catalog items.

src/Catalog.API/Apis · high confidence

The Catalog API now supports explicit API versioning (v1 and v2), requiring clients to pass an api-version query parameter to access endpoints. This change introduces distinct behavior for v2, which adds an UpdateItem operation, while v1 remains read-only for item retrieval. To support this, the service now generates and serves OpenAPI documents for both versions (v1.json and v2.json) and includes API version headers in responses, allowing consumers to discover and interact with the correct API contract.

src/Catalog.API · high confidence

The Catalog API's service registration has been updated to conditionally enable AI embedding capabilities via Ollama when the 'OllamaEnabled' configuration flag is set, falling back to OpenAI if a connection string is present. Additionally, the application now detects build-time OpenAPI document generation scenarios (via the 'Build' environment or 'GetDocument.Insider' tool) to skip database migrations and connection setup, ensuring faster and safer static analysis.

src/Catalog.API/Extensions · high confidence

The WebApp now consolidates its dependency injection setup in a new Extensions class, configuring authentication via OpenID Connect and cookies, registering gRPC and HTTP clients for Basket, Catalog, and Ordering APIs with automatic API versioning, and setting up event bus subscriptions for order status notifications. Additionally, it introduces flexible AI service integration that automatically configures either an Ollama client or an OpenAI chat client based on configuration settings, enabling users to leverage AI features without requiring public exposure of the Catalog API.

src/WebApp/Extensions · high confidence

The Ordering API now exposes order-related endpoints (create, cancel, ship, get) via minimal APIs in \OrdersApi.cs\, replacing previous implementations. A key behavioral change in the order creation flow is that the credit card number is masked (showing only the last 4 digits) before being logged or passed to the command handler, addressing a security concern regarding sensitive data exposure in logs. The API also integrates ASP.NET API Versioning, exposing these endpoints under the \api/orders\ group with version 1.0.

src/Ordering.API/Apis · high confidence

The web application now features a redesigned storefront layout with a sticky top bar, a dynamic hero section, and a comprehensive footer. The HeaderBar component displays the AdventureWorks brand, a primary navigation link, and user/cart controls, while the hero section adapts its height and imagery based on the current page (e.g., compact for product details). The FooterBar provides brand information, social media links, and structured navigation columns for Shop, Support, and Company sections. Additionally, the CartMenu component now visually indicates the number of items in the shopping bag with a count badge, and the UserMenu allows authenticated users to view their profile and log out. These changes establish a consistent, responsive visual foundation for the application.

src/WebApp/Components/Layout · high confidence

The catalog UI has been modernized with a design-token foundation, introducing a new \CatalogSearch\ component for filtering products by brand and type with live counts, and a \CatalogListItem\ component for displaying products with a 3D tilt effect and scroll-reveal animations. The layout is now responsive, with filters collapsing to a full-width collapsible section on smaller screens, and product images are served directly from the WebApp to avoid exposing the CatalogApi.

src/WebAppComponents/Catalog · high confidence

The storefront assets have been updated to use the Plus Jakarta Sans and Open Sans typefaces, and the visual identity has been renamed to AdventureWorks with new header and footer logos. The interface now includes a set of SVG icons for navigation and actions, and the shopping experience is enhanced with client-side JavaScript: product cards feature a 3D tilt effect on hover, the cart allows immediate quantity updates via typing, the catalog grid supports client-side sorting with persisted preferences, and a floating shopping-assistant dock provides a resizable, draggable chat interface.

src/WebApp/wwwroot · high confidence

The Ordering service now persists order status as a string column in the orders table rather than referencing a separate orderstatus lookup table. This migration drops the orderstatus table and the OrderStatusId foreign key, replacing them with a direct OrderStatus string column, which simplifies the data model and removes the need for a join when retrieving order status.

src/Ordering.Infrastructure · high confidence

The Cart, Catalog, and Item pages have been rebuilt with a modern, responsive design foundation. The Shopping Bag now features a segmented quantity stepper, improved accessibility labels, and a streamlined checkout summary. Product detail pages include a native image lightbox for zooming, sticky buy panels, and intelligent 'Back to catalog' navigation that preserves previous filters. The Catalog page offers a refined sorting interface and skeleton loading states. All pages utilize CSS design tokens for consistent theming and improved readability across devices.

src/WebApp/Components/Pages/Cart · high confidence

The WebhookClient has been rewritten as a Blazor Server application, replacing its previous implementation. This introduces a new user interface for managing webhook subscriptions, including a home page to view registered webhooks and received messages, and an 'Add Webhook' page to register new subscriptions. The app now supports user authentication via OpenID Connect with cookie-based sessions, featuring login and logout endpoints. It also includes a thread-safe in-memory repository for storing received webhook messages and integrates with the Webhooks API to handle registration and message reception, complete with token validation.

src/WebhookClient · high confidence

Add Playwright end-to-end tests for storefront flows; Added functional tests for the Ordering API; Added functional tests for the Redis-based basket repository; Added unit and functional tests for application services and infrastructure; Added unit tests for Basket and Ordering services; Initial unit test suite for ClientApp services and view models.

The application has been upgraded to target .NET 10.0 across all services, APIs, and client applications, including the MAUI-based ClientApp and HybridApp. The infrastructure and orchestration layer has been updated to .NET Aspire 13.5.3, bringing in corresponding updates for hosting providers (PostgreSQL, Redis, RabbitMQ, Yarp, Azure App Containers) and telemetry packages (OpenTelemetry, Scalar). This change also introduces centralized package version management via Directory.Packages.props and updates key dependencies such as Duende IdentityServer to 7.3.x, Grpc.Tools to 2.80.0, and IdentityModel to 7.0.0.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 51 → 50 (-1.3)
• Rubric changed (rubric-2026.08.19 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 69 → 65 (-3.7)
• Architecture 77 → 77 (+0.2)
• Maturity 59 → 68 (+8.6)
• Readiness 74 → 74 (+0.1)
• Security 65 → 65 (-0.2)
• Domain Modelling 55 → 45 (-10.1)
• Event-Driven 100 → 80 (-19.7)
• Accessibility 41 → 42 (+1.1)
• Performance 70 → 70 (+0.0)

• Bounded contexts not declared
• Build status unknown
• Dormant codebase
• Duplicated block (10 lines × 2) (src/Webhooks.API/Apis/WebHooksApi.cs)
• Duplicated block (13 lines × 2) (src/HybridApp/Services/CatalogService.cs)
• High CVE: [GHSA redacted] (package-lock.json)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• …and 4 more

• (anonymous) (cognitive 21) (src/WebApp/wwwroot/js/card-tilt.js)
• (anonymous) (cognitive 23) (src/WebApp/wwwroot/js/page-transitions.js)
• (anonymous) (cognitive 28) (src/WebApp/wwwroot/js/chat-fab.js)
• (anonymous) (cognitive 31) (src/WebApp/wwwroot/js/chat-eyes.js)
• (anonymous) (cognitive 59) (src/WebApp/wwwroot/js/chat-dock.js)
• (anonymous) (cognitive 79) (src/WebApp/wwwroot/js/catalog-sort.js)
• (anonymous) (cyclomatic 20) (src/WebApp/wwwroot/js/card-tilt.js)
• (anonymous) (cyclomatic 20) (src/WebApp/wwwroot/js/page-transitions.js)
• (anonymous) (cyclomatic 25) (src/WebApp/wwwroot/js/chat-fab.js)
• (anonymous) (cyclomatic 29) (src/WebApp/wwwroot/js/chat-eyes.js)
• (anonymous) (cyclomatic 53) (src/WebApp/wwwroot/js/chat-dock.js)
• (anonymous) (cyclomatic 73) (src/WebApp/wwwroot/js/catalog-sort.js)
• CommentedOutCode (src/HybridApp/Components/Pages/Item/ItemPage.razor)
• Concentrated knowledge decay
• Documentation: no contributor guidance (README.md)
• Documentation: no usage examples (README.md)
• Duplicated block (10 lines × 2) (src/Identity.API/Models/ManageViewModels/ChangePasswordViewModel.cs)
• Duplicated block (10 lines × 2) (src/Webhooks.API/Apis/WebHooksApi.cs)
• Duplicated block (12 lines × 2) (src/ClientApp/Services/RequestProvider/RequestProvider.cs)
• Duplicated block (13 lines × 2) (src/HybridApp/Services/CatalogService.cs)
• …and 40 more

• 5 commits — 5 feature/other, 0 fixes

• (root) — 2 commits
• .github/skills — 1 commit
• img/eshop_homepage.png — 1 commit
• src/WebApp — 1 commit

• change: Clarify Aspire setup and deployment (#1019)
• change: Modernize storefront UX with a design-token foundation (#1014)
• change: Update README storefront screenshot (#1016)
• change: Upgrade Aspire and .NET 10 (#1008)
• change: Upgrade Aspire to 13.5.3 (#1018)

• 1 added · 0 removed (a removed endpoint is potentially breaking)

• GET /api/catalog/items/facets

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

dotnet/eShop was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.