Skip to content

The project
How it works
Decisions
Security
Try the demo
Live demo

Sidebar Navigation

Start here

Documentation
The project
Security

Architecture Decision Records

ADR-0001: Backend-For-Frontend (BFF) Pattern
ADR-0002: YARP Reverse Proxy Selection
ADR-0003: Argon2id Password Hashing
ADR-0004: Central Package Management (CPM)
ADR-0005: Scalar API Documentation
ADR-0006: Mapperly Object Mapping
ADR-0007: FluentValidation for Request Validation
ADR-0008: Step-Up Authentication with PIN
ADR-0009: Idempotency for Monetary Operations
ADR-0010: API-side PIN attempt-limiting (lockout)
ADR-0011: PIN-hash pepper (keyed hashing) with self-describing rehash-on-use
ADR-0012: Password/login attempt-limiting (account lockout)
ADR-0013: Registration user-enumeration — bounded, documented acceptance
ADR-0014: Recipient lookup — exact-match, harvest-resistant
ADR-0015: Decouple Identity UserName from the AzureTag; make the handle renameable
ADR-0016: Observability — OpenTelemetry three pillars with a local Grafana LGTM stack
ADR-0017: PII-safe telemetry and the CodeQL log-forging barrier
ADR-0018: BFF origin hardening — __Host- session cookie, Fetch-Metadata, no CORS
ADR-0019: SPA–BFF integration architecture for the frontend build-out
ADR-0020: On-demand account-number reveal (masked-by-default + PIN-gated /full-number)
ADR-0021: Refresh-token rotation with reuse-detection (+ BFF silent re-mint)
ADR-0022: Client-side money-mutation protocol
ADR-0023: Runtime response validation — spec-generated Zod, fail-closed on money
ADR-0024: No client-facing optimistic concurrency — ETag/If-Match rejected
ADR-0025: The originals are a reference mine, not a code source
ADR-0026: The absolute session cap is re-authenticated, never extended
ADR-0027: Dark mode through CSS custom properties, decided before the first paint
ADR-0028: A data router, bought for one hook — blocking browser Back on a live idempotency key
ADR-0029: One suite, two backends — making mock drift fail the build
ADR-0030: Running the app's own data layer against the real backend
ADR-0031: The app in a real browser, against the real stack
ADR-0032: Running the real-backend layers in CI, on a stack the job owns
ADR-0033: A root error boundary, so a render error is not a blank page
ADR-0034: Recovery for a family revoke that fails
ADR-0035: A check symbol on the transaction number
ADR-0036: Recovering from an account-number collision
ADR-0037: Registration is all-or-nothing
ADR-0038: The session is the only credential the BFF will accept
ADR-0039: The BFF session cache is a fallback, never the answer
ADR-0040: Changing a credential requires proving the current one
ADR-0041: The API verifies the transfer PIN, not the BFF
ADR-0042: A transfer authorisation is bound to its amount and payee, and spent once
ADR-0043: The published document declares the error body the API actually sends
ADR-0044: Security events go to an append-only, hash-chained table
ADR-0045: The enrolment notice rides the enrolment, and stops at a pickup directory
ADR-0046: One money cap for every move, and the client promises what the contract publishes
ADR-0047: A PIN change owes the same notice an enrolment does
ADR-0048: The API is the runner that delivers owed notices
ADR-0049: Closing an account is authorised like a transfer
ADR-0050: A UTC day bounds a user's external transfers, and the mint says so before the PIN
ADR-0051: The relay runs as an Azure Function, rehearsed locally against Azurite
ADR-0052: A notice names the audit row it belongs to
ADR-0053: The committed contract is what the API generates
ADR-0054: The BFF serves the built SPA under a CSP measured against it
ADR-0055: The API serves one client, the BFF
ADR-0056: A withdrawal is authorised like a transfer
ADR-0057: The BFF's refresh token is one reusable grant per session
ADR-0058: The API gives up cleanly when the database is down
ADR-0059: The SPA tells the visitor when the service is slow or down
ADR-0060: Migrations run as a one-shot container before the app
ADR-0061: The demo is deployed to Azure Container Apps with no database password
ADR-0062: Demo visitors get private copies from a prepared pool
ADR-0063: A visitor claims a prepared copy instead of registering
ADR-0064: The Azure deployment runs the demo from a scheduled pool job

The OpenAPI document

Architecture

How AzureBank works

Runbooks

Runbook — the audit chain is unavailable
Runbook — the demo pool
A subscriber says "this was not me" about a PIN notice
Runbook — a refresh token's reuse is recorded

Testing

Try the demo

Deferred: what was chosen not to build, and why

Anchoring the audit trail, and why it is not built
Relaying the enrolment notice, and what this deployment still cannot do

The exported anchor copy
The rendered notices
The audit trail against real practice
Engineering practices
AzureBank Engineering Playbook
Harness engineering on AzureBank
Engineering traps
Brand assets

On this page

Runbooks

Runbook — the audit chain is unavailable
Runbook — the demo pool
A subscriber says "this was not me" about a PIN notice
Runbook — a refresh token's reuse is recorded

Pager

Previous pageHow AzureBank works

Next pageRunbook — the audit chain is unavailable