Guides

Derived. The behaviour described here is specified under openspec/specs/. Those specifications are the source; this page explains and illustrates them.

Task-oriented how-tos for the most common Stratara operations. Each guide assumes you've worked through Getting Started and at least the first sample.

Domain wiring

• Write a Command Handler — ICommandHandler<T> + DI registration.
• Write a Projection — read-side stores driven by event bundles.
• Write a Saga — process managers that fan one event into many commands.

Pipeline behaviors

• Write a Validator — IValidator<T> that runs before the handler.
• Enforce Tenant Isolation — reject cross-tenant requests at the mediator entrance.

Security

• Encrypt Sensitive Data — [EncryptData] + AES-GCM + tenant-aware AAD.
• Authorization Decorators — [RequireRole] + AuthorizingMediator.
• Bus-Envelope Integrity (HMAC) — opt-in tamper protection on the message bus.

Identity & access

Who the caller is, which tenant they act in, and what they may do there.

• Tenant Membership — many-to-many user↔tenant with per-membership roles, and the stratara:tenant_id sign-in bridge.
• Permission-Based Authorization — [RequirePermission] + the code-first permission catalog.
• Scoped Settings — global / tenant / user / user-in-tenant values with a fixed fallback chain.
• API Keys and Personal Access Tokens — machine callers on the same authorization plane as humans.
• External Login (OpenID Connect) + JIT Provisioning — link by issuer sub, fail-closed against nOAuth-class takeover.

Infrastructure

• Outbox — RabbitMQ — broker setup + worker wiring.
• Outbox — Azure Service Bus — managed-identity setup.
• Configure Snapshots — ISnapshotStrategy + when to deviate from the version threshold.

Test discipline

• Testing Patterns — xUnit v3 MTP idioms, integration-test boundary, test-fakes.