An Attendance Platform in ASP.NET Core
Badge gates, WFH timers and shift allowances - the shape of a seven-project intranet attendance platform, the onion it almost is, and the roadmap for fourteen more parts.
Series
An Attendance Platform in ASP.NET Core
In reading order.
- 15 parts
- ≈ 92 min total
- 15 published
Logging In with CAS When Everyone Uses OAuth
A 2004-vintage SSO protocol wired into ASP.NET Core - ticket validation, roles derived from the database at login time, and single sign-out through a WordPress front door.
Compiling Authorization Out of Debug Builds
Every controller wrapped its Authorize attribute in
Resurrecting Html.Action in ASP.NET Core
MVC5 child actions were removed from ASP.NET Core, so this codebase re-implemented them - an ActionContext conjured mid-request, a MemoryStream response swap, and a .Result at the heart of 118 call sites.
A DB-First Model in Code-First Clothing
A decimal surrogate key beside the natural key that does the work, scaffolded index cruft with a placeholder name, a DbSet of List of string, and lazy proxies in a projection minefield.
Three Ways to Call a Stored Procedure
Reflection that builds EXEC statements, a table-valued function called by string interpolation, and a raw ADO.NET runner returning lists of lists - one codebase, three coexisting answers to the same question.
The Multi-Result-Set Dream EF Core Wouldn't Grant
An entire stored-procedure framework built on an EF6 extension library, shipped inside an EF Core app, in a folder named Future - the anatomy of an abandoned migration and how to recognise one.
A Report Builder Users Drag and Drop
Templates, columns, filters and group-bys stored in tables, a fluent WHERE/HAVING/ORDER builder that parameterises values but concatenates identifiers - self-service BI, second-order injection, and a handful of copy-paste bugs.
Every Intranet App Ends Up Exporting Excel
EPPlus export by reflection, attribute-ordered columns, six near-identical branches, a ten-byte corrupt-file catch, a ghost OpenXml reference, formula injection, and the licence change that caught a lot of teams off guard.
Sticky Sessions, Wrong Cache
In-memory session behind three App Service instances with affinity disabled, two distributed caches configured at once, a 1000-second easy-testing timeout, and a Redis expiry that throws every December.
A Timer You Can Stop from an Email
A work-from-home swipe modelled as a state machine, a stop-from-email deep link, the estate's one deliberate IDOR guard that compares instead of overwrites, and a DbContext constructed by hand inside the action.
Email Templates Live in the Database
HTML templates seeded in OnModelCreating, a reflection mini-language that resolves hash-brace tokens against a model, a Gmail-versus-SMTP environment branch, Cc quietly added into To, and string.Format run over raw HTML.
Two Key Vault SDKs, One Password in Plain Sight
One class bridging the legacy ADAL KeyVaultClient and the modern SecretClient, three coexisting secret postures - managed identity, a service-principal password in config, a committed key file - and a migration frozen mid-flight.
The Dependency Graveyard
AutoMapper referenced and never mapped, a ghost OpenXml import, a full-framework MVC5 reference in a Core app, Hangfire packages with no jobs, unconfigured Serilog sinks, and an unregistered middleware - what unused packages cost even when nothing calls them.
What a Hand-Rolled Intranet App Taught Me
The honest retrospective - copy-paste as a pattern, zero tests, PII in telemetry and what employee-monitoring data demands, destructive error handling, and the handful of decisions that genuinely earned their keep.