No Coding Whatsoever
A 2018 API gateway promises that routing, auth, validation and messaging need no code at all - this series reads the source that makes the promise true, and the places where it is not.
Series
No Coding Whatsoever
In reading order.
- 13 parts
- ≈ 88 min total
- 13 published
The Route Table Is a Compiler Output
Ntrada writes no middleware - it compiles YAML into ASP.NET Core endpoints and lets the framework's matcher do the work. Then you try to declare a PATCH route.
Match All and the Reserved Word Nobody Documented
Forty lines build every upstream path Ntrada can express, and thirty more build the downstream URL - where named segments substitute, one key appends, and one config flag runs backwards.
Thirteen Lines Are the Whole Pipeline
Ntrada's request pipeline is a gate and a dictionary lookup - and four extension hooks around it, one of which lost the thing it existed to see when a disposal bug was fixed.
The Payload Template That Could Never Load
Two notions of module identity, a silent continue on a missing file - and a live bug the unreachable code was hiding.
Five Parses to Reject One Request
A validated POST is parsed, re-serialised and parsed again on its way to a schema compiled fresh per request - and when it fails validation the caller gets HTTP 200.
The Parser That Works Because Its Bug Is Harmless
Two mini-languages share one parser that runs both resolvers unconditionally and strips the first and last character from every token - and it is correct only by coincidence.
Three Predicates, One Flag
Three components decide independently whether a route needs authentication, only one of them consults auth.enabled - and the combination that turns a public route into a 403.
The Claims Map That Does Not Exist
The README and the sample both configure an auth claims alias map, the configuration class has no such property, and the binder's ignore-unknown-keys behaviour is what makes the omission silent.
Building a Second Container to Read One Value
services.BuildServiceProvider() inside ConfigureServices - what it actually costs, why it does not leak here, and how a zero-parameter extension method signature forced it.
Everything Is a Singleton
Twenty-two registrations, zero scoped, zero transient - a lifetime decision that buys a genuinely fast request path and enables exactly three bugs, all of them the same mistake.
Your API Gateway Cannot Proxy an Image
Every downstream response is buffered into a UTF-16 string and re-encoded on the way out, so binary bodies corrupt silently behind a plausible status code and a recomputed Content-Length.
Nothing Was Ever Frozen
The retrospective - configuration stays mutable, ordering stays emergent, one method absorbs every concern, and the only outside contributor correctly chose to duplicate sixteen lines rather than refactor.