Architecture styles, microservice patterns & serverless

// xUnit + NetArchTest: the domain must not depend on infrastructure or EF Core
[Fact]
public void Domain_has_no_infrastructure_dependencies()
{
    var result = Types.InAssembly(typeof(Account).Assembly)
        .That().ResideInNamespace("Bank.Domain")
        .ShouldNot().HaveDependencyOnAny("Bank.Infrastructure", "Microsoft.EntityFrameworkCore")
        .GetResult();

    Assert.True(result.IsSuccessful);
}

// Application (inner): owns the port. No EF Core, no HTTP.
public interface IAccountStore                              // outbound port
{
    Task<Account?> FindAsync(Guid id, CancellationToken ct);
    Task SaveAsync(CancellationToken ct);                   // one unit of work
}

public sealed class TransferFunds(IAccountStore store)      // use case (inbound port)
{
    public async Task Handle(Guid from, Guid to, decimal amount, CancellationToken ct)
    {
        var source = await store.FindAsync(from, ct) ?? throw new KeyNotFoundException();
        var target = await store.FindAsync(to, ct) ?? throw new KeyNotFoundException();
        source.Withdraw(amount);                            // the rules live in the domain
        target.Deposit(amount);
        await store.SaveAsync(ct);
    }
}

// Infrastructure (outer): the adapter depends on the port, not the other way round
public sealed class EfAccountStore(BankDbContext db) : IAccountStore
{
    public Task<Account?> FindAsync(Guid id, CancellationToken ct) =>
        db.Accounts.FindAsync([id], ct).AsTask();
    public Task SaveAsync(CancellationToken ct) => db.SaveChangesAsync(ct);
}

// Api (outermost): wire it up
builder.Services.AddScoped<IAccountStore, EfAccountStore>();
builder.Services.AddScoped<TransferFunds>();

// AppHost/Program.cs: the whole system in one place
var builder = DistributedApplication.CreateBuilder(args);

var sql = builder.AddSqlServer("sql");
var accountsDb = sql.AddDatabase("accountsdb");     // database per service
var paymentsDb = sql.AddDatabase("paymentsdb");

var accounts = builder.AddProject<Projects.Accounts_Api>("accounts")
    .WithReference(accountsDb).WaitFor(accountsDb);

builder.AddProject<Projects.Payments_Api>("payments")
    .WithReference(paymentsDb)
    .WithReference(accounts);                       // service discovery by name

builder.Build().Run();

builder.Services.AddServiceDiscovery();
builder.Services.ConfigureHttpClientDefaults(http =>
{
    http.AddStandardResilienceHandler();  // retry, timeout, circuit breaker
    http.AddServiceDiscovery();           // resolve logical service names
});
builder.Services.AddHttpClient<AccountsClient>(c =>
    c.BaseAddress = new("https+http://accounts"));
builder.Services.AddHealthChecks();

var app = builder.Build();
app.MapHealthChecks("/health");

// Dashboard BFF: one call from the app, two services behind it
builder.Services.AddServiceDiscovery();
builder.Services.ConfigureHttpClientDefaults(h => h.AddServiceDiscovery());

builder.Services.AddHttpClient<AccountsClient>(c => c.BaseAddress = new("https+http://accounts"))
    .AddStandardResilienceHandler();
builder.Services.AddHttpClient<CardsClient>(c => c.BaseAddress = new("https+http://cards"))
    .AddStandardResilienceHandler(o => o.AttemptTimeout.Timeout = TimeSpan.FromMilliseconds(800));
builder.Services.AddProblemDetails();   // RFC 9457 errors
builder.Services.AddOpenApi();          // contract at /openapi/v1.json

var app = builder.Build();
app.MapOpenApi();

app.MapGet("/dashboard", async (ClaimsPrincipal user,
    AccountsClient accounts, CardsClient cards, CancellationToken ct) =>
{
    var id = user.FindFirstValue(ClaimTypes.NameIdentifier)!;
    var balancesTask = accounts.GetAsync(id, ct);       // required
    var cardsTask    = Try(cards.GetAsync(id, ct));     // optional tile, runs in parallel

    var balances = await balancesTask;                  // let a required call fail
    var myCards  = await cardsTask;
    return TypedResults.Ok(new DashboardView(balances, myCards, Degraded: myCards is null));
}).RequireAuthorization();

app.Run();

static async Task<T?> Try<T>(Task<T> call) where T : class
{
    try { return await call; }
    catch (Exception ex) when (ex is HttpRequestException
        or TimeoutRejectedException or BrokenCircuitException)
    { return null; }                                    // degrade, don't fail the page
}

Task.WhenAll on its own fails the whole response when one call fails. Decide per call: required calls may fail the request, optional calls degrade.

[Function(nameof(PaymentSaga))]
public static async Task PaymentSaga([OrchestrationTrigger] TaskOrchestrationContext ctx)
{
    var payment = ctx.GetInput<Payment>()!;
    var undo = new Stack<string>();
    try
    {
        await ctx.CallActivityAsync("ReserveFunds", payment); undo.Push("ReleaseFunds");
        await ctx.CallActivityAsync("DebitAccount", payment); undo.Push("CreditBack");
        await ctx.CallActivityAsync("SendPayment", payment);
        await ctx.CallActivityAsync("Notify", payment);
    }
    catch (TaskFailedException)
    {
        while (undo.TryPop(out var step))       // compensate in reverse order
            await ctx.CallActivityAsync(step, payment);
        throw;
    }
}

Compensating activities must be idempotent and should not fail. Give them their own retry policy.

public record Deposited(decimal Amount);
public record Withdrawn(decimal Amount);

public sealed class Account                 // state is rebuilt from events
{
    public Guid Id { get; set; }
    public decimal Balance { get; set; }
    public void Apply(Deposited e) => Balance += e.Amount;
    public void Apply(Withdrawn e) => Balance -= e.Amount;
}

// Write side (Marten): append an event to the account's stream
await using var session = store.LightweightSession();
session.Events.Append(accountId, new Withdrawn(100m));
await session.SaveChangesAsync(ct);

// Read side: fold the stream into current state (or query a projected view)
var account = await session.Events.AggregateStreamAsync<Account>(accountId);

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddHttpForwarder();
var app = builder.Build();

// Features already migrated are handled by the new app...
app.MapGet("/api/accounts/{id}", GetAccount);

// ...everything else still goes to the legacy system (lowest-priority route)
app.MapForwarder("/{**catch-all}", "https://legacy.bank.internal")
   .Add(b => ((RouteEndpointBuilder)b).Order = int.MaxValue);

app.Run();

builder.Services.AddDaprClient();
var app = builder.Build();
app.UseCloudEvents();
app.MapSubscribeHandler();   // tells the sidecar which topics we subscribe to

// Publish: the sidecar talks to the real broker (Service Bus, Kafka, Redis...)
app.MapPost("/payments", async (Payment p, DaprClient dapr) =>
{
    await dapr.PublishEventAsync("pubsub", "payments", p);
    return Results.Accepted();
});

// Subscribe: the sidecar delivers events here
app.MapPost("/on-payment", (Payment p) => Results.Ok())
   .WithTopic("pubsub", "payments");

If the mesh already retries, don't stack aggressive app-level retries on top. You'll multiply load during an outage.

public sealed record Money(decimal Amount, string Currency)
{
    public Money Add(Money other) => other.Currency == Currency
        ? this with { Amount = Amount + other.Amount }
        : throw new InvalidOperationException("Currency mismatch");
}

public sealed class Account                       // aggregate root
{
    public Guid Id { get; private set; }
    public Money Balance { get; private set; } = new(0, "AUD");
    public List<object> DomainEvents { get; } = [];

    public void Deposit(Money amount)
    {
        if (amount.Amount <= 0) throw new ArgumentException("Must be positive");
        Balance = Balance.Add(amount);
        DomainEvents.Add(new MoneyDeposited(Id, amount));
    }
}

// EF Core: Money becomes Balance_Amount / Balance_Currency columns
modelBuilder.Entity<Account>().ComplexProperty(a => a.Balance);
modelBuilder.Entity<Account>().Ignore(a => a.DomainEvents);

Event storming is a workshop, so there's no library. This is how the stickies usually map to .NET code afterwards:

public sealed class PaymentFunctions(ILogger<PaymentFunctions> log)
{
    // Queue-based load levelling: Service Bus trigger
    [Function("ProcessPayment")]
    public async Task Process(
        [ServiceBusTrigger("payments", Connection = "ServiceBus")] Payment payment)
    {
        log.LogInformation("Processing {PaymentId}", payment.Id);
        await Task.CompletedTask; // do the work; keep it short and idempotent
    }

    // Scheduled job: replaces a cron VM (02:00 every day)
    [Function("NightlyReconciliation")]
    public Task Reconcile([TimerTrigger("0 0 2 * * *")] TimerInfo timer) =>
        Task.CompletedTask;
}

.NET 10 can't run on the Linux Consumption plan: use Flex Consumption. Cap concurrency in host.json (e.g. Service Bus maxConcurrentCalls) to protect downstream databases.

var builder = WebApplication.CreateBuilder(args);   // env vars are read by default

builder.Configuration.AddAzureAppConfiguration(o =>
    o.Connect(new Uri(builder.Configuration["AppConfig:Endpoint"]!),
              new DefaultAzureCredential()));

builder.Services.AddOptions<PaymentOptions>()
    .BindConfiguration("Payments")
    .ValidateDataAnnotations()
    .ValidateOnStart();                              // fail fast on bad config

builder.Services.Configure<HostOptions>(o =>
    o.ShutdownTimeout = TimeSpan.FromSeconds(30));   // graceful shutdown window
builder.Logging.AddJsonConsole();                    // logs as an event stream

// EF Core 10: named filters, so soft delete can be ignored while the tenant filter stays
public sealed class BankDbContext(DbContextOptions<BankDbContext> options, ITenantContext tenant)
    : DbContext(options)
{
    private string TenantId => tenant.TenantId;
    public DbSet<Account> Accounts => Set<Account>();

    protected override void OnModelCreating(ModelBuilder b) =>
        b.Entity<Account>()
         .HasQueryFilter("Tenant", a => a.TenantId == TenantId)
         .HasQueryFilter("SoftDelete", a => !a.IsDeleted);
}
// db.Accounts.IgnoreQueryFilters(["SoftDelete"]) still only sees this tenant's rows

// One token bucket per tenant: a noisy tenant can't starve the others
builder.Services.AddRateLimiter(o =>
{
    o.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
    o.GlobalLimiter = PartitionedRateLimiter.Create<HttpContext, string>(ctx =>
        RateLimitPartition.GetTokenBucketLimiter(
            ctx.User.FindFirst("tenant_id")?.Value ?? "anonymous",
            _ => new TokenBucketRateLimiterOptions
            {
                TokenLimit = 200, TokensPerPeriod = 100,
                ReplenishmentPeriod = TimeSpan.FromSeconds(1)
            }));
});

IgnoreQueryFilters() with no names turns off every filter, including the tenant one. Always pass the names you mean.