.NET engineering deep dive

// ❌ boxing: every int is copied into a new heap object
ArrayList list = new();
for (int i = 0; i < 1_000; i++) list.Add(i);

// ✅ generic collection: ints stored inline, no boxing
List<int> nums = [];
for (int i = 0; i < 1_000; i++) nums.Add(i);

// ✅ small immutable value with value equality
public readonly record struct Money(decimal Amount, string Currency);

// ❌ mutable struct: changes a copy, not the original
var pos = positions[0]; pos.Qty += 10;   // positions[0] is unchanged

// ❌ leak: the static event keeps every watcher alive forever
public sealed class RateWatcher
{
    public RateWatcher() => FxFeed.RateChanged += OnRate;
    void OnRate(object? sender, decimal rate) { /* ... */ }
}

// ✅ unsubscribe in Dispose, and dispose deterministically
public sealed class RateWatcher : IDisposable
{
    public RateWatcher() => FxFeed.RateChanged += OnRate;
    void OnRate(object? sender, decimal rate) { /* ... */ }
    public void Dispose() => FxFeed.RateChanged -= OnRate;
}

// ✅ await using calls DisposeAsync at the end of the scope
await using var file = File.OpenRead(path);

// ❌ sync over async: blocks a pool thread (deadlocks where a context exists)
public decimal GetBalance(string id) => _client.GetBalanceAsync(id).Result;

// ❌ async void: exceptions crash the process, callers can't await it
public async void Refresh() => await _cache.ReloadAsync();

// ✅ async all the way, token passed through
public async Task<decimal> GetBalanceAsync(string id, CancellationToken ct)
{
    var dto = await _client.GetBalanceAsync(id, ct);
    return dto.Available;
}

// ✅ library code: don't capture the caller's context
var body = await reader.ReadToEndAsync(ct).ConfigureAwait(false);

// ✅ .NET 9+: a dedicated Lock instead of lock(object)
private readonly Lock _gate = new();
public void Add(decimal amount) { lock (_gate) { _total += amount; } }

// ❌ blocking inside a request: starves the pool under load
var limit = _limits.GetAsync(id).Result;

// ✅ async throttle: at most 4 calls to the core system at once
private readonly SemaphoreSlim _sem = new(4);
public async Task<Limit> GetLimitAsync(string id, CancellationToken ct)
{
    await _sem.WaitAsync(ct);
    try { return await _limits.GetAsync(id, ct); }
    finally { _sem.Release(); }
}

// ✅ bounded channel: producers wait when it's full (back-pressure)
var queue = Channel.CreateBounded<Payment>(new BoundedChannelOptions(1_000)
{
    FullMode = BoundedChannelFullMode.Wait
});

// ❌ captive dependency: a singleton that takes a scoped DbContext
builder.Services.AddSingleton<RateCache>();   // RateCache(AppDbContext db)

// ✅ fail fast in every environment, not just Development
builder.Host.UseDefaultServiceProvider(o =>
{
    o.ValidateScopes = true;
    o.ValidateOnBuild = true;
});

// ✅ a singleton worker creates one scope per unit of work
public sealed class SettlementWorker(IServiceScopeFactory scopes) : BackgroundService
{
    protected override async Task ExecuteAsync(CancellationToken ct)
    {
        using var timer = new PeriodicTimer(TimeSpan.FromMinutes(1));
        while (await timer.WaitForNextTickAsync(ct))
        {
            await using var scope = scopes.CreateAsyncScope();
            var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
            await SettleBatchAsync(db, ct);
        }
    }
}

// ✅ keyed services (.NET 8+)
builder.Services.AddKeyedSingleton<IPaymentRail, NppRail>("npp");
app.MapGet("/rail", ([FromKeyedServices("npp")] IPaymentRail rail) => rail.Name);

builder.Services.AddProblemDetails();
var app = builder.Build();

app.UseExceptionHandler();   // ✅ first: catches everything below it
app.UseHsts();
app.UseHttpsRedirection();
app.UseRouting();
app.UseRateLimiter();        // after routing for per-endpoint policies
app.UseCors();
app.UseAuthentication();     // ✅ who are you, then...
app.UseAuthorization();      // ✅ ...are you allowed
app.UseOutputCache();
app.MapStaticAssets();

var payments = app.MapGroup("/payments").RequireAuthorization();
payments.MapPost("/", CreatePayment)
        .AddEndpointFilter<IdempotencyKeyFilter>()
        .RequireRateLimiting("per-client");
app.MapGet("/healthz", () => "ok").ShortCircuit();

// ❌ UseAuthorization() before UseAuthentication(): every user is anonymous
// ❌ UseExceptionHandler() last: it can't catch errors from earlier middleware

// ❌ new client per call: sockets pile up in TIME_WAIT under load
using var http = new HttpClient();
var rate = await http.GetFromJsonAsync<FxRate>(url, ct);

// ✅ typed client + standard resilience pipeline
builder.Services.AddHttpClient<FxClient>(c =>
        c.BaseAddress = new Uri("https://fx.example.com/"))
    .AddStandardResilienceHandler();

public sealed class FxClient(HttpClient http)
{
    public Task<FxRate?> GetAsync(string pair, CancellationToken ct) =>
        http.GetFromJsonAsync<FxRate>($"rates/{pair}", ct);
}

// ✅ no DI (console tool, library)? one static client with a pooled lifetime
static readonly HttpClient Http = new(new SocketsHttpHandler
{
    PooledConnectionLifetime = TimeSpan.FromMinutes(2)
});

The resilience handler sets its own total timeout. Don't also set a short HttpClient.Timeout, or it cuts off the retries.

// ❌ N+1 (with lazy loading): one extra query per account, all entities tracked
var accounts = await db.Accounts.ToListAsync(ct);
foreach (var a in accounts)
    total += a.Transactions.Sum(t => t.Amount);

// ✅ one query, only the columns you need (projections aren't tracked)
var totals = await db.Accounts
    .Select(a => new { a.Id, Total = a.Transactions.Sum(t => t.Amount) })
    .ToListAsync(ct);

// ✅ bulk update without loading rows
await db.Cards.Where(c => c.ExpiresOn < today)
    .ExecuteUpdateAsync(s => s.SetProperty(c => c.Status, CardStatus.Expired), ct);

// ❌ string concatenation = SQL injection
db.Accounts.FromSqlRaw("SELECT * FROM Accounts WHERE Bsb = '" + bsb + "'");
// ✅ interpolated FromSql: bsb is sent as a parameter
db.Accounts.FromSql($"SELECT * FROM Accounts WHERE Bsb = {bsb}");

// ❌ allocates a string[] and three strings per line
var parts = line.Split('|');
decimal amt = decimal.Parse(parts[2], CultureInfo.InvariantCulture);

// ✅ zero-allocation parse with spans
ReadOnlySpan<char> s = line;
var field = s[(s.LastIndexOf('|') + 1)..];   // a view, not a copy
decimal amount = decimal.Parse(field, CultureInfo.InvariantCulture);

// ✅ compile-time regex and JSON (also trimming and AOT friendly)
public static partial class Bsb
{
    [GeneratedRegex(@"^\d{3}-\d{3}$")]
    public static partial Regex Pattern();
}

[JsonSerializable(typeof(Payment))]
internal partial class AppJson : JsonSerializerContext { }

var json = JsonSerializer.Serialize(payment, AppJson.Default.Payment);

[MemoryDiagnoser]   // BenchmarkDotNet: adds an "Allocated" column
public class ParseBench { /* [Benchmark] methods */ }

public interface IAccountGrain : IGrainWithStringKey
{
    Task<decimal> Deposit(decimal amount);
}

[GenerateSerializer]
public sealed class AccountState { [Id(0)] public decimal Balance { get; set; } }

public sealed class AccountGrain(
    [PersistentState("account", "accounts")] IPersistentState<AccountState> state)
    : Grain, IAccountGrain
{
    public async Task<decimal> Deposit(decimal amount)
    {
        state.State.Balance += amount;   // ✅ one call at a time: no lock needed
        await state.WriteStateAsync();
        return state.State.Balance;
    }
}

builder.UseOrleans(silo => silo
    .UseLocalhostClustering()
    .AddMemoryGrainStorage("accounts"));   // dev only; use real storage in prod

var balance = await grains.GetGrain<IAccountGrain>("acc-123").Deposit(50m);

// ❌ blocking inside a grain (.Result) stalls every caller of that grain

// ✅ global.json: pin the SDK so every build machine behaves the same
{ "sdk": { "version": "10.0.100", "rollForward": "latestFeature" } }

<!-- ✅ A library mid-migration: one codebase, two targets -->
<PropertyGroup>
  <TargetFrameworks>net48;net10.0</TargetFrameworks>
</PropertyGroup>
<ItemGroup Condition="'$(TargetFramework)' == 'net48'">
  <Reference Include="System.Web" />
</ItemGroup>

// ✅ Isolate the few platform differences behind #if
#if NETFRAMEWORK
    string? user = HttpContext.Current?.User?.Identity?.Name;           // System.Web
#else
    string? user = accessor.HttpContext?.User.Identity?.Name;          // IHttpContextAccessor
#endif

// ❌ Big-bang rewrite of every project at once: long freeze, high risk

// inline short-circuit
app.Use(async (ctx, next) =>
{
    if (!ctx.Request.Headers.ContainsKey("X-Api-Key"))
    {
        ctx.Response.StatusCode = StatusCodes.Status401Unauthorized;
        return;                                  // next never runs
    }
    await next(ctx);
});

// branches
app.Map("/legacy", b => b.Run(ctx => { ctx.Response.StatusCode = 410; return Task.CompletedTask; }));
app.UseWhen(ctx => ctx.Request.Path.StartsWithSegments("/api"),
            b => b.UseMiddleware<TenantMiddleware>());   // rejoins the main pipeline

// factory-based: resolved from DI per request, so scoped ctor deps are fine
public sealed class TenantMiddleware(AppDbContext db) : IMiddleware
{
    public async Task InvokeAsync(HttpContext ctx, RequestDelegate next)
    {
        ctx.Items["Tenant"] = await db.Tenants.FindAsync(ctx.Request.Headers["X-Tenant"].ToString());
        await next(ctx);
    }
}
builder.Services.AddScoped<TenantMiddleware>();

// global exception handling (.NET 8+)
public sealed class RuleExceptionHandler(IProblemDetailsService problems, ILogger<RuleExceptionHandler> log)
    : IExceptionHandler
{
    public async ValueTask<bool> TryHandleAsync(HttpContext ctx, Exception ex, CancellationToken ct)
    {
        if (ex is not BusinessRuleException rule) return false;   // next handler, then the default
        log.LogWarning(ex, "Business rule failed");               // .NET 10 doesn't log handled ones
        ctx.Response.StatusCode = StatusCodes.Status422UnprocessableEntity;
        return await problems.TryWriteAsync(new ProblemDetailsContext
        {
            HttpContext = ctx,
            ProblemDetails = new ProblemDetails { Status = 422, Title = "Business rule violated", Detail = rule.Message }
        });
    }
}
builder.Services.AddProblemDetails();
builder.Services.AddExceptionHandler<RuleExceptionHandler>();
app.UseExceptionHandler();                     // first in the pipeline (23.6)

// ❌ convention middleware with a scoped dependency in the constructor
public class BadMiddleware(RequestDelegate next, AppDbContext db) { /* captive DbContext */ }

// rate limiting: per-user fixed window, 429 instead of the default 503
builder.Services.AddRateLimiter(o =>
{
    o.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
    o.AddPolicy("per-client", ctx => RateLimitPartition.GetFixedWindowLimiter(
        ctx.User.Identity?.Name ?? "anonymous",
        _ => new FixedWindowRateLimiterOptions { PermitLimit = 100, Window = TimeSpan.FromMinutes(1) }));
});
builder.Services.AddOutputCache(o => o.AddPolicy("short", p => p.Expire(TimeSpan.FromSeconds(30)).Tag("rates")));
builder.Services.AddCors(o => o.AddPolicy("web", p =>
    p.WithOrigins("https://app.example.com").AllowAnyHeader().WithMethods("GET", "POST")));

// add traceId to every ProblemDetails
builder.Services.AddProblemDetails(o => o.CustomizeProblemDetails = c =>
    c.ProblemDetails.Extensions["traceId"] = Activity.Current?.Id ?? c.HttpContext.TraceIdentifier);

// controller equivalent: [ApiController] gives auto-400 and binding inference
[ApiController, Route("api/v1/accounts")]
public class AccountsController(IAccountStore store) : ControllerBase
{
    [HttpGet("{id:guid}")]
    [ProducesResponseType<AccountDto>(200), ProducesResponseType(404)]
    public async Task<ActionResult<AccountDto>> Get(Guid id, CancellationToken ct)
        => await store.FindAsync(id, ct) is { } a ? a : NotFound();
}

// integration test (xUnit)
public class AccountsApiTests(WebApplicationFactory<Program> factory)
    : IClassFixture<WebApplicationFactory<Program>>
{
    [Fact]
    public async Task Invalid_body_returns_problem_details()
    {
        var res = await factory.CreateClient().PostAsJsonAsync("/api/v1/accounts", new { name = "", deposit = -5 });
        Assert.Equal(HttpStatusCode.BadRequest, res.StatusCode);
        Assert.Equal("application/problem+json", res.Content.Headers.ContentType?.MediaType);
    }
}

@* Pages/Customers/Edit.cshtml: a Razor Page *@
@page "{id:guid}"
@model EditCustomerModel
<form method="post">                        @* token added automatically *@
    <input asp-for="Input.Name" /> <span asp-validation-for="Input.Name"></span>
    <button>Save</button>
</form>

// Edit.cshtml.cs
public class EditCustomerModel(ICustomerService customers) : PageModel
{
    [BindProperty] public CustomerInput Input { get; set; } = new();

    public async Task OnGetAsync(Guid id) => Input = await customers.GetAsync(id);

    public async Task<IActionResult> OnPostAsync(Guid id)
    {
        if (!ModelState.IsValid) return Page();
        await customers.UpdateAsync(id, Input);
        return RedirectToPage("Index");
    }
}

@* Components/Pages/Counter.razor: Blazor, interactive over SignalR *@
@page "/counter"
@rendermode InteractiveServer
<button @onclick="() => count++">Clicked @count times</button>
@code { int count; }

// Program.cs (Blazor Web App)
builder.Services.AddRazorComponents().AddInteractiveServerComponents();
app.UseAntiforgery();
app.MapRazorComponents<App>().AddInteractiveServerRenderMode();

// Entra ID: reads Instance, TenantId, ClientId from the "AzureAd" section
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

builder.Services.AddSingleton<IAuthorizationHandler, AccountOwnerHandler>();
builder.Services.AddAuthorizationBuilder()
    .SetFallbackPolicy(new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build())
    .AddPolicy("AccountOwner", p => p.AddRequirements(new AccountOwnerRequirement()));

// ✅ Resource-based: the rule needs the record, so check after loading it
app.MapGet("/accounts/{id:int}", async (int id, ClaimsPrincipal user,
    IAuthorizationService authz, AppDb db, CancellationToken ct) =>
{
    var acct = await db.Accounts.FindAsync([id], ct);
    if (acct is null) return Results.NotFound();
    var result = await authz.AuthorizeAsync(user, acct, "AccountOwner");
    return result.Succeeded ? Results.Ok(acct) : Results.Forbid();
});
app.MapGet("/status", () => "ok").AllowAnonymous();

public class AccountOwnerRequirement : IAuthorizationRequirement { }
public class AccountOwnerHandler : AuthorizationHandler<AccountOwnerRequirement, Account>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext ctx,
        AccountOwnerRequirement req, Account acct)
    {
        if (acct.OwnerId == ctx.User.GetObjectId()) ctx.Succeed(req); // Entra "oid"
        return Task.CompletedTask;
    }
}

// ❌ ValidateIssuer = false, ValidateAudience = false: accepts any tenant's tokens
// ❌ new JwtSecurityTokenHandler().ReadJwtToken(raw): decodes, doesn't validate

builder.Services.AddSingleton(TimeProvider.System);
builder.Services.AddSingleton<AuditInterceptor>();
builder.Services.AddDbContextPool<AppDb>((sp, o) => o
    .UseSqlServer(builder.Configuration.GetConnectionString("Db"),
                  sql => sql.EnableRetryOnFailure())
    .AddInterceptors(sp.GetRequiredService<AuditInterceptor>()));

public sealed class AuditInterceptor(TimeProvider clock) : SaveChangesInterceptor
{
    public override ValueTask<InterceptionResult<int>> SavingChangesAsync(
        DbContextEventData e, InterceptionResult<int> result, CancellationToken ct = default)
    {
        foreach (var entry in e.Context!.ChangeTracker.Entries<IAudited>())
            if (entry.State is EntityState.Added or EntityState.Modified)
                entry.Entity.UpdatedAt = clock.GetUtcNow();
        return base.SavingChangesAsync(e, result, ct);
    }
}

// ✅ Several saves in one transaction, retried as a whole
var strategy = db.Database.CreateExecutionStrategy();
await strategy.ExecuteAsync(async () =>
{
    await using var tx = await db.Database.BeginTransactionAsync(ct);
    db.Transfers.Add(transfer);              await db.SaveChangesAsync(ct);
    await db.Database.ExecuteSqlAsync($"EXEC PostLedger {transfer.Id}", ct);
    await tx.CommitAsync(ct);
});

// ✅ EF 10 LeftJoin instead of GroupJoin + SelectMany + DefaultIfEmpty
var rows = await db.Accounts.LeftJoin(db.Branches, a => a.BranchId, b => b.Id,
    (a, b) => new { a.Id, Branch = b == null ? "(none)" : b.Name }).ToListAsync(ct);
var deletedToo = await db.Accounts.IgnoreQueryFilters(["SoftDelete"]).ToListAsync(ct);

// ✅ Dapper for a tuned read: parameters, never concatenation
var list = await conn.QueryAsync<AccountDto>(
    "SELECT Id, Balance FROM Accounts WHERE BranchId = @branchId", new { branchId });

// dotnet ef migrations add AddRowVersion
// dotnet ef migrations script --idempotent -o migrate.sql   (review, run in the pipeline)
// dotnet ef migrations bundle -o efbundle                    (self-contained runner)

// Key Vault, added last so it overrides earlier providers ("Db--Password" => "Db:Password")
if (!builder.Environment.IsDevelopment())
    builder.Configuration.AddAzureKeyVault(
        new Uri($"https://{builder.Configuration["KeyVaultName"]}.vault.azure.net/"),
        new DefaultAzureCredential());            // managed identity when running in Azure

// Compile-time validator instead of reflection-based ValidateDataAnnotations
builder.Services.AddSingleton<IValidateOptions<PaymentsOptions>, PaymentsOptionsValidator>();

builder.Services.Configure<HostOptions>(o => o.ShutdownTimeout = TimeSpan.FromSeconds(45));
builder.Services.AddHealthChecks()
    .AddDbContextCheck<AppDb>(tags: ["ready"]);

var app = builder.Build();
app.MapHealthChecks("/health/live", new HealthCheckOptions { Predicate = _ => false });
app.MapHealthChecks("/health/ready", new HealthCheckOptions { Predicate = c => c.Tags.Contains("ready") });

app.Lifetime.ApplicationStopping.Register(() => app.Logger.LogInformation("Draining"));
app.Run();

[OptionsValidator]
public partial class PaymentsOptionsValidator : IValidateOptions<PaymentsOptions> { }

// ❌ public OutboxWorker(AppDb db): a scoped DbContext captured by a singleton
// ❌ IOptionsSnapshot<T> in a singleton: scoped service, resolution fails

// ✅ Calling a WCF/SOAP service from .NET 10 (System.ServiceModel.Http)
[ServiceContract]
public interface IPaymentService
{
    [OperationContract] Task<string> SubmitAsync(string paymentXml);  // maps to "Submit"
}

var factory = new ChannelFactory<IPaymentService>(
    new BasicHttpBinding(BasicHttpSecurityMode.Transport),
    new EndpointAddress("https://payments.example.com/PaymentService.svc"));
IPaymentService client = factory.CreateChannel();
string reply = await client.SubmitAsync(xml);
((IClientChannel)client).Close();

// ✅ CoreWCF reusing an existing config file (CoreWCF.ConfigurationManager)
builder.Services.AddServiceModelConfigurationManagerFile("wcf.config");
builder.WebHost.UseNetTcp(8090);   // netTcp port is set in code, not in <host>

// ❌ Rewriting every service to REST in one go: months of risk, no business value

// ✅ Testable time: inject TimeProvider, fake it in tests
public sealed class CardExpiry(TimeProvider clock)
{
    public bool IsExpired(DateOnly expiresOn) =>
        DateOnly.FromDateTime(clock.GetUtcNow().UtcDateTime) > expiresOn;
}

[Fact]
public void Expires_after_the_date()
{
    var clock = new FakeTimeProvider(new DateTimeOffset(2026, 10, 17, 0, 0, 0, TimeSpan.Zero));
    var card = new CardExpiry(clock);
    Assert.False(card.IsExpired(new DateOnly(2026, 10, 31)));
    clock.Advance(TimeSpan.FromDays(30));                 // no Thread.Sleep, no flaky test
    Assert.True(card.IsExpired(new DateOnly(2026, 10, 31)));
}

// ✅ HybridCache: cache-aside, stampede protection and tags in one call
public interface IFxClient { ValueTask<decimal> FetchAsync(string pair, CancellationToken ct); }

public sealed class FxRates(HybridCache cache, IFxClient fx)
{
    public ValueTask<decimal> GetAsync(string pair, CancellationToken ct) =>
        cache.GetOrCreateAsync($"fx:{pair}", token => fx.FetchAsync(pair, token),
            tags: ["fx"], cancellationToken: ct);

    public ValueTask ResetAsync(CancellationToken ct) => cache.RemoveByTagAsync("fx", ct);
}

// ✅ .NET 10 file-based app (tool.cs, no .csproj): dotnet run tool.cs
#:package Humanizer@2.14.1
using Humanizer;
Console.WriteLine(TimeSpan.FromMinutes(90).Humanize());

// ❌ DateTime.UtcNow inside business logic: untestable, so tests sleep or skip