# Project plan — findndrive_api_net

Evidence date: 2026-10-15. Source repository: `git@bitbucket.org:overdrive/findndrive_api_net.git`.

Inspected revision: `master` at `a2414dd` (2023-12-12 14:04:02 +0000, subject "README.md edited online with Bitbucket"). `origin/HEAD` points at `master`. The scan-host path on the onboarding issue was not on this machine. The tree was read from a full clone of that revision. Secret values found in source are named by file and are not repeated here.

There is no prior Silicon Ark directory for this repository. Sibling directories `findndrive_webportal` and `findndrive_pwa` exist in Silicon Ark. This repository does not reference them. Whether they are callers of this API is **Unknown / Requires Confirmation**.

## What this repository is

`README.md` titles the product **Find and Drive API**. It says the API has three endpoints that predict what amount of financing an individual qualifies for, that it integrates with TransUnion and Experian, and that it is written in C# on .NET 6.

The solution `FindAndDrive.sln` is an ASP.NET Core Web API. Callers authenticate with an API key, receive a JWT, and then:

1. Post a pre-qualification and receive a rough monthly and total financing amount plus an applicant id.
2. Post a prediction for that applicant. The API calls Experian affordability and TransUnion credit, stores the result, and returns the applicant id.
3. Read the stored applicant back by id, limited to the client id on the token.

Provenance: **Documented** in `README.md` for the three-endpoint summary and the two bureaus. **Implemented** in `FinancingController` and `FinancingService`. A written product goal beyond that README paragraph was not found.

## Objectives visible in the repository

| Objective | Evidence | Provenance |
|---|---|---|
| Predict a financing amount from income, deposit, and later bureau data | `README.md`; `FinancingService.FinancingCalc` and `Analytics` | Documented and implemented |
| Call Experian affordability and TransUnion quick credit | `ExperianGateway`, `TransUnionGateway` | Implemented |
| Issue JWTs from API key id and secret, with role permissions | `AuthenticationService`, `Permissions` | Implemented |
| Let an admin client create clients and API keys | `ClientController`, `ApiKeyController` | Implemented |
| Persist applicants and bureau results in SQL Server | EF Core `DefaultContext`, migrations under `FindAndDrive.Persistence/Migrations` | Implemented |
| Run SonarQube on `master` | `bitbucket-pipelines.yml` | Implemented as CI only |

## Scope

In scope of the committed tree:

- HTTP API in `FindAndDrive.API`.
- Domain services, entities, and DTOs in `FindAndDrive.Domain`.
- EF Core persistence and migrations in `FindAndDrive.Persistence`.
- Experian and TransUnion HTTP gateways.
- xUnit tests and an NBomber performance harness.
- A SQL Server backup `database/FindAndDrive.bak` (about 5.0 MB). The backup was not restored. Its rows were not read.

Out of scope of this repository, as far as the tree shows:

- A user interface. None is present.
- A deploy pipeline, container, or hosting manifest. None is present.
- Queues, background workers, or schedulers. None are registered.

## System architecture

```text
Caller
  │  POST /api/Authentication/token  (API key id + secret)
  ▼
FindAndDrive.API  (ASP.NET Core, net6.0)
  │  JWT with ClientId, apiKeyId, Permissions
  ▼
FinancingService
  ├─ SQL Server via EF Core (applicants and related rows)
  ├─ ExperianGateway  → hardcoded UAT Compuscan affordability URL
  └─ TransUnionGateway → hardcoded TransUnion autotest SOAP URL
```

Projects in `FindAndDrive.sln`:

| Project | Role |
|---|---|
| `FindAndDrive.API` | Host, controllers, JWT, Swagger, exception middleware, startup migration and seed |
| `FindAndDrive.Domain` | Services, entities, DTOs, settings types, API-key helper |
| `FindAndDrive.Persistence` | `DefaultContext`, repositories, EF configurations, migrations, role seed |
| `FindAndDrive.Gateway.Experian` | Experian HTTP client |
| `FindAndDrive.Gateway.TransUnion` | TransUnion SOAP client |
| `FindAndDrive.Tests` | xUnit unit and integration tests |
| `FindAndDrive.Tests.Performance` | NBomber console harness |

## Major components

- **Clients and API keys.** A client owns API keys. Each key has one role. Roles carry a permission list: `Client`, `ApiKey`, `Role`, `Financing`.
- **Applicants.** Created on pre-qualification, updated on prediction, read back by the owning client.
- **Prediction.** `FinancingService.MakePrediction` maps Experian income and expenses plus a TransUnion score onto `ChancesOfApproval`: `Low`, `Medium`, `High`, or `Undetermined`.
- **Startup data.** Every process start applies EF migrations, upserts two roles, and creates a client named `Admin` with a `SystemAdmin` key if that name is absent. The new secret is written to stdout once.

## Milestones visible in history

Git history on this remote has four commits. Migration timestamps are earlier than the first import, so day-to-day history before 2023-11-15 is not in this repository.

| When | What | Evidence |
|---|---|---|
| 2023-02-06 to 2023-05-25 | EF migrations from `InitialMigration` through `Kappa` | `FindAndDrive.Persistence/Migrations` |
| 2023-11-15 | `Initial commit`, then `First commit` (the application tree) | `git log` |
| 2023-11-15 | `bitbucket-pipelines.yml` added | commit `d8d781d` |
| 2023-12-12 | README edited | commit `a2414dd`, current `master` |

No commit after 2023-12-12 is on `master`.

## Implementation plan

No roadmap, issue list, or TODO file describes future work. Inline comments that look like unfinished intent:

- `Startup` JWT options say to set `SaveToken`, `ValidateIssuer`, and `ValidateAudience` to true "when going to prod". They are currently false. `RequireHttpsMetadata` is false with no matching comment.
- `ApplicantRepository.Update` has a comment "ApplicantId doesnt exist error (TODO)" at the call site in `FinancingService.Analytics`. A missing applicant is not turned into a dedicated error.
- `ApplicantCredit.RiskBankDescription` is stored as `""`. A comment says "Need to determine where these values are coming from".
- `EstimatedApprovalAmount` has a comment "Is this monthly or yearly?".

Provenance: **Inferred** that these comments mark open questions. They are not a plan.

## Known dependencies

| Dependency | Where | Notes |
|---|---|---|
| .NET 6 | every `.csproj` `TargetFramework` | Pipeline image is `mcr.microsoft.com/dotnet/sdk:7.0` |
| ASP.NET Core, JWT bearer 6.0.13, Swashbuckle 6.2.3, EF Core SQL Server 6.0.13, Newtonsoft.Json 13.0.2 | `FindAndDrive.API.csproj` | |
| SQL Server | `UseSqlServer` | Connection string key `ConnectionStrings:DefaultConnection` is empty in both appsettings files |
| Experian / Compuscan affordability | `ExperianGateway` | URL is hardcoded, not read from `ExperianSettings.BaseUrl` |
| TransUnion quick credit and fraud | `TransUnionGateway` | URL is hardcoded, not read from `TransUnionSettings.BaseUrl` |
| SonarQube | `bitbucket-pipelines.yml` | Token and host come from pipeline variables. Project key is `overdrive_findndrive_api_net_AYvUygomT-jCdK_QYjRL` |
| NBomber 4.1.0 | performance project | Not run by the pipeline |

## Current project status

**Implemented** and present on `master`. **Unknown / Requires Confirmation:** whether any environment is deployed, who operates it, and whether the Compuscan UAT host and the TransUnion autotest host are still the intended targets.

The pipeline builds and runs SonarQube. It does not run tests and does not deploy.

`README.md` says "Duplicate Repo on Github configured with Github Actions". This Bitbucket tree has no GitHub Actions workflow. The GitHub URL is **Unknown / Requires Confirmation**.

The onboarding issue listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Those files are not in the committed tree at `a2414dd`.

## Human confirmation

- Product owner, live environments, and whether this API is still in use.
- Whether `findndrive_webportal` or `findndrive_pwa` is a caller.
- Which pre-qualification formula is approved. The service multiplies by `48.4`. The unit test `FinancingCalc_TotalAmount` expects the result without that factor. See `business-rules.md`.
- Which prediction outcomes are approved. Several unit tests do not match `MakePrediction`. See `business-rules.md`.
- Credentials are committed in `FindAndDrive.API/appsettings.json` and in `FindAndDrive.Tests.Performance/Program.cs`. Values are omitted here. They need a decision on rotation and removal from git.
- `database/FindAndDrive.bak` was not inspected. Confirm whether it contains personal data and whether it should remain in git.