Tech Stack & Key Libraries

This section catalogs every technology choice in Courier, organized by layer. Each entry includes the specific package, its version constraint, what it's used for, and which section(s) it supports.

3.1 Runtime & Frameworks

3.2 Job Scheduling & Workflow

Quartz.NET is used solely as the scheduling trigger layer. It fires at the scheduled time and delegates to Courier's Job Engine for actual execution. Quartz tables (QRTZ_*) are managed via DbUp (Section 13.3.6).

3.3 File Transfer

Both libraries are wrapped behind the ITransferClient abstraction (Section 6.2). Application code never references SSH.NET or FluentFTP types directly outside the protocol adapter implementations.

3.4 Cryptography & Key Management

FIPS note: When FIPS mode is enabled, internal cryptographic operations use .NET's System.Security.Cryptography APIs (backed by CNG on Windows, OpenSSL on Linux) restricted to FIPS-approved algorithms. Whether the underlying module runs in its FIPS-validated mode depends on OS/container configuration (Section 12.10). BouncyCastle (standard edition) is restricted to approved algorithms but is not a FIPS-validated module; a migration path to bcpg-fips-csharp exists if validated PGP operations are required.

3.5 Compression

All compression operations use streaming APIs and never load full files into memory. The ICompressionProvider abstraction (Section 8.1) wraps each library.

3.6 Authentication & Authorization

Roles (Admin, Operator, Viewer) are defined as Entra ID App Roles and enforced via [Authorize(Roles = "...")] attributes (Section 12.2).

3.7 API & Validation

3.8 Database & Migrations

Migrations are raw SQL scripts managed via DbUp. EF Core is not used for migrations — it is used only for querying and change tracking against the schema that DbUp creates.

3.9 JSON Serialization

Configuration:

builder.Services.ConfigureHttpJsonOptions(options =>
{
    options.SerializerOptions.PropertyNamingPolicy = JsonNamingPolicy.CamelCase;
    options.SerializerOptions.DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull;
    options.SerializerOptions.Converters.Add(new JsonStringEnumConverter(JsonNamingPolicy.SnakeCaseLower));
});

Enums are serialized as snake_case strings ("retry_step", "sftp") rather than integers, for API readability. JSONB columns in PostgreSQL use the same serializer settings via EF Core's HasConversion or Npgsql's ConfigureJsonOptions.

3.10 Logging & Observability

Configuration:

Log.Logger = new LoggerConfiguration()
    .MinimumLevel.Information()
    .MinimumLevel.Override("Microsoft", LogEventLevel.Warning)
    .MinimumLevel.Override("System", LogEventLevel.Warning)
    .MinimumLevel.Override("Quartz", LogEventLevel.Warning)
    .Enrich.FromLogContext()
    .Enrich.WithMachineName()
    .Enrich.WithThreadId()
    .WriteTo.Console(outputTemplate:
        "[{Timestamp:HH:mm:ss} {Level:u3}] {SourceContext} {Message:lj}{NewLine}{Exception}")
    .WriteTo.Conditional(
        _ => builder.Environment.IsDevelopment(),
        config => config.Seq("http://localhost:5341"))
    .WriteTo.Conditional(
        _ => !builder.Environment.IsDevelopment(),
        config => config.ApplicationInsights(
            builder.Configuration["ApplicationInsights:ConnectionString"],
            TelemetryConverter.Traces))
    .CreateLogger();

Sensitive data redaction: Serilog destructuring policies are configured to redact passwords, passphrases, private key material, and bearer tokens from all log output (Section 12.8).

3.11 Testing

Test project structure:

Courier.Tests.Unit/          Unit tests — pure logic, all dependencies mocked
Courier.Tests.Integration/   Integration tests — real database (Testcontainers), real HTTP
Courier.Tests.Architecture/  Architecture tests — enforce dependency rules, naming conventions

3.12 Infrastructure & Deployment

3.13 Package Version Policy

Version constraints:

• .NET 10 and ASP.NET Core 10: Pinned to the major version. Minor/patch updates applied via regular dependency updates.
• EF Core: Matches the .NET major version (EF Core 10 with .NET 10).
• All NuGet packages: Use the latest stable release at project initialization. Pinned to major version with ~> range to allow patch updates. Breaking changes require an explicit upgrade decision.
• PostgreSQL: Minimum version 16 for native partitioning performance improvements and JSONB enhancements.

Dependency audit: dotnet list package --vulnerable is run as part of the CI pipeline. Packages with known CVEs are flagged as build warnings (high severity) or build failures (critical severity).

3.14 Library Decision Summary

┌──────────────────┬──────────────────────────────────────────────┐
│ Concern           │ Decision                                     │
├──────────────────┼──────────────────────────────────────────────┤
│ Runtime           │ .NET 10                                      │
│ Frontend          │ Next.js (React)                              │
│ Database          │ PostgreSQL 16+                               │
│ ORM               │ EF Core 10 (query only, not migrations)     │
│ Migrations        │ DbUp (raw SQL scripts)                      │
│ Scheduling        │ Quartz.NET (AdoJobStore)                    │
│ SFTP              │ SSH.NET                                      │
│ FTP/FTPS          │ FluentFTP                                    │
│ PGP               │ BouncyCastle (FIPS-approved algorithms only) │
│ Encryption        │ .NET System.Security.Cryptography (CNG/OSSL) │
│ Key management    │ Azure Key Vault                              │
│ Compression       │ SharpZipLib + SharpCompress + 7z CLI         │
│ Auth              │ Entra ID via Microsoft.Identity.Web          │
│ API docs          │ Swashbuckle (OpenAPI/Swagger)                │
│ Validation        │ FluentValidation                             │
│ JSON (primary)    │ System.Text.Json                             │
│ JSON (Quartz)     │ Newtonsoft.Json                              │
│ Logging           │ Serilog → Seq (dev) / App Insights (prod)   │
│ Testing           │ xUnit + Shouldly + NSubstitute               │
│ Orchestration     │ .NET Aspire (dev), Docker + K8s (prod)      │
└──────────────────┴──────────────────────────────────────────────┘

---