PortfolioVincent Chepkwony

using System.ComponentModel.DataAnnotations;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.DataProtection;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;

namespace Agency.Services.Applicants;

public sealed record CreateApplicantRequest(
    [property: Required, StringLength(100)] string FullName,
    [property: Required, EmailAddress] string Email,
    [property: Required, RegularExpression(@"^\d{3}-\d{2}-\d{4}$",
        ErrorMessage = "Enter the SSN as 123-45-6789.")] string Ssn);

public sealed record ApplicantDto(int Id, string FullName, string Email, string SsnMasked)
{
    public static ApplicantDto From(Applicant a) =>
        new(a.Id, a.FullName, a.Email, $"***-**-{a.SsnLast4}");
}

[ApiController]
[Route("api/applicants")]
[Authorize(Policy = "CaseWorker")]
public sealed class ApplicantsController(
    AppDbContext db,
    IDataProtectionProvider protection,
    ILogger<ApplicantsController> log) : ControllerBase
{
    // Purpose string isolates this key ring; rotate by bumping the version.
    private readonly IDataProtector _pii = protection.CreateProtector("Applicants.Pii.v1");

    [HttpPost]
    [ProducesResponseType<ApplicantDto>(StatusCodes.Status201Created)]
    [ProducesResponseType<ValidationProblemDetails>(StatusCodes.Status400BadRequest)]
    public async Task<IActionResult> Create(CreateApplicantRequest req, CancellationToken ct)
    {
        // [ApiController] has already returned 400 + ValidationProblemDetails
        // if any annotation above failed, so the request is valid here.
        if (await db.Applicants.AnyAsync(a => a.Email == req.Email.ToLowerInvariant(), ct))
        {
            ModelState.AddModelError(nameof(req.Email), "An applicant with this email already exists.");
            return ValidationProblem(ModelState);
        }

        var entity = new Applicant
        {
            FullName  = req.FullName.Trim(),
            Email     = req.Email.Trim().ToLowerInvariant(),
            SsnCipher = _pii.Protect(req.Ssn),
            SsnLast4  = req.Ssn[^4..]
        };

        db.Applicants.Add(entity);
        await db.SaveChangesAsync(ct);

        log.LogInformation("Applicant {ApplicantId} created", entity.Id); // ID only, no PII
        return CreatedAtAction(nameof(GetById), new { id = entity.Id }, ApplicantDto.From(entity));
    }

    [HttpGet("{id:int}")]
    [ProducesResponseType<ApplicantDto>(StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    public async Task<ActionResult<ApplicantDto>> GetById(int id, CancellationToken ct)
    {
        var applicant = await db.Applicants.AsNoTracking()
            .SingleOrDefaultAsync(a => a.Id == id, ct);

        return applicant is null ? NotFound() : ApplicantDto.From(applicant);
    }
}

using System.ComponentModel;
using Microsoft.EntityFrameworkCore;
using ModelContextProtocol;
using ModelContextProtocol.Server;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication().AddJwtBearer();            // Entra ID access tokens
builder.Services.AddAuthorization(o =>
    o.AddPolicy("EnrollmentReader", p => p.RequireRole("Enrollment.Read")));

builder.Services.AddDbContext<EnrollmentDb>(o =>
    o.UseSqlServer(builder.Configuration.GetConnectionString("Enrollment")));

builder.Services
    .AddMcpServer()
    .WithHttpTransport()
    .WithTools<EnrollmentTools>();

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapMcp("/mcp").RequireAuthorization("EnrollmentReader");
app.Run();

/// <summary>Tools an AI agent may call. Each is narrow, validated and read-only.</summary>
[McpServerToolType]
public sealed class EnrollmentTools(EnrollmentDb db, ILogger<EnrollmentTools> log)
{
    [McpServerTool(ReadOnly = true)]
    [Description("Returns open seats for one school and grade in a given school year.")]
    public async Task<SeatAvailability> GetSeatAvailability(
        [Description("State school ID, for example 0123-4567")] string schoolId,
        [Description("Grade level: 0 for kindergarten, up to 12")] int grade,
        [Description("School year it starts in, for example 2027")] int schoolYear,
        CancellationToken ct)
    {
        if (grade is < 0 or > 12)
            throw new McpException($"Grade {grade} is out of range. Use 0 (kindergarten) to 12.");

        var seats = await db.Seats.AsNoTracking()
            .Where(s => s.SchoolId == schoolId && s.Grade == grade && s.SchoolYear == schoolYear)
            .Select(s => new SeatAvailability(s.SchoolId, s.Grade, s.Capacity, s.Enrolled, s.Capacity - s.Enrolled))
            .SingleOrDefaultAsync(ct)
            ?? throw new McpException($"No seat plan for school {schoolId}, grade {grade}, {schoolYear}.");

        log.LogInformation("Seat lookup {SchoolId} grade {Grade}", schoolId, grade); // no student data in logs
        return seats;
    }
}

public sealed record SeatAvailability(string SchoolId, int Grade, int Capacity, int Enrolled, int Open);

using System.Text.Encodings.Web;
using Microsoft.AspNetCore.Mvc.Rendering;
using Microsoft.AspNetCore.Mvc.ViewFeatures;
using Microsoft.AspNetCore.Razor.TagHelpers;

namespace Agency.Web.TagHelpers;

/// <summary>
/// Renders a design-system text field: label, optional hint, inline error, input.
/// Wires for/id, aria-describedby and aria-invalid so WCAG 1.3.1, 3.3.1 and
/// 4.1.2 are met without each developer remembering to do it.
/// </summary>
[HtmlTargetElement("a11y-field", Attributes = "asp-for", TagStructure = TagStructure.WithoutEndTag)]
public sealed class AccessibleFieldTagHelper(IHtmlGenerator generator, HtmlEncoder encoder) : TagHelper
{
    [HtmlAttributeName("asp-for")] public ModelExpression For { get; set; } = default!;
    [HtmlAttributeName("hint")]    public string? Hint { get; set; }
    [HtmlAttributeName("type")]    public string InputType { get; set; } = "text";
    [HtmlAttributeName("autocomplete")] public string? AutoComplete { get; set; }

    [ViewContext, HtmlAttributeNotBound]
    public ViewContext ViewContext { get; set; } = default!;

    public override void Process(TagHelperContext context, TagHelperOutput output)
    {
        var name    = For.Name;
        var id      = TagBuilder.CreateSanitizedId(name, "_");
        var hintId  = $"{id}-hint";
        var errorId = $"{id}-error";

        var errors   = ViewContext.ViewData.ModelState[name]?.Errors;
        var hasError = errors is { Count: > 0 };

        var describedBy = string.Join(' ',
            new[] { Hint is null ? null : hintId, hasError ? errorId : null }.OfType<string>());

        var input = generator.GenerateTextBox(ViewContext, For.ModelExplorer, name,
            For.Model, format: null, htmlAttributes: new { @class = "ds-input" });

        input.Attributes["id"]   = id;
        input.Attributes["type"] = InputType;
        if (describedBy.Length > 0) input.Attributes["aria-describedby"] = describedBy;
        if (hasError)               input.Attributes["aria-invalid"] = "true";
        if (For.Metadata.IsRequired) input.Attributes["required"] = "required";
        if (AutoComplete is not null) input.Attributes["autocomplete"] = AutoComplete;

        output.TagName = "div";
        output.TagMode = TagMode.StartTagAndEndTag;
        output.Attributes.SetAttribute("class", hasError ? "ds-field ds-field--error" : "ds-field");

        var label = encoder.Encode(For.Metadata.GetDisplayName());
        output.Content.AppendHtml($"<label class=\"ds-label\" for=\"{id}\">{label}</label>");

        if (Hint is not null)
            output.Content.AppendHtml($"<p class=\"ds-hint\" id=\"{hintId}\">{encoder.Encode(Hint)}</p>");

        if (hasError)
            output.Content.AppendHtml(
                $"<p class=\"ds-error\" id=\"{errorId}\">" +
                $"<span class=\"visually-hidden\">Error: </span>{encoder.Encode(errors![0].ErrorMessage)}</p>");

        output.Content.AppendHtml(input);
    }
}

@use "sass:color";
@use "sass:map";
@use "sass:math";

// ── Tokens ────────────────────────────────────────────────
$palette: (
  "ink":     #0d1b2a,
  "muted":   #4a5668,
  "surface": #ffffff,
  "canvas":  #f4f6fa,
  "accent":  #1846c7,
  "error":   #b42318,
  "success": #1b6e3a,
  "focus":   #ffbf47,
);

@function c($name) {
  @if not map.has-key($palette, $name) { @error "Unknown color token '#{$name}'."; }
  @return map.get($palette, $name);
}

// ── WCAG 2.x relative luminance & contrast ratio ─────────
@function -linear($channel) {
  $s: math.div($channel, 255);
  @if $s <= 0.04045 { @return math.div($s, 12.92); }
  @return math.pow(math.div($s + 0.055, 1.055), 2.4);
}

@function luminance($color) {
  $r: -linear(color.channel($color, "red",   $space: rgb));
  $g: -linear(color.channel($color, "green", $space: rgb));
  $b: -linear(color.channel($color, "blue",  $space: rgb));
  @return 0.2126 * $r + 0.7152 * $g + 0.0722 * $b;
}

@function contrast($a, $b) {
  $l1: luminance($a);
  $l2: luminance($b);
  @return math.div(math.max($l1, $l2) + 0.05, math.min($l1, $l2) + 0.05);
}

/// Sets text + background and fails the build below the WCAG threshold.
/// @param $min 4.5 for body text (1.4.3), 3 for large text and UI parts (1.4.11)
@mixin text-on($fg, $bg, $min: 4.5) {
  $ratio: contrast(c($fg), c($bg));
  @if $ratio < $min {
    @error "#{$fg} on #{$bg} is #{math.div(math.round($ratio * 100), 100)}:1, WCAG needs #{$min}:1.";
  }
  color: c($fg);
  background-color: c($bg);
}

// ── Shared a11y mixins ───────────────────────────────────
@mixin focus-ring {
  outline: 3px solid transparent;            // still visible in Windows High Contrast
  box-shadow: 0 0 0 3px c("focus"), 0 0 0 6px c("ink");
}

@mixin visually-hidden {
  position: absolute !important;
  width: 1px; height: 1px; margin: -1px; padding: 0;
  overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0;
}

@mixin motion-safe {
  @media (prefers-reduced-motion: no-preference) { @content; }
}

// ── Component usage ──────────────────────────────────────
.ds-button {
  @include text-on("surface", "accent");     // 7.67:1 ✓
  min-height: 44px;                          // target size
  padding: 0.6rem 1.1rem;
  border: 2px solid c("accent");
  border-radius: 6px;
  @include motion-safe { transition: transform 150ms ease; }
  &:focus-visible { @include focus-ring; }
}

.ds-error { @include text-on("error", "surface"); }   // 6.57:1 ✓
.ds-hint  { @include text-on("muted", "canvas"); }    // 6.88:1 ✓
.visually-hidden { @include visually-hidden; }

/**
 * Accessible sortable table.
 *  - Header buttons are real <button>s: focusable, Enter/Space for free.
 *  - aria-sort lives on the <th> (only the active column carries it).
 *  - A polite live region announces the result; focus stays on the button.
 */
export function sortableTable(table, { rows, render, status }) {
  const headers = [...table.querySelectorAll('thead th[data-key]')];
  let state = { key: null, dir: 'ascending' };

  const collator = new Intl.Collator(undefined, { numeric: true, sensitivity: 'base' });
  const compare = (a, b, key) =>
    typeof a[key] === 'number' ? a[key] - b[key] : collator.compare(a[key], b[key]);

  function sortBy(key) {
    state = {
      key,
      dir: state.key === key && state.dir === 'ascending' ? 'descending' : 'ascending',
    };
    const sign = state.dir === 'ascending' ? 1 : -1;
    const sorted = [...rows()].sort((a, b) => sign * compare(a, b, key));

    headers.forEach(th => {
      if (th.dataset.key === key) th.setAttribute('aria-sort', state.dir);
      else th.removeAttribute('aria-sort');
    });

    render(sorted);
    const label = headers.find(th => th.dataset.key === key).textContent.trim();
    status.textContent = `Sorted by ${label}, ${state.dir}. ${sorted.length} rows.`;
  }

  headers.forEach(th =>
    th.querySelector('button').addEventListener('click', () => sortBy(th.dataset.key)));

  return { sortBy, get state() { return { ...state }; } };
}

// Status cells pair text with color so meaning survives without color (WCAG 1.4.1).
export const statusCell = s =>
  `<span class="pill pill--${s.toLowerCase()}">${s}</span>`;

CREATE OR ALTER PROCEDURE dbo.usp_ServiceRequest_Search
    @Status        varchar(20)   = NULL,   -- NULL = any status
    @CountyId      int           = NULL,
    @SubmittedFrom date          = NULL,
    @AfterId       int           = 0,      -- keyset cursor: last Id from previous page
    @PageSize      int           = 25
AS
BEGIN
    SET NOCOUNT ON;
    SET XACT_ABORT ON;

    IF @PageSize NOT BETWEEN 1 AND 100
        THROW 50001, N'PageSize must be between 1 and 100.', 1;

    SELECT TOP (@PageSize)
           sr.Id,
           sr.CaseNumber,
           p.ProgramName,
           c.CountyName,
           sr.Status,
           sr.SubmittedOn,
           DATEDIFF(day, sr.SubmittedOn, SYSUTCDATETIME()) AS DaysOpen
    FROM   dbo.ServiceRequest AS sr
    JOIN   dbo.Program        AS p ON p.Id = sr.ProgramId
    JOIN   dbo.County         AS c ON c.Id = sr.CountyId
    WHERE  sr.Id > @AfterId
      AND (@Status        IS NULL OR sr.Status      = @Status)
      AND (@CountyId      IS NULL OR sr.CountyId    = @CountyId)
      AND (@SubmittedFrom IS NULL OR sr.SubmittedOn >= @SubmittedFrom)
    ORDER BY sr.Id
    OPTION (RECOMPILE);   -- optional filters: plan built for the actual values
END;
GO

-- Supporting index: seek on Id, cover the filtered columns.
CREATE INDEX IX_ServiceRequest_Status_County
    ON dbo.ServiceRequest (Status, CountyId)
    INCLUDE (ProgramId, SubmittedOn, CaseNumber);

trigger:
  branches: { include: [ main, release/* ] }

pool:
  vmImage: ubuntu-latest

variables:
  buildConfiguration: Release
  dotnetVersion: 8.0.x

stages:
- stage: Build
  jobs:
  - job: BuildAndTest
    steps:
    - task: UseDotNet@2
      inputs: { packageType: sdk, version: $(dotnetVersion) }

    - script: dotnet restore --locked-mode
      displayName: Restore (locked)

    - script: dotnet build -c $(buildConfiguration) --no-restore -warnaserror
      displayName: Build

    - script: dotnet test -c $(buildConfiguration) --no-build --collect "XPlat Code Coverage" --logger trx
      displayName: Unit tests

    - task: PublishTestResults@2
      condition: succeededOrFailed()
      inputs: { testResultsFormat: VSTest, testResultsFiles: '**/*.trx' }

    - task: NodeTool@0
      inputs: { versionSpec: '20.x' }

    - script: |
        npm ci
        npx sass styles/main.scss wwwroot/css/main.css --style=compressed --no-source-map
      displayName: Compile Sass (contrast checks run here)

    - script: dotnet publish src/Agency.Web -c $(buildConfiguration) -o $(Build.ArtifactStagingDirectory)/web
      displayName: Publish web app

- stage: Accessibility
  dependsOn: Build
  jobs:
  - job: AxeScan
    steps:
    - script: |
        dotnet run --project src/Agency.Web -c Release --urls http://localhost:5080 &
        npx wait-on http://localhost:5080/health
        npx @axe-core/cli http://localhost:5080/ http://localhost:5080/apply \
          --tags wcag2a,wcag2aa,wcag21a,wcag21aa --exit
      displayName: axe-core WCAG 2.1 AA gate

- stage: Deploy
  dependsOn: Accessibility
  condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
  jobs:
  - deployment: Staging
    environment: agency-web-staging      # approvals and checks live on the environment
    strategy:
      runOnce:
        deploy:
          steps:
          - task: AzureWebApp@1
            inputs:
              azureSubscription: agency-svc-connection
              appName: agency-web-staging
              package: $(Pipeline.Workspace)/**/web