A production-shaped, end-to-end online widget store built as a portfolio showcase: .NET 10 (Minimal API, Dapper, PostgreSQL) + React/TypeScript SPA, with real auth, 2FA, token rotation, catalog/inventory, cart, per-state tax, checkout with pluggable payments (sync + async/webhook), transactional email, and an order lifecycle.
- Overview — what it is, features, tech stack, repo layout.
- Architecture — onion/clean layering, request flow, security model, seams.
- Setup & run — one-command Docker, hybrid dev, URLs, demo accounts.
- Configuration, secrets, email & 2FA — what keys go where/how/why; email + Google setup; how to set up 2FA.
- Payments, tax & testing credit cards — how the total is built (shipping + per-state sales tax, worked examples, the rate table), Mock + Stripe test mode, async/webhooks, testing without charging a card, going live.
- Database & schema — why PostgreSQL, migrations, tables and relationships.
- Testing & smoke test — four layers (backend unit, PostgreSQL integration, frontend component, end-to-end smoke), the coverage floors CI enforces, and how to run each locally.
- Bugs & lessons learned — 46 real bugs, how each was found, fixed, and prevented — from CI-as-compiler through deployment, test coverage, and a security and operability review.
- Runbook — testing & going live — step-by-step to test email, payments, and Google locally, and exactly what to change to go live.
- Deploying to Azure on free tiers — the whole stack for $0: F1 App Service, Static Web Apps, Key Vault with a managed identity, and Postgres on Neon.
- Project README — quick start + the documentation hub.
- Security policy — what's never committed and how it's enforced.
- Local development notes — deeper dev-workflow detail.
- Web app README — the React/TypeScript SPA.
- Architecture ADRs — decision records behind the design.