Declare surface
The entity CRUD mask and custom methods state which capabilities may exist.
Engineering reference · 05
The framework owns the rails.
The developer owns the result.
CodingWithEase standardizes infrastructure, generates security boundaries, and detects known unsafe shapes. It does not invent correct business rules, prove that a custom query is fast, or remove the need for engineering review. Enterprise quality comes from making that responsibility explicit and verifiable.
Entities/ Commands/ Queries/
Services/ Security/ Components/
Engineer + agent author business intent
Framework/
cwe-gen only · never hand-edit
Platform/
Framework-managed · documented extension points only
Tests/
Engineer proves the application behavior00 · RESPONSIBILITY CONTRACT
Automation removes repetition—not accountability.
The framework can make safe mechanics the default and unsafe shortcuts visible. Only the application team knows whether the business decision, data scope, response time, and operational outcome are correct.
| Concern | Framework responsibility | Developer responsibility | Required evidence |
|---|---|---|---|
| Business rules | Provides entities, commands, validation hooks, transactions, audit, and test structure. | Defines invariants, state transitions, approvals, ownership, exceptional paths, and domain tests. | Scenario tests agreed with process owners. |
| Authorization | Generates keys, catalogs, authenticated endpoints, handler checks, permission-aware operations, and fail-closed client gates. | Chooses public capabilities, role grants, row scopes, ownership rules, and tests ordinary users. | Catalog dump, grant tests, scoped-query tests, and denied hostile requests. |
| Query correctness | Supplies typed query options, projection allow-lists, safe filtering, deterministic paging, and diagnostics. | Writes the actual predicate, joins, projection, ordering semantics, and complete data scope. | Known datasets, edge cases, and result assertions. |
| Query performance | Warns about unbounded collections, supports paging and caching, and exposes unsafe cache declarations. | Measures query plans and payloads, selects indexes, avoids N+1 work, chooses paging, and validates production-scale data. | Plans, timings, row counts, payload size, and load tests. |
| Caching | Partitions by caller and permission set, invalidates declared tags, and safely disables undeclared custom-query caching. | Declares every data dependency or opts out when time, external systems, or opaque services affect the result. | Freshness tests before and after relevant writes and permission changes. |
| Custom code and dependencies | Protects framework-owned paths and detects several boundary violations. | Reviews custom integrations, secrets, package risk, error handling, deployment, and operational monitoring. | Threat review, dependency scanning, configuration review, and release smoke. |
Honest boundary
A framework cannot guarantee that an application has zero vulnerabilities. CodingWithEase reduces vulnerability classes by centralizing and protecting security infrastructure; the application still requires correct policy decisions, custom-code review, dependency maintenance, configuration, and adversarial testing.
01 · SECURITY BY CONSTRUCTION
Agents declare capability. They do not rewrite the checkpoints.
The high-risk mechanics live in generated or framework-managed zones. The agent works through entities, commands, queries, permissions, scopes, and components; regeneration recreates the same enforcement chain from that declared intent.
Generate contract
Keys, DTOs, operations, endpoints, handlers, and AI descriptors are emitted together.
Protect rails
Framework/ is generator-owned. Infrastructure changes belong in the framework, not an app-agent patch.
Enforce server
Every protected handler evaluates the current caller independently of browser state.
Probe failure
Tests and analyzers deliberately attempt unsafe paths and require the build or request to fail.
Read-only / append-only declarationSTRUCTURAL SECURITY
// Read-only: no Create, Update, or Delete artifacts exist.
[CxEntity(Crud = CxCrud.View)]
public partial class ReleasedSpecification { ... }
// Append-only: Update and Delete are absent everywhere.
[CxEntity(Crud = CxCrud.View | CxCrud.Create)]
public partial class AuditObservation { ... }Absence is stronger than a hidden button
A verb outside the declared mask generates no command, endpoint, operations method, permission key, catalog entry, or AI tool. A read-only contract cannot bind to an editable grid: the mistake becomes a compile error.
- One declaration controls the entire generated surface.
- The browser cannot call an endpoint that was never emitted.
- The runtime assistant cannot discover a tool that does not exist.
- Regeneration removes orphaned artifacts after model changes.
02 · MEASURED FAILURE CASES
Guardrails exist because plausible code failed in real applications.
These examples are recorded in the current framework documentation and release probes. They show both the benefit of automation and the point where human judgment remains necessary.
3,378 rows for a 25-row grid
A real query transferred 740 KB; only 0.7% of the payload was useful on first paint. The analyzer now warns on bare collection queries, but the developer must choose paging or justify a domain bound.
4 of 12 queries had incomplete tags
Those queries read an entity not represented by their cache tags. Custom queries now default to no cache until the author declares dependencies or explicitly chooses zero duration.
A successful write skipped every rail
Synchronous SaveChanges() bypassed validation, authorization, audit, cache reset, files, and events. It is now a build error, and release verification mutates a real call to prove the diagnostic fires.
Generated CRUD once exceeded the domain
An immutable document version received Update and Delete. CRUD masks now remove forbidden verbs across server, client, permission, and AI surfaces in lockstep.
Green builds are not enough
The effective permission catalog can be dumped after generation so the constant, grant, and handler key can be compared. Ordinary-persona tests prove denial where Administrator would hide a defect.
Rules run against a real data context
The starter includes role composition, permission gate, scope policy, and scoped-query tests using the real permission-set implementation over in-memory SQLite.
Evidence level
These are framework-level findings and safeguards, grounded in revision d9f47f85. They do not automatically certify a particular customer application; each app must publish its own build, security, correctness, and performance results.
03 · QUERY EXAMPLE
The analyzer can identify risk. Only the developer can choose the right answer.
“Return a list” does not reveal whether the domain contains five rows or five million. Silently clamping would turn a performance defect into missing data, so CodingWithEase asks the author to state the intended shape.
Unbounded collectionCWE0111 WARNING
[CxQuery]
public static Task<List<ShiftRow>> GetProgramShifts(
ApplicationDbContext db,
Guid workProgramId)
// How many shifts can this return?Growing data setDEVELOPER DECISION: PAGE IT
[CxQuery]
public static Task<CxPagedResult<ShiftRow>>
GetProgramShifts(
ApplicationDbContext db,
Guid workProgramId,
CxQueryOptions options)
// Measure the plan and index for real data.Small by business definitionDEVELOPER DECISION: STATE THE BOUND
[CxQuery]
[CxBoundedResult(50,
"One plant's job titles; bounded by the org chart.")]
public static Task<List<JobTitle>>
GetJobTitles(ApplicationDbContext db)
// Runtime guard logs if the claim becomes false.Performance remains application engineering
The framework provides paging, safe filters, deterministic sorting, cache infrastructure, and warnings. The developer still reviews generated SQL, projections, indexes, cardinality, payload size, N+1 behavior, concurrency, and response time using production-shaped data.
- A warning is a review trigger, not a performance certificate.
- A bounded-result attribute is a domain claim, not a database limit.
- Cache can hide latency while preserving a poor query.
- Performance budgets belong to each application and workflow.
04 · CACHE EXAMPLE
Safe defaults cannot infer opaque business dependencies.
Caller and permission partitioning prevent cross-user reuse. Write-time tags keep declared data fresh. A query that reads through a service, external API, clock, or another entity still needs an explicit developer decision.
Database dependenciesDECLARE INVALIDATION
[CxQuery(Tags = new[] {
nameof(Department),
nameof(Employee)
})]
public static Task<HeadcountRow>
GetHeadcount(ApplicationDbContext db, ...)External or time-sensitive resultOPT OUT
[CxQuery(CacheSeconds = 0)]
public static Task<MachineState>
GetLiveMachineState(
IMachineGateway gateway,
CancellationToken ct)
// A database write cannot invalidate this value.05 · BUSINESS-RULE EXAMPLE
The framework secures the command. The developer defines what “allowed” means.
Generated infrastructure can authenticate, authorize, validate the request shape, open the transaction, stamp audit fields, publish events, and normalize errors. It cannot decide the factory’s approval policy.
Business meaning stays authored
This command’s permission says who may attempt approval. The method body states when approval is valid for the business.
- Correct lifecycle states come from domain experts.
- Separation-of-duties rules are application policy.
- Cut-off times and tolerance limits are business decisions.
- Tests must cover accepted and rejected operational scenarios.
ApproveHours.cs · conceptualDEVELOPER-OWNED SEMANTICS
[CxCommand(Permission = TimePermissions.Approve)]
public static async Task<CxResult> ApproveHours(
ApplicationDbContext db,
ApproveHours request,
CancellationToken ct)
{
var entry = await db.TimeEntries.FindAsync(...);
if (entry.Status != TimeStatus.Submitted)
return CxResult.Failure("Only submitted time can be approved.");
if (entry.EmployeeId == request.ApproverEmployeeId)
return CxResult.Failure("Self-approval is not allowed.");
entry.Approve(request.ApproverEmployeeId);
await db.SaveChangesAsync(ct);
return CxResult.Success();
}06 · APPLICATION PROOF
Every delivered app must earn its own evidence.
A framework release can prove its rails. An application release must additionally prove its domain behavior, access model, data scale, integrations, configuration, and operating environment.
Regenerate and compare
Run cwe-gen twice and require a clean generated tree with no orphaned artifacts.
Build and analyze
Treat security diagnostics as errors and run CheckComposition in addition to compilation.
Test business scenarios
Verify invariants, transitions, exceptional paths, and rejected operations using realistic data.
Test ordinary personas
Inspect the effective permission catalog and prove API, page, row-scope, and AI-tool denial outside Administrator.
Measure queries
Capture SQL plans, indexes, row counts, payloads, timings, cache behavior, and concurrent load against production-shaped volume.
Release smoke
Validate configuration, secrets, health, authentication, critical routes, integrations, logging, and rollback in the target environment.
Definition of done
“Built with CodingWithEase” describes the delivery system. It is not a substitute for an application-specific acceptance record signed by engineering and the process owner.
Start with the complete path
Open Entity → GridView