System Overview - SAI APP Demos

Architecture and domain

frontend/: React 18 + Vite + Tailwind CSS single-page application.
backend/: ASP.NET Core Web API (.NET 8) with JWT authentication and MongoDB repositories.
database/: MongoDB initialization and seed support for local dockerized environments.
automation/: quality tooling, including applied-ai-aura functional automation.

Module catalog

Module	Purpose	Tech
`frontend-public`	Public web flows and privacy/terms informational pages	React, Router, i18next
`frontend-admin`	JWT-protected administration console	React, protected routes
`backend-api`	REST API for auth and business operations	ASP.NET Core, JWT, MongoDB
`automation-aura`	Functional automation scenarios and reporting	TypeScript, Cucumber

API / interface inventory (key endpoints)

Method	Endpoint	Description
POST	`/api/auth/login`	Admin/user login, returns JWT.
POST	`/api/creditrequests`	Public credit request creation.
GET/PATCH	`/api/creditrequests/{id}`	Admin read and status transition (approve/reject).
GET/POST/PUT/DELETE	`/api/credittypes`	Public read, admin CRUD of the credit product catalog.
GET/POST/PUT/DELETE	`/api/services`	Public read, admin CRUD of marketing service cards.
CRUD	`/api/users`	Admin-only user management, including password changes.
CRUD	`/api/contactmessages`	Public intake, admin triage/response workflow.
GET	`/api/dashboard/*`	Aggregated KPIs and status distribution for the admin dashboard.
GET	`/api/health`, `/api/backup/*`	Health telemetry and downloadable backups.

→ Full endpoint catalog in the backend-api module page

Business rules

Credit request flow: public submission always starts as Pending; admin approves (sets approved amount/term, defaults to requested values) or rejects (with remarks).
Roles: Admin and SuperAdmin guard virtually all administrative endpoints; self-registered accounts default to role User with no elevated access.
Credit type constraints: min/max amount and term bounds drive calculator behavior and are enforced server-side on request creation.
Contact messages follow a sequential lifecycle: New → InProgress → Replied → Closed.
Authentication uses BCrypt password hashing and HMAC-signed JWTs carrying a role claim.

Data model (key entities)

User: Email, PasswordHash, FullName, Role, IsActive, LastLogin.
CreditType: Name, Description, BaseInterestRate, MinAmount, MaxAmount, MinTermMonths, MaxTermMonths, IsActive.
CreditRequest: personal data, financial data, credit details (amount/term/rate/payment), and status metadata (Pending/Approved/Rejected, dates, remarks).
Service: Title, Description, Icon, DisplayOrder, IsActive.
ContactMessage: Name, Email, Subject, Message, Status, response/close audit fields, AdminNotes.

→ Full schema, indexes, and seed strategy in the database page

User journeys

Public credit request: browse services/calculator → simulate payment → complete the credit request wizard (personal → financial → review) → submit → confirmation.
Admin management: login → dashboard KPIs → review/approve/reject credit requests → manage users, credit types, services, and contact messages → generate backups.

Automation structure

AURA feature files: automation/src/features/*.feature; step definitions: automation/src/steps/*.steps.ts plus shared common/preview steps from @sai/applied-ai-aura.
Suite command: npm test (full run), with tag-scoped variants test:smoke / test:regression; JSON report written to reports/cucumber-report.json.
CI tag filter: node "$CUCUMBER_JS" --tags "@preview or @smoke or @new" against the PR preview URL (https://pr-{N}.sai-delivery-online-credit-github.pages.dev); new demo scenarios are tagged @new.

→ Full automation module page

Internationalization (strict)

Supported runtime locales are strictly: en, es, and pt.
Locale files: frontend/src/i18n/locales/en.json, es.json, pt.json (always edited together). Default locale is en (fallbackLng: 'en').
Language switch is provided in the header selector and persisted with tco-user-language.

CI / quality

Workflow: .github/workflows/delivery-pr.yml (paths projects/DELIVERY/**, docs/projects/DELIVERY/**; branches task/* or demo/*). Preview and docs deploys always run; test jobs are gated by detect_changes on the files changed in the PR.

Job	Gate	Report URL pattern
App preview	Always	`https://pr-{N}.sai-delivery-online-credit-github.pages.dev`
Docs preview	Always	`https://pr-{N}-docs.sai-delivery-docs-github.pages.dev`
Frontend unit (Jest)	Frontend test files changed	`https://pr-{N}-frontend.sai-delivery-online-credit-github.pages.dev`
Backend unit (xUnit)	Backend unit test files changed	`https://pr-{N}-backend.sai-delivery-online-credit-github.pages.dev`
Integration & Security	`Integration.cs` changed	Integration: `https://pr-{N}-integration.sai-delivery-online-credit-github.pages.dev`; Security Dashboard (SAST · SCA · DAST): `https://pr-{N}-security.sai-delivery-online-credit-github.pages.dev`
Functional (AURA Cucumber)	`.feature` files changed	`https://pr-{N}-functional.sai-delivery-online-credit-github.pages.dev`
SonarQube (frontend / backend)	Source under `frontend/src/` or `backend/src/` changed	SonarQube server link

Documentation map

docs/index.html: documentation hub.
docs/modules/frontend-public/index.html: public frontend details.
docs/modules/frontend-admin/index.html: admin frontend details.
docs/modules/backend-api/index.html: backend API details.
docs/modules/automation-aura/index.html: functional automation module details.
docs/database.html: MongoDB model, indexes, seed strategy, and local reset workflow.
docs/qa-coverage.html: QA pipeline stages, unit coverage flow, and test report locations.