Quickstart

Prerequisites

.NET 10 SDK (see global.json)
Node.js 20 or later with npm (the repository root is an npm workspace)
Azure CLI, signed in to the publisher tenant (local debugging uses the Azure dev resources); Bicep for deployment
Azure Functions Core Tools and Azurite, for the Worker
An Entra ID test tenant with an app registration for the API

1. Build the solution

dotnet build Signsync.slnx
npm ci
npm run typecheck

Building Signsync.API also regenerates src/Signsync.Api/openapi/Signsync.Api.json.

2. Configure the hosts against Azure dev

Local debugging uses the Azure dev resources (Cosmos DB uw-cosmos-signsync-weu-dev, database signatures), not emulators. The hosts sign in to Cosmos DB with your own Entra identity through DefaultAzureCredential; the account has key authentication disabled, so there is no connection string.

az login --tenant ed5c1757-0275-4beb-a5ea-072c938da4e2

Get Cosmos DB data access on dev (Cosmos DB Built-in Data Contributor). Without this role, every Cosmos DB request from your machine fails with 403. Get your object ID first:
az ad signed-in-user show --query id -o tsv
Add the object ID to developerPrincipalIds in infra/parameters/main.dev.parameters.json, then run infra/deployment-dev.sh (or infra/deployment-dev.ps1). The script runs a what-if first and applies the role assignment with the rest of the dev infrastructure (Developer data access). Infrastructure is deployed only through these scripts, so don’t deploy the Bicep modules on their own with az deployment group create.

Copy the Development settings. They already point at dev; real settings files are gitignored.

cp src/Signsync.Api/appsettings.Development.example.json src/Signsync.Api/appsettings.Development.json
cp src/Signsync.Publisher.Api/appsettings.Development.example.json src/Signsync.Publisher.Api/appsettings.Development.json
cp src/Signsync.Worker/local.settings.example.json src/Signsync.Worker/local.settings.json

Set the dev app registrations (AzureAd:*) in user secrets: see Entra app registrations. Put any client secret or certificate in user secrets, never in a file.

The Worker still uses Azurite for AzureWebJobsStorage (UseDevelopmentStorage=true); start it with azurite before func host start. In VS Code, start azurite and then the Signsync: back ends launch configuration.

Production

Local debugging never targets prod. Prod Cosmos DB (uw-cosmos-signsync-weu) holds customer data, and only the managed identities of the two prod App Service apps have data access to it:

	Dev	Prod
Cosmos DB account	`uw-cosmos-signsync-weu-dev`	`uw-cosmos-signsync-weu`
Resource group	`uw-rg-signsync-weu-dev`	`uw-rg-signsync-weu`
Developer data access	Yes, through `developerPrincipalIds`	No: `main.bicep` ignores `developerPrincipalIds` in prod
Local settings	`appsettings.Development.json`, `local.settings.json`	None; the apps get their settings from App Service

Don’t point local settings or user secrets at the prod account, and don’t run cosmos-access.bicep against it: either would bypass the rule that no developer identity reads prod customer data (README §15.1).
Investigate prod issues from telemetry in Application Insights uw-appi-signsync-weu and Log Analytics uw-log-signsync-weu. Logs contain object IDs only, never tokens or rendered signatures.
To reproduce a prod problem, recreate the data in dev and debug there.

3. Run the hosts

dotnet run --project src/Signsync.Api
dotnet run --project src/Signsync.Publisher.Api

Host	HTTPS	HTTP
Signsync.API	`https://localhost:7101`	`http://localhost:5101`
Publisher API	`https://localhost:7102`	`http://localhost:5102`

Check that both are up:

curl -s https://localhost:7101/health
curl -s https://localhost:7102/health

4. Call the API

Import postman/signsync-api.postman_collection.json and the signsync-local environment (see Postman). Set accessToken in the environment to a bearer token for your test tenant, then run the requests.

Never paste a real token into a committed file or into the collection. The accessToken variable is marked secret and must stay empty in the example environment files.

5. Run the front ends

npm run dev -w src/web-admin
npm run dev -w src/web-publisher

Get started

Reference

Operations

Prerequisites

1. Build the solution

2. Configure the hosts against Azure dev

Production

3. Run the hosts

4. Call the API

5. Run the front ends

​Prerequisites

​1. Build the solution

​2. Configure the hosts against Azure dev

​Production

​3. Run the hosts

​4. Call the API

​5. Run the front ends

Prerequisites

1. Build the solution

2. Configure the hosts against Azure dev

Production

3. Run the hosts

4. Call the API

5. Run the front ends