VendorFlow

VendorFlow is a portfolio-grade .NET vendor-onboarding workflow. It accepts a vendor application, validates it, calls a simulated compliance service, routes risk with Camunda DMN, and records either automatic or human approval.

All external enterprise dependencies are simulated locally. This repository demonstrates architecture and operational practices; it is not a production vendor-management system.

What it demonstrates

• Clean Domain / Application / Infrastructure boundaries
• Camunda BPMN orchestration and DMN risk routing
• SQL Server business persistence, idempotency, worker execution, audit, and outbox records
• Human review, recovery, retries, incidents, and manual remediation
• JWT/OIDC role policies for applicant, reviewer, and administrator operations
• Correlated logs, liveness/readiness checks, tests, formatting, vulnerability checks, and CI

Architecture

flowchart LR
  Client --> API[ASP.NET Core API]
  API --> SQL[(SQL Server)]
  API --> Camunda[Camunda]
  Camunda --> Workers[.NET Workers]
  Workers --> Mock[Mock Compliance API]
  Workers --> SQL
  Workers --> Camunda

Loading

Workflow

flowchart LR
  Submit --> Validate --> Compliance --> Risk{DMN risk}
  Risk -->|Low| AutoApprove --> Complete
  Risk -->|Medium| StandardReview --> Complete
  Risk -->|High| EnhancedReview --> Complete
  Compliance -->|Business error| Remediation --> EnhancedReview

Loading

Quick start

1. Start SQL Server and Camunda as described in docs/Camunda.md.
2. Before starting the local identity provider, choose a local Keycloak bootstrap username and unique password. Set them only in your shell as KEYCLOAK_ADMIN_USERNAME and KEYCLOAK_ADMIN_PASSWORD, then follow docs/LocalIdentity.md to start Keycloak and create the demo users. Never commit credentials.
3. Configure connection strings plus Jwt__Authority and Jwt__Audience with user secrets or environment variables.
4. Deploy the BPMN and DMN resources using the command in docs/Camunda.md.
5. Run VendorFlow.MockComplianceApi, VendorFlow.Workers, and VendorFlow.Api.
6. Submit a vendor application with an Idempotency-Key header and a bearer token for the appropriate role.

See Quality Gates, Operations, Security, and Mock Compliance API.

Engineering decisions

Concern	Approach
Business state	SQL Server is the system of record. Camunda owns long-running workflow state.
Reliability	API and worker idempotency records, bounded retries, BPMN error routing, recovery audit, outbox dispatch.
Security	JWT/OIDC authentication, role policies, externally configured settings, threat model.
Operability	Correlation header, structured worker context, health/readiness, runbook.

Validate locally

dotnet restore
dotnet build VendorFlow.slnx --no-restore --configuration Release
dotnet format VendorFlow.slnx --no-restore --verify-no-changes
dotnet test VendorFlow.slnx --no-build --configuration Release

Demo

Use DemoScript.md for a three-to-five-minute walkthrough, including a failed compliance call and recovery path.