Document Management in .NET: Renditions & Secure Links
Storing an uploaded file is the easy 20%. The other 80% — thumbnails, typed metadata, and secure expiring share links — is what every team reinvents badly. Here is how Granit solves all three.
JF Meyers
61 posts by JF Meyers
Structured LLM Output in .NET: Stop Parsing Prose
Regex-parsing an LLM's prose reply breaks the day the model rephrases. Ask for a typed object instead — your C# type becomes a JSON schema the model must satisfy.
RAG in .NET: Semantic Search Without a Vector Vendor
You don't need a vector database vendor to ship retrieval-augmented generation in .NET. Here's semantic search end to end — embeddings, pgvector, similarity search, and a grounded LLM answer — on the Postgres you already run.
A Power BI Feed From Your .NET App With OData
Finance wants the numbers in Power BI, refreshed daily — again. Instead of hand-building another CSV export, expose a governed OData v4 feed from your .NET app and let Power BI pull live data through the same security pipeline as your grids.
VAT and Sales Tax for .NET SaaS, Done Right
Tax is where naive SaaS billing quietly breaks. Here is how to get EU cross-border VAT, US sales tax, and historical invoice integrity right in a .NET SaaS — with real Granit code.
Type-Safe React API Clients From Your .NET App
A hand-written fetch wrapper drifts from your .NET contract the moment someone renames a field. Here is how to make the backend contract the single source of truth for your React client — with type errors at build time instead of 500s in prod.
Subscription Billing in .NET: Proration and Dunning
Recurring billing looks like a cron job that charges a card once a month. Then a customer upgrades on day 20, a card declines, and someone overpays. Here is how the hard parts actually work in .NET.
SEPA Payments in .NET Without a Payment Gateway
Recurring EU billing does not require a US payment gateway. Here is how a provider-agnostic design collects a finalized invoice over SEPA — no Stripe, no Mollie, no Cloud Act exposure — and stays retry-safe end to end.
Usage-Based Billing in .NET Without a Metering Vendor
You do not need a metering vendor to bill on usage. Here is the full in-process pipeline — event ingest, idempotent dedupe, watermark rollup, quota alerts, invoice — built on Granit.Metering and Granit.Invoicing.
Multi-Tenant Data Isolation in .NET: Three Strategies
Row-level, schema-per-tenant, or database-per-tenant? Here is how the three isolation strategies trade off — and how Granit gives you the safe default plus a mechanical path to strict isolation when a customer demands it.
MQTT to Time-Series in .NET: IoT Telemetry Without a Separate Stack
Most .NET teams reach for a Python or Node sidecar the moment a device starts speaking MQTT. Here's how to keep the entire pipeline — broker connection, dedup, thresholds, time-series storage — in .NET 10, and why that stops being optional past 10 million rows a day.
Real-Time Presence in .NET: Who's Online Without Polling Redis Yourself
Every chat, dashboard, or CMS eventually needs a green dot next to a name. Most teams build it twice: once for "is this person online", once for "who else is looking at this document" — and get the multi-tab and multi-pod edge cases wrong both times. Here's the primitive that replaces both.
Impossible Travel Detection & Session Risk Scoring in .NET
A stolen session cookie passes every auth check you have. The signal that something is wrong isn't in the token — it's in the pattern: a login from Brussels, then São Paulo, eight minutes later. Here's how to catch it in .NET.
IP Geolocation in .NET: Local MaxMind vs Remote API
Turning a client IP into a city has two answers in .NET — a local MaxMind database or a remote lookup API — and each hides a trap. Here is the honest trade-off between offline speed and online freshness, the GDPR problem nobody mentions, and how to run both behind one resolver.
FAPI 2.0 in .NET: Financial-Grade Security with One Flag
FAPI 2.0 is the security profile required by Open Banking, healthcare APIs, and government identity systems. Most teams think conformance takes months. Granit's OpenIddict server, BFF, and resource server implement every requirement — one flag enables the full profile.
Build Your Own Identity Server in .NET: OpenIddict + Granit
Auth0 costs $240/month past 7 500 users. Keycloak needs its own VM and JVM tuning. Granit.OpenIddict ships as NuGet packages and runs in the same process as your API — full OIDC compliance, zero external services.
Rate Limiting and Bulkhead Isolation in ASP.NET Core
Rate limiting and bulkhead isolation are often mentioned together but solve different problems. This deep-dive explains both patterns, shows where they fail without the other, and walks through Granit's dual enforcement model — Redis-backed quotas for the time axis, concurrency limiters for the thread axis.
Never Lose a Webhook: Signed, Durable Delivery in .NET
A server restart between your database commit and your HTTP POST drops the event forever. The fix is the transactional outbox pattern — persist the event in the same transaction as your data, relay it asynchronously, retry on failure. Here is how Granit.Webhooks implements it end-to-end.
Multi-Regulation Cookie Consent: GDPR, CCPA, LGPD
Shipping to the EU means opt-in. Shipping to California means opt-out. Shipping to Brazil means opt-in again. Most teams hardcode GDPR and call it done. Here is how Granit resolves the right consent model automatically — per tenant, per request, without a line of conditional logic in your application code.
Content Security Policy in ASP.NET Core, Per Endpoint
Your strict Content Security Policy breaks the moment one ASP.NET Core route serves HTML — Scalar, an admin page, a Keycloak iframe. The usual band-aid weakens every other endpoint. Granit's per-endpoint CSP composition keeps strict defaults strict and lets the package that mounts the UI declare its own relaxation.
From Channels to Wolverine: Upgrade Without a Rewrite
Prototype with Channel
Web Push Notifications in .NET 10 with VAPID
W3C Web Push lets the browser ring even when your tab is closed. With VAPID you do it without FCM, without APNs, and without a single US-hosted dependency. Here is the .NET 10 side, the React hook, and the 30 lines of service worker that ties them together.
Building an Import Pipeline: CSV and Excel with Validation
Every line-of-business app eventually grows an "import CSV" button. Done wrong it OOMs on the first 100k row file. Done right it streams, validates, resolves identity, and hands the user a correction file for the rows that failed.
Soft Deletes and Audit Trails with EF Core Interceptors
Stop sprinkling CreatedAt assignments across repositories and IsDeleted = false across queries. Five interceptors and one global filter make compliance the default — and ExecuteUpdate the only thing left to watch for.
Background Jobs in .NET Without Hangfire: Wolverine + Cronos
Hangfire ships fast. Then production scales out, two nodes fire the same recurring job at the same time, the outbox you bolted on doesn't include the job table, and the audit log goes sideways. There is a better default in 2026.
Feature Flags in .NET Without LaunchDarkly
LaunchDarkly is great. €0.0050 per MAU is less great when you have 200k tenants and want to gate "VideoConference" behind the Premium plan. Here is how to build LaunchDarkly's core value in your own .NET codebase — without the bill.
HTML-to-PDF in .NET: PuppeteerSharp + Scriban Without the Pain
Every SaaS eventually needs invoices, contracts, monthly reports. The HTML-to-PDF route is cheaper, more flexible and easier to maintain than iText or QuestPDF — provided you build the pipeline right. Here's how.
Architecture Tests in .NET: Stop Module Boundary Drift
Code reviews catch typos. They do not catch a controller quietly importing Microsoft.EntityFrameworkCore and bypassing your repository layer. Architecture tests do — at build time, on every PR. Here is a pragmatic playbook for .NET teams.
Adding Authentication with Keycloak in Granit
Wire Keycloak JWT Bearer authentication into a Granit API in five minutes — claims transformation, role mapping, back-channel logout, and an Admin authorization policy, all from one DependsOn.
5 EF Core Mistakes That Kill Performance
From accidental client evaluation to N+1 queries and tracked reads, these are the five EF Core anti-patterns that turn 50 ms endpoints into 5-second ones — and the exact fix for each.
Multi-Channel Notifications in .NET
One PublishAsync call, nine delivery channels. How Granit fans out a single notification to email, SMS, WhatsApp, mobile push, web push, SignalR, SSE, Zulip, and the in-app inbox without rewriting your domain code.
ConfigureAwait(false) in Library Code in .NET 10
ASP.NET Core dropped the synchronization context years ago. So why do every Granit library and the .NET runtime itself still write ConfigureAwait(false) on every await? Because libraries do not get to choose their host.
HybridCache + Redis: Solving Distributed Cache Invalidation
Two-tier caches are fast, but cross-pod invalidation is the part everyone gets wrong. Here is how the L1 + L2 + backplane pattern works, and how Granit wires it up with Redis.
Validation at the Right Layer
Scattering validation across controllers, services, and entities produces inconsistent errors and missed cases. Pin it to the API boundary with FluentValidation and endpoint filters — and let the platform do the rest.
CQRS Without MediatR: How Granit Uses Wolverine
MediatR is in-process only — no outbox, no retry, no transport. Wolverine is the CQRS bus most teams actually need. Here is how Granit uses it.
Don't Mock the Database — Use Testcontainers Instead
EF Core InMemory and SQLite lie about PostgreSQL. Use Testcontainers to run ephemeral real databases in your integration tests — zero mocks, zero surprises in prod.
Observability in .NET 10: Serilog + OpenTelemetry to Grafana
Wire Serilog, OpenTelemetry and the Grafana LGTM stack into a .NET 10 app in one call. Structured logs, distributed traces, metrics — all OTLP, all sovereign.
The Options Pattern — 3 Levels of Configuration Binding
IOptions, IOptionsSnapshot, and IOptionsMonitor solve different problems. Picking the wrong one causes stale config, unnecessary allocations, or subtle concurrency bugs. Here is when to use each — with real examples from the Granit codebase.
Secrets Management with HashiCorp Vault in .NET 10
Hardcoded connection strings and static API keys are a breach waiting to happen. HashiCorp Vault gives you dynamic credentials, transit encryption, and per-entity key isolation — and Granit integrates all three as a single module dependency.
Idempotency Keys: Why Every POST Should Be Retry-Safe
A dropped connection, a mobile retry, a load-balancer timeout — any of these can duplicate a POST. Idempotency keys turn dangerous replays into harmless no-ops, and Granit ships the entire pattern as a single middleware.
Server-Sent Events in .NET 10: Real-Time Without WebSockets
.NET 10 makes SSE a first-class citizen with TypedResults.ServerSentEvents(). Build a complete real-time notification stream from HTTP primitives to React hooks — no WebSocket plumbing required.
RFC 7807 Problem Details: The Only Way to Return Errors
Stop returning bare strings from your .NET APIs. RFC 7807 Problem Details is the standard for error responses — here is why it matters, what the spec actually says, and how Granit enforces it with zero boilerplate.
SSE vs SignalR vs WebSockets
SSE, SignalR, or raw WebSockets? A practical decision framework for .NET real-time applications, with protocol deep-dives, trade-offs, and ready-to-use Granit code samples for each transport.
[LoggerMessage] Over String Interpolation
String interpolation in log calls allocates on every invocation, even when the log level is disabled. Source-generated [LoggerMessage] eliminates that cost entirely and gives you structured logs for free.
FullStackHero vs Granit: Two .NET Frameworks
FullStackHero and Granit both target modular .NET applications, but their architectures, compliance stories, and extension models diverge sharply. Here is a fair, side-by-side comparison for architects choosing their next foundation.
Building SOC 2 Type 2-Ready SaaS with Granit
Enterprise customers ask for a SOC 2 Type 2 report before signing. Here is how Granit's modules map to the five Trust Service Criteria — and what the framework cannot replace.
How Granit Helps You Ship NIS 2-Ready .NET Applications
NIS 2 is now law across the EU. Here is what it requires from your .NET stack — and how Granit's supply chain pipeline and embedded security modules cover the key obligations out of the box.
Scalar Is the New Swagger UI — Here's How to Switch
Swashbuckle is unmaintained and has no OpenAPI 3.1 support. .NET 10 ships a native document generator. Here is how to replace Swagger UI with Scalar — and what Granit's ApiDocumentation module does for you automatically.
Let AI Agents Use Your .NET Modules
The new Granit.Mcp module family wraps the MCP C# SDK to expose your application capabilities to AI agents, with auto-discovery, RBAC authorization, and GDPR-compliant output sanitization.
Crypto-Shredding: GDPR Erasure Without Deleting a Single Row
Physical deletion breaks audit trails, conflicts with legal holds, and fails on append-only systems. Crypto-shredding solves all three: destroy the key, and the ciphertext becomes random noise. Here is how Granit implements it.
Why Your React App Should Never Touch an Access Token
Your React app stores access tokens in localStorage. A compromised npm package reads them. Game over. Granit.Bff moves token handling to the server, so the browser only sees an HttpOnly cookie it cannot read.
Never Return Your EF Entities From an API
Returning EF Core entities directly from your endpoints leaks internal structure, creates circular references, and exposes sensitive data. Use response records instead.
400+ Packages, Zero Circular Dependencies
Granit ships 400+ NuGet packages with zero circular dependencies, enforced by Kahn's algorithm at startup and architecture tests at build time.
From Zero to CRUD in 10 Minutes with Granit
Build a complete CRUD module with Granit in under 10 minutes — from entity definition to validated endpoints with full audit trail and soft delete.
Introducing Granit: A Modular Framework for .NET 10
Granit is an open-source modular framework for .NET 10 — 400+ packages, zero circular dependencies, GDPR and ISO 27001 compliance built in. Here is why we built it and what it gives you.
Guard Clauses Done Right
Manual null checks are noisy and inconsistent. .NET provides built-in guard methods that are cleaner, faster, and throw the right exceptions every time.
GDPR by Design: Privacy Patterns in a .NET Framework
GDPR compliance is not a checkbox. It is an architectural constraint that must be enforced at the framework level. Here is how Granit implements data minimization, right to erasure, and pseudonymization by default.
[GeneratedRegex] Is Not Optional — Compiled Regex Is Dead
new Regex(..., RegexOptions.Compiled) allocates at startup and hides patterns from the JIT. Source-generated regex is faster, safer, and enforced at build time.
Isolated DbContext Per Module: Why and How
Shared DbContexts create hidden coupling between modules. Here is how Granit enforces database isolation per module — and why it makes microservice extraction mechanical.
Stop Using DateTime.Now — Inject TimeProvider Instead
DateTime.Now makes your code untestable and timezone-fragile. Here is how to replace it with TimeProvider and IClock for deterministic, test-friendly time.
Why We Chose Modular Monolith Over Microservices
Microservices are not a goal. They are a trade-off. Here is why Granit bets on the modular monolith as the default architecture — and how the framework makes extraction painless when the time comes.