Interceptors — Audit, Soft Delete, Concurrency, Events

Five interceptors execute on every SaveChanges call, in this order:

Order	Interceptor	Behavior
1	`AuditedEntityInterceptor`	Populates `CreatedAt`, `CreatedBy`, `ModifiedAt`, `ModifiedBy`, auto-generates `Id`, injects `TenantId`
2	`VersioningInterceptor`	Sets `VersionId` and `Version` on `IVersioned` entities
3	`ConcurrencyStampInterceptor`	Regenerates `ConcurrencyStamp` on `IConcurrencyAware` entities
4	`DomainEventDispatcherInterceptor`	Collects domain events before save, dispatches after commit
5	`SoftDeleteInterceptor`	Converts `DELETE` to `UPDATE` for `ISoftDeletable` entities

AuditedEntityInterceptor

Resolves audit data from DI:

Who: ICurrentUserService.UserId (falls back to "system")
When: IClock.Now (never DateTime.UtcNow)
Id: IGuidGenerator (sequential GUIDs for clustered indexes)

Entity state	Action
`Added`	Sets `CreatedAt`, `CreatedBy`. Auto-generates `Id` if `Guid.Empty`. Injects `TenantId` if `IMultiTenant` and null.
`Modified`	Protects `CreatedAt`/`CreatedBy` from overwrite. Sets `ModifiedAt`, `ModifiedBy`.

ExecuteUpdate() and ExecuteUpdateAsync() emit a raw SQL UPDATE and never reach AuditedEntityInterceptor. Set ModifiedAt, ModifiedBy, and TenantId explicitly in the setPropertyCalls expression, or use the change tracker.

// ❌ Bypasses interceptor — audit fields not set
await db.Patients
    .Where(p => p.TenantId == tenantId)
    .ExecuteUpdateAsync(s => s.SetProperty(p => p.Status, status), ct);

// ✅ Correct — include audit fields explicitly
await db.Patients
    .Where(p => p.TenantId == tenantId)
    .ExecuteUpdateAsync(s => s
        .SetProperty(p => p.Status, status)
        .SetProperty(p => p.ModifiedAt, clock.Now)
        .SetProperty(p => p.ModifiedBy, currentUser.UserId), ct);

SoftDeleteInterceptor

Converts physical DELETE to soft delete:

DELETE FROM Patients WHERE Id = @id
  ↓ intercepted ↓
UPDATE Patients SET IsDeleted = true, DeletedAt = @now, DeletedBy = @userId WHERE Id = @id

Only applies to entities implementing ISoftDeletable.

ExecuteDelete() and ExecuteDeleteAsync() emit a raw SQL DELETE and never reach SoftDeleteInterceptor. Use ExecuteUpdate() with explicit IsDeleted, DeletedAt, and DeletedBy assignments instead, or load the entity and call DbContext.Remove().

// ❌ Bypasses interceptor — performs a physical DELETE
await db.Patients.Where(p => p.Id == id).ExecuteDeleteAsync(ct);

// ✅ Correct — soft delete via interceptor
var patient = await db.Patients.FindAsync(id, ct);
db.Remove(patient!);
await db.SaveChangesAsync(ct);

// ✅ Also correct — explicit soft delete via ExecuteUpdate
await db.Patients
    .Where(p => p.Id == id)
    .ExecuteUpdateAsync(s => s
        .SetProperty(p => p.IsDeleted, true)
        .SetProperty(p => p.DeletedAt, clock.Now)
        .SetProperty(p => p.DeletedBy, currentUser.UserId), ct);

DomainEventDispatcherInterceptor

Collects and dispatches domain events transactionally:

SavingChanges — scans change tracker for IDomainEventSource entities, collects events, clears event lists
SavedChanges — dispatches events after commit via IDomainEventDispatcher
SaveChangesFailed — discards events (transaction rolled back)

Uses AsyncLocal<List<IDomainEvent>> for thread safety across concurrent SaveChanges calls in the same async flow.

Default dispatcher is NullDomainEventDispatcher (no-op). Granit.Wolverine replaces it with real message bus dispatch.

VersioningInterceptor

For IVersioned entities on EntityState.Added:

Generates VersionId if empty (first version of a new entity)
Determines Version from change tracker (starting at 1)
Modified entities are untouched — versioning is explicit (create a new entity with same VersionId)

ConcurrencyStampInterceptor

Prevents silent data loss from concurrent writes. When two users load the same entity and both save changes, the second write fails instead of overwriting the first.

Targets entities implementing IConcurrencyAware:

public class Order : AuditedEntity, IConcurrencyAware
{
    public string Reference { get; set; } = string.Empty;
    public OrderStatus Status { get; set; }
    public string ConcurrencyStamp { get; set; } = string.Empty;
}

Entity state	Action
`Added`	Sets `ConcurrencyStamp` to a new GUID string
`Modified`	Regenerates `ConcurrencyStamp` with a new GUID string

ApplyGranitConventions auto-discovers IConcurrencyAware entities and configures ConcurrencyStamp as an EF Core concurrency token (VARCHAR(36), .IsConcurrencyToken()). No manual Fluent API configuration needed.

EF Core includes the stamp in the WHERE clause on update:

UPDATE Orders
SET Status = @newStatus, ConcurrencyStamp = @newStamp
WHERE Id = @id AND ConcurrencyStamp = @originalStamp

If the stamp in the database differs from the original value loaded by the entity, EF Core throws DbUpdateConcurrencyException — mapped to HTTP 409 Conflict by EfCoreExceptionStatusCodeMapper.

Connected vs disconnected updates

Connected — entity loaded from the same DbContext. EF Core tracks OriginalValue automatically; nothing extra to do:

var order = await db.Orders.FindAsync(orderId, ct);
order!.Status = OrderStatus.Confirmed;
await db.SaveChangesAsync(ct); // stamp checked automatically

Disconnected (CQRS command, new DbContext) — the frontend sends the stamp it received in the GET response. You must set OriginalValue explicitly before saving:

var order = await db.Orders.FindAsync(request.Id, ct);
order!.Status = request.NewStatus;

// Tell EF Core what the client believes the current stamp is
db.Entry(order).Property(e => e.ConcurrencyStamp).OriginalValue = request.ConcurrencyStamp;

await db.SaveChangesAsync(ct); // throws DbUpdateConcurrencyException on mismatch

Use IConcurrencyStampRequest as a DTO convention:

public sealed record UpdateOrderStatusRequest(
    Guid Id,
    OrderStatus NewStatus,
    string ConcurrencyStamp) : IConcurrencyStampRequest;