GateKeeper — Quick Reference

Run it locally

# Prereqs: .NET 8 SDK, MySQL 8.0.16+, Redis
dotnet restore
dotnet build

# Load schema against a fresh database (see Known Issues — seed rows 101/205/310 will FK-fail as-is)
mysql -u root -p gatekeeper < docs/gatekeeper-schema.sql

dotnet run --project GateKeeper.Api        # http://localhost:5080
dotnet run --project GateKeeper.AdminUI    # http://localhost:5190

docs/gatekeeper-schema.sql seeds two customers, CWS (id 401) and WSB (id 402), with no tokens/packages/subscriptions attached. Issue a token via the Admin API or AdminUI, then call /v1/meetings with the issued client-guid and secret in the X-Client-Guid / X-Api-Secret headers.

Full onboarding walkthrough (create customer → issue token → assign package → hand off credentials → rotate/revoke later) is in the README's "Onboarding an external client" section.

HTTP API

GET /v1/meetings

Requires X-Client-Guid + X-Api-Secret headers. Currently serves a hardcoded in-memory list of 4 sample meetings filtered through the caller's effective entitlement — illustrative, so the pipeline is runnable without a real racing-data backend. /v1/racecards, /v1/speedmaps not yet implemented (same shape planned).

Response: 200 { "data": [ { "venue": "...", "country": "...", "discipline": "..." }, ... ] }, or 401 on missing/invalid credentials or an unresolvable entitlement.

Admin endpoints (all require the X-Admin-Key header)

Route	Method	Body	Returns
/admin/customers	POST	{ name, contactEmail }	201 → { id, clientGuid }
/admin/customers/{id}	DELETE	—	200 (cascades tokens/subscriptions/overrides; invalidates cache)
/admin/packages	POST	{ code, name, rules }	201 → { id }
/admin/packages/{id}	POST	{ name, rules, isActive }	200 (refreshes cache for every subscribed customer)
/admin/customers/{id}/tokens	POST	{ label, expiresAt? }	201 → issued token id + the new secret, shown once, never retrievable again
/admin/tokens/{id}/revoke	POST	—	200
/admin/customers/{id}/subscriptions	POST	{ packageCode, startDate, endDate? }	201 → { subscriptionId }
/admin/subscriptions/{id}/cancel	POST	—	200
/admin/customers/{id}/overrides	POST	{ effect, constraints, startDate, endDate?, note?, createdBy? }	201 → { overrideId }
/admin/overrides/{id}/revoke	POST	—	200 (sets endDate to today, doesn't delete — preserves history)

Gap: DataType CRUD, UpdateSubscriptionDatesAsync, UpdateApiHitLimitAsync exist on GateKeeperAdminService and are used by the Blazor AdminUI, but have no corresponding /admin HTTP route — only reachable in-process from the AdminUI today.

Configuration

Setting	Where	Notes
ConnectionStrings:MySql	appsettings.json (API + AdminUI)	MySQL host/port/database/credentials, semicolon-delimited connection string
ConnectionStrings:Redis	same	host:port, e.g. localhost:6379
Admin:ApiKey	same	Shared value checked by AdminAuthMiddleware and the AdminUI login screen
Cache:TokenTtlMinutes	same (optional)	Redis TTL for the token cache. Default 5. 0/negative = no expiry.
Cache:EntitlementTtlMinutes	same (optional)	Redis TTL for the entitlement cache. Default 5. 0/negative = no expiry.

Docker Compose/Swarm maps two environment variables (see .env.example) onto the MySQL connection string and admin key settings via ASP.NET Core's double-underscore config binding. launchSettings.json for both API and AdminUI can also carry local dev connection-string overrides directly (e.g. pointing at a docker-mapped MySQL port) — never commit real credentials there; use a local, non-shared dev value.

Do not commit real credentials. appsettings.json and gatekeeper-schema.sql use placeholder values for secrets — but see Known Issues for a real credential currently committed in one Development config file.

Related docs in docs/

• entitlement-system-design.md — original design proposal (architecture rationale, worked examples)
• gatekeeper-schema.sql — MySQL DDL + seed data
• gatekeeper-db-documentation.md — table-by-table DB reference
• entitlement-system-architecture.svg, entitlement-system-full-picture.html — diagrams