Feat/portfolio owned position events

.config/dotnet-tools.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "dotnet-ef": {
+      "version": "10.0.9",
+      "commands": [
+        "dotnet-ef"
+      ],
+      "rollForward": false
+    }
+  }
+}

.github/workflows/portal-validation.yml

@@ -47,5 +47,10 @@ jobs:
       - name: Restore solution
         run: dotnet restore WiSave.Portal.slnx --configfile NuGet.Config
 
+      # Compiles every project, not just what the test project happens to reference.
+      # Without this, a project outside the test graph can break without CI noticing.
+      - name: Build solution
+        run: dotnet build WiSave.Portal.slnx --configuration Release --no-restore
+
       - name: Run portal unit tests
         run: dotnet test tests/WiSave.Portal.UnitTests/WiSave.Portal.UnitTests.csproj --configuration Release --no-restore

.gitignore

@@ -25,3 +25,6 @@ graphify-out/
 ## OS
 .DS_Store
 Thumbs.db
+
+## Superpowers artifacts (specs/plans live in the Obsidian vault)
+docs/superpowers/

CLAUDE.md

@@ -1,67 +1,6 @@
 # CLAUDE.md
 
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+All guidance for this repository lives in [AGENTS.md](AGENTS.md). It is the single
+source of truth for every coding agent — do not add project guidance here.
 
-## Build & Run Commands
-
-```bash
-# Build
-dotnet build
-
-# Run the portal (requires Postgres + Redis; see docker-compose for local infra)
-dotnet run --project src/WiSave.Portal
-
-# Run all tests (uses in-memory database, no external deps needed)
-dotnet test
-
-# Run a single test by fully-qualified name
-dotnet test --filter "FullyQualifiedName~WiSave.Portal.Tests.Auth.AuthEndpointsTests.Register_ReturnsOk"
-
-# Run tests in a specific class
-dotnet test --filter "FullyQualifiedName~WiSave.Portal.Tests.Auth.AuthEndpointsTests"
-
-# Start local infrastructure only; the portal container is behind an explicit profile.
-docker compose up -d
-
-# Start local infrastructure plus the Dockerfile-built portal image
-docker compose --profile portal up -d --build
-
-# Generate a DbUp migration SQL from EF Core migrations
-./scripts/generate-dbup-script.sh <from-migration|0> <to-migration> <output-sql-path>
-```
-
-## Architecture
-
-**WiSave Portal** is an API gateway/portal service built on ASP.NET Core (.NET 10). It authenticates users, resolves plan-based permissions, and proxies requests to downstream microservices via YARP reverse proxy.
-
-### Solution Projects
-
-- **WiSave.Portal** — Main application: auth endpoints, YARP gateway, session management, authorization middleware
-- **WiSave.Portal.Migrations** — DbUp-based PostgreSQL migrations (SQL scripts in `Scripts/`, run via `DbMigrator.Run()`)
-- **WiSave.Portal.Tests** — xUnit v3 integration tests using `WebApplicationFactory` with in-memory database
-- **WiSave.Portal.EfTools** — Design-time helper for EF Core CLI tooling (used by `generate-dbup-script.sh`)
-
-### Key Layers (within WiSave.Portal)
-
-- **Auth** (`/Auth`) — ASP.NET Core Identity configuration, `ApplicationUser` model (extends `IdentityUser` with `Name` and `PlanId`)
-- **Authorization** (`/Authorization`) — `PermissionResolutionMiddleware` resolves user permissions from their plan, caches via `UserPlanCache` and `PlanPermissionCache` (1hr TTL, distributed cache)
-- **Gateway** (`/Gateway`) — YARP config (`YarpConfiguration.cs`), `UserHeaderTransform` strips client identity headers and injects authenticated user info (X-User-Id, X-User-Email, X-User-Roles, X-User-Permissions)
-- **Session** (`/Session`) — Redis-backed session storage (`RedisTicketStore`), falls back to in-memory cache
-- **Endpoints** (`/Endpoints`) — Auth endpoint mappings at `/api/auth` (register, login, logout, me, antiforgery-token)
-- **Infrastructure/Database** (`/Infrastructure/Database`) — `PortalDbContext` with Identity tables + Plans, Permissions, PlanPermissions
-
-### Permission Model
-
-Users belong to a **Plan** (free/standard/premium). Each plan maps to a set of **Permissions** (e.g., `incomes:read`, `stocks:write`). Admin roles (`superadmin`, `admin`) get wildcard `*` permissions. Resolved permissions are injected into proxy headers for downstream services.
-
-### Proxy Routes
-
-YARP routes `/api/incomes/{**remainder}` and `/api/stocks/{**remainder}` to downstream service clusters. Antiforgery validation is enforced on unsafe HTTP methods (POST/PUT/DELETE/PATCH) in the proxy pipeline.
-
-### Local Development
-
-Default downstream targets: incomes at `localhost:5114`, stocks at `localhost:5086`. Override via `ReverseProxy:Clusters` config or environment variables. CORS allows `http://localhost:4200` (Angular frontend). API docs available at `/scalar/v1` in Development mode.
-
-## Testing
-
-Tests use `WebApplicationFactory` with `UseInMemoryDatabase=true` — no external services required. Each test seeds its own roles and plans. `UserHeaderTransformTests` spins up a local echo server to validate proxy header injection.
+@AGENTS.md

Directory.Packages.props

@@ -1,31 +1,42 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <ItemGroup>
+    <PackageVersion Include="Aspire.Hosting.AppHost" Version="13.4.6" />
+    <PackageVersion Include="Aspire.Hosting.PostgreSQL" Version="13.4.6" />
+    <PackageVersion Include="Aspire.Hosting.RabbitMQ" Version="13.4.6" />
+    <PackageVersion Include="Aspire.Hosting.Redis" Version="13.4.6" />
     <PackageVersion Include="dbup-postgresql" Version="7.0.1" />
-    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.StackExchangeRedis" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.9" />
-    <PackageVersion Include="MessagePack" Version="3.1.7" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
-    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.2" />
-    <PackageVersion Include="NSubstitute" Version="5.3.0" />
-    <PackageVersion Include="Scalar.AspNetCore" Version="2.16.10" />
+    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.StackExchangeRedis" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.17.0" />
+    <PackageVersion Include="Microsoft.OpenApi" Version="2.11.0" />
+    <PackageVersion Include="MessagePack" Version="3.1.8" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
+    <PackageVersion Include="NSubstitute" Version="6.0.0" />
+    <PackageVersion Include="Scalar.AspNetCore" Version="2.16.17" />
     <PackageVersion Include="WiSave.Expenses.Contracts" Version="1.0.9" />
     <PackageVersion Include="WiSave.Framework.Messaging.Wolverine" Version="1.0.5" />
     <PackageVersion Include="WiSave.Incomes.Contracts" Version="1.0.6" />
-    <PackageVersion Include="WiSave.Stock.Contracts" Version="1.0.1" />
-    <PackageVersion Include="WolverineFx.RabbitMQ" Version="6.16.0" />
-    <PackageVersion Include="WolverineFx.RuntimeCompilation" Version="6.16.0" />
+    <PackageVersion Include="WiSave.Stock.Contracts" Version="2.0.4" />
+    <PackageVersion Include="WolverineFx.RabbitMQ" Version="6.24.2" />
+    <PackageVersion Include="WolverineFx.RuntimeCompilation" Version="6.24.2" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
     <PackageVersion Include="xunit.v3" Version="3.2.2" />
     <PackageVersion Include="Yarp.ReverseProxy" Version="2.3.0" />

WiSave.Portal.slnx

@@ -1,16 +1,20 @@
 <Solution>
   <Folder Name="/src/">
+    <Project Path="src/WiSave.Portal.AppHost/WiSave.Portal.AppHost.csproj" />
     <Project Path="src/WiSave.Portal.Console/WiSave.Portal.Console.csproj" />
     <Project Path="src/WiSave.Portal.Contracts/WiSave.Portal.Contracts.csproj" />
+    <Project Path="src/WiSave.Portal.Core.Abstractions/WiSave.Portal.Core.Abstractions.csproj" />
+    <Project Path="src/WiSave.Portal.Core.Application/WiSave.Portal.Core.Application.csproj" />
+    <Project Path="src/WiSave.Portal.Core.Infrastructure/WiSave.Portal.Core.Infrastructure.csproj" />
     <Project Path="src/WiSave.Portal.Migrations/WiSave.Portal.Migrations.csproj" />
-    <Project Path="src/WiSave.Portal/WiSave.Portal.csproj" />
+    <Project Path="src/WiSave.Portal.WebApi/WiSave.Portal.WebApi.csproj" />
   </Folder>
   <Folder Name="/tests/">
     <Project Path="tests/WiSave.Portal.UnitTests/WiSave.Portal.UnitTests.csproj" />
-    <Project Path="tests/WiSave.Portal.IntegrationTests/WiSave.Portal.IntegrationTests.csproj" />
   </Folder>
   <Folder Name="/Solution Items/">
+    <File Path="AGENTS.md" />
     <File Path="CLAUDE.md" />
-    <File Path="docker-compose.yml" />
+    <File Path="Directory.Packages.props" />
   </Folder>
 </Solution>

aspire.config.json

@@ -0,0 +1,5 @@
+{
+  "appHost": {
+    "path": "src/WiSave.Portal.AppHost/WiSave.Portal.AppHost.csproj"
+  }
+}