Load for Blazor BFF server work involving YARP proxy routes, cookie sessions, access-token forwarding/refresh, downstream API calls, BFF handlers, or browser-to-API auth failures; not for client component rendering or API JWT validation alone.
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
ABOUTME: Blazor BFF rules for YARP, token forwarding, and auth state. ABOUTME: Read referenced resources before applying.
Project-Agnostic BFF Patterns for Blazor Web Apps (InteractiveAuto)
Placeholders use
{Placeholder}syntax - see docs/internal/TEMPLATE_GLOSSARY.md.
X-Setup-Secret is stripped from inbound requests and replaced by the BFF from secure config. X-Tenant-Slug is forwarded when the BFF has an authoritative tenant hint.InternalAppPolicy, ExternalAppPolicy, InternalWebsitePolicy, ExternalWebsitePolicy, DevPolicy). Do not copy placeholder policy names from generic BFF examples into this codebase.X-Tenant-Slug first, then normalized Request.Host.Host after forwarded-header processing. API-key flows are split: pre-auth middleware may record a requested tenant hint, and post-auth middleware finalizes binding or fails closed.No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Load for Blazor/MudBlazor UI changes involving forms, dialogs, focus, keyboard navigation, landmarks, ARIA, color contrast, RTL-safe styling, or WCAG 2.2 AA tests; not for backend-only changes.
The English summary is being prepared. Showing the original description.
Load when a task asks to research, verify, compare, or look up framework/package behavior, release notes, standards, RFCs, CVEs, or unfamiliar APIs; use repository evidence first, then official docs, and not for codebase navigation alone.
The English summary is being prepared. Showing the original description.
Load for Aspire AppHost work: start/stop/wait resources, inspect dashboard/logs/traces, add integrations/resources, rebuild a service, run isolated worktrees, or diagnose Aspire orchestration; not for plain dotnet apps, container-only deployments, or cloud deployment.
The English summary is being prepared. Showing the original description.
Load for authentication or authorization changes involving BFF cookies/tokens, JWT validation, claims/user ID extraction, policies, handler access checks, impersonation, or 401/403 bugs; not for UI affordance gating alone.
The English summary is being prepared. Showing the original description.
Load when editing Blazor `.razor.css`, scoped selectors, `::deep`, BEM class names, RTL/logical CSS properties, or styling nested MudBlazor components; not for global design tokens or non-Blazor CSS.
The English summary is being prepared. Showing the original description.
Load for Blazor/MudBlazor component or page changes involving render modes, dialogs, parameters/events, HAL-gated actions, generated API clients or generated record consumption, theming, or component tests; add accessibility or CSS-isolation only when touched.
The English summary is being prepared. Showing the original description.