Merge pull request 'Added RequireCors() to RouteGroup' (#76 ) from garages3 into main

Reviewed-on: #76
Added RequireCors() to RouteGroup
2026-09-15 08:45:25 +02:00 · 2026-09-15 08:44:43 +02:00 · 2026-09-15 08:37:43 +02:00 · 2026-09-15 08:37:08 +02:00 · 2026-09-15 07:30:29 +02:00 · 2026-09-15 07:29:58 +02:00
103 changed files with 576 additions and 183 deletions
@@ -0,0 +1,21 @@
+# Exclude build output and caches
+**/bin/
+**/obj/
+**/out/
+.vs/
+.vscode/
+
+# Exclude git internal files
+.git/
+.gitignore
+
+# Exclude local environment/secret files
+.env
+*.env
+*.user
+*.suo
+
+# Exclude node modules and temporary logs
+**/node_modules/
+**/dist/
+*.log
@@ -1,28 +0,0 @@
-FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
-WORKDIR /app
-EXPOSE 80
-EXPOSE 443
-
-FROM node:22-bookworm-slim AS node
-
-FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
-ARG TARGETARCH
-ENV DOTNET_CLI_TELEMETRY_OPTOUT=1 \
-    NUGET_XMLDOC_MODE=skip
-WORKDIR /app_source
-
-COPY . .
-
-RUN dotnet restore "PostFundManagement.slnx"
-
-WORKDIR "/app_source/PostFundManagement.Api"
-RUN dotnet build "PostFundManagement.Api.csproj" -c Release -o /app/build
-
-FROM build AS publish
-RUN dotnet publish "PostFundManagement.Api.csproj" -c Release --no-restore -o /app/publish
-
-FROM base AS final
-WORKDIR /app
-COPY --from=publish /app/publish .
-ENV ASPNETCORE_FORWARDEDHEADERS_ENABLED=true
-ENTRYPOINT ["dotnet", "PostFundManagement.Api.dll"]
@@ -0,0 +1,36 @@
+# Stage 1: Runtime base
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
+USER app
+WORKDIR /app
+EXPOSE 8080
+
+# Stage 2: Build & Restore
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+# Copy csproj files for layer caching
+COPY ["PostFundManagement.Api/PostFundManagement.Api.csproj", "PostFundManagement.Api/"]
+COPY ["PostFundManagement.Application/PostFundManagement.Application.csproj", "PostFundManagement.Application/"]
+COPY ["PostFundManagement.Domain/PostFundManagement.Domain.csproj", "PostFundManagement.Domain/"]
+COPY ["PostFundManagement.Infrastructure/PostFundManagement.Infrastructure.csproj", "PostFundManagement.Infrastructure/"]
+
+# Restore packages
+RUN dotnet restore "PostFundManagement.Api/PostFundManagement.Api.csproj"
+
+# Copy full source code
+COPY . .
+
+# Build from the project folder using relative filename
+WORKDIR "/src/PostFundManagement.Api"
+RUN dotnet build "PostFundManagement.Api.csproj" -c Release -o /app/build -v n
+
+# Stage 3: Publish
+FROM build AS publish
+ARG BUILD_CONFIGURATION=Release
+RUN dotnet publish "PostFundManagement.Api.csproj" -c Release -o /app/publish /p:UseAppHost=false
+
+# Stage 4: Final Runtime
+FROM base AS final
+WORKDIR /app
+COPY --from=publish /app/publish .
+ENTRYPOINT ["dotnet", "PostFundManagement.Api.dll"]
@@ -23,6 +23,7 @@ public sealed class GetApplicantInviteEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Gets an applicant's invite")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetApplicantInviteEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite>(StatusCodes.Status200OK)        
@@ -23,6 +23,7 @@ public sealed class GetApplicantInvitesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Gets an applicant's invite list")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetApplicantInvitesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite[]>(StatusCodes.Status200OK)        
@@ -23,6 +23,7 @@ public sealed class GetInvitesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of sent invitations")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetInvitesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite[]>(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public sealed class SendInviteEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Trigger an invite to an organization or candidate (specifying NotificationPlatform)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(SendInviteEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite>(StatusCodes.Status200OK)
@@ -34,9 +34,9 @@ public class CreateEvidenceEndpoint : IEndpoint
                var r => Results.InternalServerError(r.Errors.ToProblems())
            };
        })
-        .RequireAuthorization()
-        .DisableAntiforgery()
        .WithDescription("Upload supporting evidence file to S3 and register metadata (M14)")
+        .DisableAntiforgery()
+        .RequireAuthorization(Constants.MainScope)
        .WithName(typeof(CreateEvidenceEndpoint).ToEndpointName())
        .MapToApiVersion(new ApiVersion(1))
        .Produces(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class CreateIndicatorEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Define indicators and baselines/targets (M08)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateIndicatorEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class CreateMilestoneEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Define contractual milestones (M07)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateMilestoneRequest).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public sealed class GetEvidenceEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific evidence record and assiciated file URLs")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Evidence>(StatusCodes.Status200OK)
@@ -21,6 +21,7 @@ public class GetEvidenceFilesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of all uploaded evidence files metadata")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetEvidenceFilesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Evidence[]>(StatusCodes.Status200OK)
@@ -0,0 +1,37 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
+using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;
+
+namespace PostFundManagement.Api.Endpoints.Evidence;
+
+[ApiVersionTarget(1)]
+public sealed class GetEvidenceUrlEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/evidence/{evidenceId}/securelink", async (string evidenceId, IEvidenceService service, 
+            CancellationToken cancellationToken = default) =>
+                await service.GetEvidenceUrlAsync(evidenceIdHash: evidenceId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var evidenceUrl } => Results.Ok(evidenceUrl),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a secure download URL of the evidence file, URL expires (default: 15min)")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetEvidenceUrlEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<string>(StatusCodes.Status200OK)
+            .Produces<string>(StatusCodes.Status404NotFound)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Grants)
+            .CacheOutput();
+    }
+}
@@ -24,6 +24,7 @@ public sealed class GetIndicatorEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific indicator.")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetIndicatorEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Indicator>(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public class GetIndicatorsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Get a list of indicators")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetIndicatorsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Indicator[]>(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public class GetMilestoneEvidenceEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of all uploaded evidence metadata for a specific mliestone")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetMilestoneEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Evidence[]>(StatusCodes.Status200OK)        
@@ -22,6 +22,7 @@ public class GetProjectEvidenceEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Get a list of all uploaded evidence metadata for a specific project")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProjectEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Evidence[]>(StatusCodes.Status200OK)        
@@ -23,6 +23,7 @@ public class RecordIndicatorAmountEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Record actual values for indicators (M08)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(RecordIndicatorAmountEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -24,6 +24,8 @@ public sealed class UpdateEvidenceEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Updates a specific evidence record metadata")
+            .RequireAuthorization(Constants.MainScope)
+            .DisableAntiforgery()
            .WithName(typeof(UpdateEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public class ApproveDisbursementEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Approve disbursement and release payment (M06)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(ApproveDisbursementEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class CreateDisbursementEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Create a new disbursement schedule (M06)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateDisbursementEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class CreateRiskEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Add risk to risk register (M09)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateRiskEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public sealed class GetDisbursementEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific disbursement")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetDisbursementEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Disbursement>(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public class GetDisbursementsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of disbursements")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetDisbursementsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Disbursement[]>(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public sealed class GetRiskEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific risk")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetRiskEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Risk>(StatusCodes.Status200OK)
@@ -21,6 +21,7 @@ public class GetRisksEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of all risks")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetRisksEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public sealed class UpdateDisbursementEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update the details of a specific disbursement")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateDisbursementEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public sealed class UpdateRiskEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update the details of a specific risk")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateRiskEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public sealed class CreateOrganisationEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a new organization profile")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateOrganisationEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -25,6 +25,7 @@ public sealed class CreatePortfolioEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a new organization portfolio")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreatePortfolioEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -21,6 +21,7 @@ public class DashboardEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get executive portfolio dashboard metrics and KPIs")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(DashboardEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Dashboard>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public class GetInstrumentsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Get all funding instruments")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetInstrumentsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Instrument[]>(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class GetOrganisationEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get organization profile by ID")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetOrganisationEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Organisation>(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public class GetOrganisationsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a paginated directory of organizations")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetOrganisationsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Organisation[]>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public sealed class GetPortfolioEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific portfolios")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetPortfolioEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Portfolio[]>(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public sealed class GetPortfolioProgrammesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a programme's portfolios")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetPortfolioProgrammesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Programme[]>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public class GetPortfoliosEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get all portfolios")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetPortfoliosEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Portfolio[]>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public class GetProgrammesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get all programmes")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProgrammesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Programme[]>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public sealed class UpdateOrganisationEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update an existing organization profile")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateOrganisationEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -25,6 +25,7 @@ public sealed class UpdatePortfolioEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update an existing organization portfolio")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdatePortfolioEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -25,6 +25,7 @@ public class CreateAwardEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Register an approved funding award (M01)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateAwardEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -25,6 +25,7 @@ public class CreateBudgetEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a new budget line (M05)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateBudgetEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class CreateContractEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a contract record from an approved award (M02)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateContractEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public class ExecuteContractEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Execute the contract and lock the contractual version")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(ExecuteContractEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class GetAwardEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get award by ID")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetAwardEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Award>(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public class GetAwardsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of awards")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetAwardsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Award[]>(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class GetBudgetEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get budget by ID")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetBudgetEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Budget>(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public class GetBudgetsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get all budgets")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetBudgetsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Budget[]>(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class GetContractEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get contract by ID")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetContractEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Contract>(StatusCodes.Status200OK)
@@ -0,0 +1,37 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
+using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public sealed class GetContractUrlEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/grants/contracts/{contractId}/securelink", async (string contractId, IGrantsService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetContractUrlAsync(contractId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var contractUrl} => Results.Ok(contractUrl),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a secure download URL, has expiry period (default 15min)")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetContractUrlEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<string>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Grants)
+            .CacheOutput();
+    }
+}
@@ -22,6 +22,7 @@ public class GetContractsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get all contracts")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetContractsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Contract[]>(StatusCodes.Status200OK)
@@ -0,0 +1,39 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
+using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateContractEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/grants/contracts", async (UpdateContractRequest request, IGrantsService service,
+            CancellationToken cancellationToken = default) =>
+                await service.UpdateContractAsync(request, cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Updates a specific contract")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateContractEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Grants)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,48 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
+using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public sealed class UploadContractEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/grants/contracts/{contractId}", async (string contractId, HttpRequest request, IGrantsService service, 
+            CancellationToken cancellationToken = default) =>
+        {
+            if (!request.HasFormContentType)
+                return Results.BadRequest("Request must be a multipart form.");
+
+            var form = await request.ReadFormAsync(cancellationToken);
+            var file = form.Files.GetFile("file");
+
+            if (file == null || file.Length == 0)
+                return Results.BadRequest("No file uploaded or file is empty.");
+
+            return await service.UploadContractAsync(contractId, request.HttpContext.GetUserId(), file, cancellationToken) switch
+            {
+                { IsSuccess: true } => Results.Ok(),
+                var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                var r => Results.InternalServerError(r.Errors.ToProblems())
+            };
+        })
+        .WithDescription("Uploads a contract file securely")
+        .RequireAuthorization(Constants.MainScope)
+        .DisableAntiforgery()
+        .WithName(typeof(UploadContractEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status403Forbidden)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .Produces(StatusCodes.Status404NotFound)
+        .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .WithTags(EndpointTags.Grants)
+        .CacheOutput();
+    }
+}
@@ -23,6 +23,7 @@ public class CreateActivityEndpoint : IEndpoint
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
+            .RequireAuthorization(Constants.MainScope)
            .WithDescription("Add a new activity under project (M04)")
            .WithName(typeof(CreateActivityEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
@@ -25,6 +25,7 @@ public sealed class CreateProgrammeEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create programme")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateProgrammeEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -25,6 +25,7 @@ public class CreateProjectEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a new project (M04)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateProjectEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public class GetActivitiesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of activities for a project")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetActivitiesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Activity[]>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public class GetActivityEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Gets a specific activity by it's id")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetActivityEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Activity>(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class GetMilestoneEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Gets a specific milestone")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetMilestoneEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Milestone>(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public class GetMilestonesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of all milestones")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetMilestonesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Milestone[]>(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public sealed class GetProgrammeEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get specific programme")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProgrammeEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Programme>(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public sealed class GetProgrammeProjectsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Get a list of all projects under a programme")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProgrammeProjectsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Project[]>(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public sealed class GetProgrammesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of all programmes")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProgrammesEndpoint).ToEndpointName("Projects"))
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Programme[]>(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class GetProjectEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get project by ID")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProjectEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Project[]>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public class GetProjectIndicatorsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get get a detailed list of project indicators")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProjectIndicatorsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Indicator[]>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public class GetProjectMilestonesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of milestones for a project")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProjectMilestonesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Milestone[]>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public class GetProjectRisksEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of risks for a project")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProjectRisksEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Risk[]>(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public class GetProjectsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of projects")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProjectsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Project[]>(StatusCodes.Status200OK)
@@ -21,6 +21,7 @@ public sealed class UpdateMilestoneEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update project milestone details")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateMilestoneEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public sealed class UpdateProgrammeEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update existing programme")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateProgrammeEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public sealed class UpdateProjectEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update project details")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateProjectEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -24,6 +24,7 @@ public class UpdateProjectStatusEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update project status (M04)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateProjectStatusEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -22,6 +22,7 @@ public sealed class EncodeIdEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Hashes an int64 identifier")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(EncodeIdEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<string>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public sealed class GetUserEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Gets the metadata of a single user.")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetUserEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<User>(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public class GetUsersEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Paginated, searchable directory of system users. Supports filtering by ActivityStatus, searching by Email, and sorting")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetUsersEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<User[]>(StatusCodes.Status200OK)
@@ -30,6 +30,7 @@ public class SyncUserEndpoint : IEndpoint
            };
        })
        .WithDescription("Trigger integration and data synchronization in the background")
+        .RequireAuthorization(Constants.MainScope)
        .WithName(typeof(SyncUserEndpoint).ToEndpointName())
        .MapToApiVersion(new ApiVersion(1))
        .Produces(StatusCodes.Status200OK)
@@ -23,6 +23,7 @@ public sealed class UpdateUserStatusEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Changes the Activity status of the user in the system")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateUserStatusEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -91,11 +91,18 @@ builder.Services.AddOpenApi(options =>
    });
 });

-builder.Services.AddCors(options => options.AddPolicy("AllowFrontend", policy => 
-    policy.WithOrigins("https://localhost:3000", "https://localhost:8076", "https://console.ifri.khongisa.co.za")
-          .AllowAnyHeader()
-          .AllowAnyMethod()
-          .AllowCredentials()));
+var allowedOrigins = builder.Configuration.GetSection("CorsOrigins").Get<string[]>() ?? [];
+
+builder.Services.AddCors(options =>
+{
+    options.AddPolicy(CorsPolicy, policy =>
+    {
+        policy.WithOrigins(allowedOrigins)
+              .AllowAnyHeader()
+              .AllowAnyMethod()
+              .AllowCredentials();
+    });
+});

 var app = builder.Build();

@@ -107,10 +114,10 @@ if (!scheduler!.IsStarted)

 app.UseHsts();
 app.UseHttpsRedirection();
-
 app.UseRouting();
-app.UseCors("AllowFrontend");
+app.UseCors(CorsPolicy);
 app.UseOutputCache();
+
 app.UseAuthentication();
 app.UseAuthorization();

@@ -123,7 +130,7 @@ var versionGroups = new Dictionary<int, RouteGroupBuilder>
 {
    {
        1, app.MapGroup("v{version:apiVersion}").WithApiVersionSet(versionSet)
-            .RequireAuthorization("ApiScope").AddEndpointFilter<ActiveUserFilter>()
+            .RequireCors(CorsPolicy).AddEndpointFilter<ActiveUserFilter>()
    }
 };

@@ -1,21 +1,13 @@
 {
+  "CorsOrigins": [
+    "https://console.ifri.khongisa.co.za",
+    "https://localhost:7208"
+  ],
  "GeneralS3Settings": {
-    "ServiceUrl": "http://192.168.1.177:30900",
+    "ServiceUrl": "https://s3.garage.khongisa.co.za",
    "Region": "garage",
-    "BucketName": "pfm.general",
-    "CdnBaseUrl": "https://pfm.general.cdn.khongisa.co.za"
-  },
-  "ContractS3Settings": {
-    "ServiceUrl": "http://192.168.1.177:30900",
-    "Region": "garage",
-    "BucketName": "pfm.general",
-    "CdnBaseUrl": "https://pfm.general.cdn.khongisa.co.za"
-  },
-  "EvidenceS3Settings": {
-    "ServiceUrl": "http://192.168.1.177:30900",
-    "Region": "garage",
-    "BucketName": "pfm.general",
-    "CdnBaseUrl": "https://pfm.general.cdn.khongisa.co.za"
+    "BucketName": "pfm",
+    "CdnBaseUrl": "https://pfm.cdn.khongisa.co.za"
  },
  "Monitoring": {
    "Address": "http://aspire-dashboard-service.aspire.svc.cluster.local:18889",
@@ -10,14 +10,55 @@ public abstract class S3ServiceBase(IAmazonS3 amazonS3)
    protected abstract string BucketName { get; }
    protected abstract string CdnBaseUrl { get; }

-    public virtual async ValueTask<Result<string>> UploadFileAsync(string fileName, Stream fileStream, string contentType, CancellationToken cancellationToken = default) =>
+    public string GenerateCdnUrl(string fileKey) => $"{CdnBaseUrl}/{fileKey}";
+
+    public virtual async ValueTask<Result<string>> GeneratePresignedUrlAsync(string fileKey, TimeSpan duration, string? contentType = null, CancellationToken cancellationToken = default) =>
        await Result.Try((Func<ValueTask<Result<string>>>)(async () =>
        {
            if (string.IsNullOrWhiteSpace(BucketName))
-                return Result.Fail<string>(Domain.Errors.ValidationError.Create("Bucket name is not configured."));
+                return Result.Fail(ValidationError.Create("Bucket name is not configured."));
+
+            if (string.IsNullOrWhiteSpace(fileKey))
+                return Result.Fail(ValidationError.Create("File key is required."));
+
+            var request = new GetPreSignedUrlRequest
+            {
+                BucketName = BucketName,
+                Key = fileKey,
+                Expires = DateTime.UtcNow.Add(duration),
+                Verb = HttpVerb.GET
+            };
+
+            if (!string.IsNullOrWhiteSpace(contentType))
+            {
+                request.ResponseHeaderOverrides.ContentType = contentType;
+                request.ResponseHeaderOverrides.ContentDisposition = "inline";
+            }
+
+            var presignedUrl = await Client.GetPreSignedURLAsync(request);
+
+            return Result.FailIf(string.IsNullOrWhiteSpace(presignedUrl),
+                CreateError.Create("Failed to create presigned URL"))
+                    .ToResult(presignedUrl);
+        }));
+        
+    private static string CreateFileKey(string path, string fileName, string fileHash)
+    {
+        var cleanSubPath = path.Replace('\\', '/').Trim('/');
+
+        return string.IsNullOrWhiteSpace(cleanSubPath)
+            ? $"{fileHash.ToLower(CultureInfo.InvariantCulture)}_{fileName}"
+            : $"{cleanSubPath}/{fileHash.ToLower(CultureInfo.InvariantCulture)}_{fileName}";
+    }
+
+    public virtual async ValueTask<Result<string>> UploadFileAsync(string fileName, string subPath, Stream fileStream, string contentType, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<ValueTask<Result<string>>>)(async () =>
+        {
+            if (string.IsNullOrWhiteSpace(BucketName))
+                return Result.Fail<string>(ValidationError.Create("Bucket name is not configured."));

            if (string.IsNullOrWhiteSpace(CdnBaseUrl))
-                return Result.Fail<string>(Domain.Errors.ValidationError.Create("CDN base URL is not configured."));
+                return Result.Fail<string>(ValidationError.Create("CDN base URL is not configured."));

            await using var stream = new MemoryStream();

@@ -31,7 +72,7 @@ public abstract class S3ServiceBase(IAmazonS3 amazonS3)
            if (string.IsNullOrWhiteSpace(fileHash))
                return Result.Fail<string>(CreateError.Create("Failed to compute file hash."));

-            var fileKey = $"{fileHash.ToLower(CultureInfo.InvariantCulture)}{Path.GetExtension(fileName)}";
+            var fileKey = CreateFileKey(subPath, fileName, fileHash);

            var putRequest = new PutObjectRequest
            {
@@ -48,7 +89,7 @@ public abstract class S3ServiceBase(IAmazonS3 amazonS3)

            return response.HttpStatusCode != HttpStatusCode.OK
                ? Result.Fail<string>(CreateError.Create($"Failed to upload {fileName} to S3."))
-                : Result.Ok($"{CdnBaseUrl}/{fileKey}");
+                : Result.Ok(fileKey);
        }));

    public virtual async ValueTask<Result> DeleteFileAsync(string fileKey, CancellationToken cancellationToken = default) =>
@@ -63,7 +104,7 @@ public abstract class S3ServiceBase(IAmazonS3 amazonS3)
                Key = fileKey
            }, cancellationToken);

-            return Result.FailIf(response.HttpStatusCode == HttpStatusCode.NoContent, 
+            return Result.FailIf(response.HttpStatusCode == HttpStatusCode.NoContent,
                UpdateError.Create($"Failed to delete {fileKey} from S3."));
        }));
 }
@@ -27,4 +27,6 @@ public interface IEvidenceService
    ValueTask<Result<Evidence[]>> GetProjectEvidencesAsync(string projectIdHash, CancellationToken cancellationToken = default);

    ValueTask<Result> UpdateEvidenceAsync(UpdateEvidenceRequest request, Guid userId, CancellationToken cancellationToken = default);
+
+    ValueTask<Result<string>> GetEvidenceUrlAsync(string evidenceIdHash, CancellationToken cancellationToken = default);
 }
@@ -25,4 +25,10 @@ public interface IGrantsService
    ValueTask<Result> CreateBudgetAsync(CreateBudgetRequest request, Guid userId, CancellationToken cancellationToken = default);

    ValueTask<Result> CreateAwardAsync(CreateAwardRequest request, Guid userId, CancellationToken cancellationToken = default);
+
+    ValueTask<Result<string>> GetContractUrlAsync(string contractIdHash, CancellationToken cancellationToken = default);
+    
+    ValueTask<Result> UploadContractAsync(string contractIdHash, Guid userId, IFormFile file, CancellationToken cancellationToken = default);
+    
+    ValueTask<Result> UpdateContractAsync(UpdateContractRequest request, CancellationToken cancellationToken = default);
 }
@@ -25,40 +25,6 @@ public static class S3
            services.AddKeyedScoped<IS3Service, GeneralS3Service>(GeneralBucketName); 
        }

-        if (!string.IsNullOrWhiteSpace(configuration.GetSection($"{EvidenceS3SettingsSection}:ServiceUrl").Value))
-        {
-            services.AddKeyedSingleton<IAmazonS3, AmazonS3Client>(EvidenceBucketName, (provider, client) =>
-                new AmazonS3Client(new BasicAWSCredentials(configuration.GetSection($"{EvidenceS3SettingsSection}:AccessKey").Value,
-                configuration.GetSection($"{EvidenceS3SettingsSection}:SecretKey").Value),
-                new AmazonS3Config
-                {
-                    ServiceURL = configuration.GetSection($"{EvidenceS3SettingsSection}:ServiceUrl").Value,
-                    AuthenticationRegion = configuration.GetSection($"{EvidenceS3SettingsSection}:Region").Value,
-                    ForcePathStyle = true,
-                    EndpointDiscoveryEnabled = true,
-                    UseHttp = configuration.GetSection($"{EvidenceS3SettingsSection}:ServiceUrl").Value!.Contains("http://", StringComparison.InvariantCultureIgnoreCase),
-                }));
-
-            services.AddKeyedScoped<IS3Service, EvidenceS3Service>(EvidenceBucketName);
-        }
-
-        if (!string.IsNullOrWhiteSpace(configuration.GetSection($"{ContractS3SettingsSection}:ServiceUrl").Value))
-        {
-            services.AddKeyedSingleton<IAmazonS3, AmazonS3Client>(ContractBucketName, (provider, client) =>
-                new AmazonS3Client(new BasicAWSCredentials(configuration.GetSection($"{ContractS3SettingsSection}:AccessKey").Value,
-                configuration.GetSection($"{ContractS3SettingsSection}:SecretKey").Value),
-                new AmazonS3Config
-                {
-                    ServiceURL = configuration.GetSection($"{ContractS3SettingsSection}:ServiceUrl").Value,
-                    AuthenticationRegion = configuration.GetSection($"{ContractS3SettingsSection}:Region").Value,
-                    ForcePathStyle = true,
-                    EndpointDiscoveryEnabled = true,
-                    UseHttp = configuration.GetSection($"{ContractS3SettingsSection}:ServiceUrl").Value!.Contains("http://", StringComparison.InvariantCultureIgnoreCase),
-                }));
-
-            services.AddKeyedScoped<IS3Service, ContractS3Service>(ContractBucketName);
-        }
-
        return services;
    }
 }
@@ -1,5 +1,6 @@
 using PostFundManagement.Application.Services.Shared;
 using PostFundManagement.Domain.Security.Configuration;
+using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Security.Sdk;
 using PostFundManagement.Infrastructure.Database;

@@ -97,6 +98,7 @@ public static class Security
            options.Scope.Clear();
            options.Scope.Add("openid");
            options.Scope.Add("profile");
+            options.Scope.Add("role");
            options.Scope.Add("email");

            options.Events = new OpenIdConnectEvents
@@ -137,7 +139,7 @@ public static class Security
            {
                options.MapInboundClaims = false;
                options.Authority = authOptions.Authority;
-                options.Audience = authOptions.Audience;
+                options.Audience = authOptions.Audience;                

                options.TokenValidationParameters = new TokenValidationParameters
                {
@@ -149,7 +151,7 @@ public static class Security
            });

        services.AddAuthorizationBuilder()
-            .AddPolicy("ApiScope", policy =>
+            .AddPolicy(Constants.MainScope, policy =>
            {
                policy.RequireAuthenticatedUser();
                policy.RequireClaim("scope", authOptions.Audience!);
@@ -3,7 +3,7 @@ using static PostFundManagement.Domain.Extensions.Constants;

 namespace PostFundManagement.Application.Services.Communications;

-public record InviteRequest([Required] long OrganisationId,
+public sealed record InviteRequest([Required] long OrganisationId,
    [Required] long InvitedOrganisationId,
    [Required] long AwardId,
    [Required] long ContractId,
@@ -60,6 +60,27 @@ public sealed class EvidenceCacheService(EvidenceService service, IDistributedCa
            return Result.Ok(cached.FromJson<Domain.Models.Evidence[]>());
        }));

+    public async ValueTask<Result<string>> GetEvidenceUrlAsync(string evidenceIdHash, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<ValueTask<Result<string>>>)(async () =>
+        {
+            var cacheKey = HashService.ToMd5Hash($"getevidenceurl-{evidenceIdHash}").Value;
+
+            var cached = await cache.GetStringAsync(cacheKey, cancellationToken);
+
+            if (string.IsNullOrWhiteSpace(cached))
+            {
+                var result = await service.GetEvidenceUrlAsync(evidenceIdHash, cancellationToken);
+
+                if (result.IsFailed) return result;
+
+                await cache.SetStringAsync(cacheKey, result.Value, cancellationToken);
+
+                return result.Value;
+            }
+
+            return Result.Ok(cached);
+        }));
+
    public async ValueTask<Result<Indicator>> GetIndicatorAsync(string indicatorId, CancellationToken cancellationToken = default) =>
        await Result.Try((Func<ValueTask<Result<Indicator>>>)(async () =>
        {
@@ -10,7 +10,7 @@ using PostFundManagement.Infrastructure.Database;
 namespace PostFundManagement.Application.Services.Evidence;

 public sealed class EvidenceService(IDbContextFactory<ApplicationDbContext> contextFactory, HashService hashService,
-    [FromKeyedServices(Constants.EvidenceBucketName)] IS3Service s3Service) : IEvidenceService
+    [FromKeyedServices(Constants.GeneralBucketName)] IS3Service s3Service) : IEvidenceService
 {
    public async ValueTask<Result> CreateEvidenceAsync(Guid userId, IFormCollection form, IFormFile file, CancellationToken cancellationToken = default) =>
        await Result.Try((Func<ValueTask<Result>>)(async () =>
@@ -22,13 +22,12 @@ public sealed class EvidenceService(IDbContextFactory<ApplicationDbContext> cont

            await using var stream = file.OpenReadStream();

-            var uploadResult = await s3Service.UploadFileAsync(file.FileName, stream, file.ContentType, cancellationToken);
+            var uploadResult = await s3Service.UploadFileAsync(file.FileName, "evidence", stream, 
+                file.ContentType, cancellationToken);

            if (uploadResult.IsFailed)
                return Result.Fail(uploadResult.Errors);

-            var documentUrl = uploadResult.Value;
-
            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);

            var evidence = new Domain.Entities.Evidence
@@ -41,7 +40,7 @@ public sealed class EvidenceService(IDbContextFactory<ApplicationDbContext> cont
                CreatedAt = DateTime.UtcNow,
                Version = 1,
                Type = type,
-                DocumentUrl = documentUrl,
+                DocumentUrl = uploadResult.Value,
                Status = ApprovalStatus.Pending
            };

@@ -238,4 +237,31 @@ public sealed class EvidenceService(IDbContextFactory<ApplicationDbContext> cont

            return Result.OkIf(changedTotal > 0, UpdateError.New);
        }));
+
+    public async ValueTask<Result<string>> GetEvidenceUrlAsync(string evidenceIdHash, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<ValueTask<Result<string>>>)(async () =>
+        {
+            var decodeResult = hashService.DecodeLongIdHash(evidenceIdHash);
+
+            if (decodeResult.IsFailed)
+                return Result.Fail(IdDecodeError.Create()
+                    .CausedBy(decodeResult.Errors));
+
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            var evidence = await context.Evidences.AsNoTracking().FirstOrDefaultAsync(e => e.Id == decodeResult.Value, cancellationToken);
+
+            if (evidence is null)
+                return Result.Fail<string>(NotFoundError.New);
+
+            if (string.IsNullOrWhiteSpace(evidence.DocumentUrl))
+                return Result.Fail<string>(ValidationError.Create("Ecidence is invalid, has no saved documentUrl"));
+
+            var secureDownloadUrlResult = await s3Service.GeneratePresignedUrlAsync(evidence.DocumentUrl, 
+                TimeSpan.FromMinutes(15), null, cancellationToken);
+
+            return Result.OkIf(secureDownloadUrlResult.IsSuccess && !string.IsNullOrWhiteSpace(secureDownloadUrlResult.Value), 
+                NotFoundError.Create("Failed to generate secure file url"))
+                    .ToResult(secureDownloadUrlResult.Value);
+        }));
 }
@@ -3,19 +3,19 @@ using static PostFundManagement.Domain.Extensions.Constants;

 namespace PostFundManagement.Application.Services.Evidence;

-public record UpdateEvidenceRequest([Required] long EvidenceId, 
+public sealed record UpdateEvidenceRequest([Required] long EvidenceId, 
    [Required] int Version, 
    [Required] EvidenceType EvidenceType, 
    [Required] ApprovalStatus Status);

-public record RecordActualRequest([Required] decimal ActualAmount);
+public sealed record RecordActualRequest([Required] decimal ActualAmount);

-public record CreateMilestoneRequest([Required] long ProjectId, 
+public sealed record CreateMilestoneRequest([Required] long ProjectId, 
    [Required] DateTime DueAt, 
    [Required][MaxLength(LabelLength)] string Name, 
    [Required] Priority Priority);

-public record CreateIndicatorRequest([Required] long ProjectId, 
+public sealed record CreateIndicatorRequest([Required] long ProjectId, 
    [Required][MaxLength(LabelLength)] string Name, 
    [Required] UnitOfMeasure UnitOfMeasure, 
    [Required] decimal BaselineAmount, 
@@ -3,17 +3,17 @@ using static PostFundManagement.Domain.Extensions.Constants;

 namespace PostFundManagement.Application.Services.Execution;

-public record UpdateDisbursementRequest([Required] long DisbursementId, long? MilestoneId, [Required] decimal Amount);
+public sealed record UpdateDisbursementRequest([Required] long DisbursementId, long? MilestoneId, [Required] decimal Amount);

-public record UpdateRiskRequest([Required] long RiskId,
+public sealed record UpdateRiskRequest([Required] long RiskId,
    [Required] RiskLikelihood Likelihood,
    [Required] RiskImpact Impact,
    [Required][MaxLength(LabelLength)] string Name,
    [Required][MaxLength(TextLength)] string Description);

-public record CreateDisbursementRequest([Required] long ProjectId, long? MilestoneId, [Required] decimal Amount);
+public sealed record CreateDisbursementRequest([Required] long ProjectId, long? MilestoneId, [Required] decimal Amount);

-public record CreateRiskRequest([Required] long ProjectId,
+public sealed record CreateRiskRequest([Required] long ProjectId,
    [Required] RiskLikelihood Likelihood,
    [Required] RiskImpact Impact,
    [Required][MaxLength(LabelLength)] string Name,
@@ -3,28 +3,28 @@ using static PostFundManagement.Domain.Extensions.Constants;

 namespace PostFundManagement.Application.Services.Governance;

-public record UpdatePortfolioRequest([Required] long PortfolioId,
+public sealed record UpdatePortfolioRequest([Required] long PortfolioId,
    [Required][MaxLength(LabelLength)] string Name,
    [Required][MaxLength(TextLength)]  string Description, 
    [Required] Guid OwnerId);

-public record CreatePortfolioRequest([Required][MaxLength(LabelLength)] string Name,
+public sealed record CreatePortfolioRequest([Required][MaxLength(LabelLength)] string Name,
    [Required][MaxLength(TextLength)] string Description, 
    [Required] long OrganisationId,
    [Required] Guid OwnerId);

-public record UpdateOrganisationRequest([Required] long OrganisationId,
+public sealed record UpdateOrganisationRequest([Required] long OrganisationId,
    [Required][MaxLength(LabelLength)] string Name,
    [Required][MaxLength(LabelLength)] string RegistrationNo,
    [Required][EmailAddress][MaxLength(LabelLength)] string Email, 
    [Required] OrganisationType Type);

-public record CreateOrganisationRequest([Required][MaxLength(LabelLength)] string Name, 
+public sealed record CreateOrganisationRequest([Required][MaxLength(LabelLength)] string Name, 
    [Required][MaxLength(LabelLength)] string RegistrationNo, 
    [Required][EmailAddress][MaxLength(LabelLength)] string Email, 
    [Required] OrganisationType Type = OrganisationType.PrivateLimitedCompany);

-public record Dashboard([Required] decimal PortfolioValue,
+public sealed record Dashboard([Required] decimal PortfolioValue,
    [Required] int ActiveAwards,
    [Required] decimal Disbursed,
    [Required] double OnTrackPercentage,
@@ -146,4 +146,31 @@ public sealed class GrantsCacheService(GrantsService service, IDistributedCache

            return Result.Ok(cached.FromJson<Contract[]>());
        }));
+
+    public async ValueTask<Result<string>> GetContractUrlAsync(string contractIdHash, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<ValueTask<Result<string>>>)(async () =>
+        {
+            var cacheKey = HashService.ToMd5Hash($"getcontracturl-{contractIdHash}").Value;
+
+            var cached = await cache.GetStringAsync(cacheKey, cancellationToken);
+
+            if(string.IsNullOrWhiteSpace(cached))
+            {
+                var result = await service.GetContractUrlAsync(contractIdHash, cancellationToken);
+
+                if(result.IsFailed) return result;
+
+                await cache.SetStringAsync(cacheKey, result.Value, cancellationToken);
+
+                return result.Value;
+            }
+
+            return Result.Ok(cached!);
+        }));
+
+    public async ValueTask<Result> UpdateContractAsync(UpdateContractRequest request, CancellationToken cancellationToken = default) =>
+        await service.UpdateContractAsync(request, cancellationToken);
+
+    public async ValueTask<Result> UploadContractAsync(string contractIdHash, Guid userId, IFormFile file, CancellationToken cancellationToken = default) =>
+        await service.UploadContractAsync(contractIdHash, userId, file, cancellationToken);
 }
@@ -1,6 +1,7 @@
 using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Services.Shared;
 using PostFundManagement.Domain;
+using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
@@ -8,7 +9,8 @@ using PostFundManagement.Infrastructure.Database;

 namespace PostFundManagement.Application.Services.Grants;

-public sealed class GrantsService(IDbContextFactory<ApplicationDbContext> contextFactory, HashService hashService) : IGrantsService
+public sealed class GrantsService(IDbContextFactory<ApplicationDbContext> contextFactory, HashService hashService,
+    [FromKeyedServices(Constants.GeneralBucketName)] IS3Service s3Service) : IGrantsService
 {
    public async ValueTask<Result<Contract[]>> GetContractsAsync(Pagination pagination, CancellationToken cancellationToken = default) =>
        await Result.Try((Func<ValueTask<Result<Contract[]>>>)(async () =>
@@ -201,4 +203,73 @@ public sealed class GrantsService(IDbContextFactory<ApplicationDbContext> contex

            return Result.OkIf(await context.SaveChangesAsync(cancellationToken) > 0, CreateError.New);
        }));
+
+    public async ValueTask<Result<string>> GetContractUrlAsync(string contractIdHash, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<ValueTask<Result<string>>>)(async () =>
+        {
+            var decodeResult = hashService.DecodeLongIdHash(contractIdHash);
+
+            if (decodeResult.IsFailed)
+                return Result.Fail(IdDecodeError.Create()
+                    .CausedBy(decodeResult.Errors));
+
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            var contract = await context.Contracts.AsNoTracking().FirstOrDefaultAsync(e => e.Id == decodeResult.Value, cancellationToken);
+
+            if (contract is null)
+                return Result.Fail<string>(NotFoundError.New);
+
+            if (string.IsNullOrWhiteSpace(contract.SignedDocumentUrl))
+                return Result.Fail<string>(ValidationError.Create("Ecidence is invalid, has no saved documentUrl"));
+
+            var secureDownloadUrlResult = await s3Service.GeneratePresignedUrlAsync(contract.SignedDocumentUrl,
+                TimeSpan.FromMinutes(15), null, cancellationToken);
+
+            return Result.OkIf(secureDownloadUrlResult.IsSuccess && !string.IsNullOrWhiteSpace(secureDownloadUrlResult.Value),
+                NotFoundError.Create("Failed to generate secure file url"))
+                    .ToResult(secureDownloadUrlResult.Value);
+        }));
+
+    public async ValueTask<Result> UploadContractAsync(string contractIdHash, Guid userId, IFormFile file, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<ValueTask<Result>>)(async () =>
+        {
+            var decodeResult = hashService.DecodeLongIdHash(contractIdHash);
+
+            if (decodeResult.IsFailed)
+                return Result.Fail(IdDecodeError.Create()
+                    .CausedBy(decodeResult.Errors));
+
+            await using var stream = file.OpenReadStream();
+
+            var uploadResult = await s3Service.UploadFileAsync(file.FileName, "contracts", stream,
+                file.ContentType, cancellationToken);
+
+            if (uploadResult.IsFailed)
+                return Result.Fail(uploadResult.Errors);
+
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            var changedTotal = await context.Contracts.Where(c => c.Id == decodeResult.Value)
+                .ExecuteUpdateAsync(f => f
+                    .SetProperty(c => c.SignedDocumentUrl, uploadResult.Value), cancellationToken);
+
+            var secureDownloadUrlResult = await s3Service.GeneratePresignedUrlAsync(uploadResult.Value,
+                TimeSpan.FromMinutes(15), null, cancellationToken);
+
+            return Result.OkIf(changedTotal > 0 && secureDownloadUrlResult.IsSuccess && !string.IsNullOrWhiteSpace(secureDownloadUrlResult.Value), 
+                CreateError.Create("Failed to upload contract file"));
+        }));
+
+    public async ValueTask<Result> UpdateContractAsync(UpdateContractRequest request, CancellationToken cancellationToken = default) =>
+        await Result.Try((Func<ValueTask<Result>>)(async () =>
+        {
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            var changedTotal = await context.Contracts.Where(c => c.Id == request.ContractId)
+                .ExecuteUpdateAsync(f => f
+                    .SetProperty(u => u.Status, request.Status), cancellationToken);
+
+            return Result.OkIf(changedTotal > 0, UpdateError.Create("Failed to update the contract."));
+        }));
 }
@@ -1,18 +1,21 @@
-using static PostFundManagement.Domain.Extensions.Constants;
+using PostFundManagement.Domain;
+using static PostFundManagement.Domain.Extensions.Constants;

 namespace PostFundManagement.Application.Services.Grants;

-public record CreateAwardRequest([Required] long OrganisationId, [Required] long ProgrammeId, [Required] decimal Amount);
+public sealed record UpdateContractRequest([Required] long ContractId, [Required] ContractStatus Status);

-public record CreateBudgetRequest([Required] long ProjectId, 
+public sealed record CreateAwardRequest([Required] long OrganisationId, [Required] long ProgrammeId, [Required] decimal Amount);
+
+public sealed record CreateBudgetRequest([Required] long ProjectId, 
    [Required][MaxLength(LabelLength)] string Name, 
    [Required] decimal Amount);

-public record CreateContractRequest([Required] long AwardId, 
+public sealed record CreateContractRequest([Required] long AwardId, 
    [Required] decimal TotalValue, 
    [Required] DateTime EffectiveAt, 
    [Required] DateTime ExpiresAt);

-public record ExecuteContractRequest([Required] long ContractId, 
+public sealed record ExecuteContractRequest([Required] long ContractId, 
    [Required][MaxLength(LabelLength)] string ExternalSignatureId, 
    [Required][MaxLength(LabelLength)] string SignedDocumentUrl);
@@ -3,35 +3,35 @@ using static PostFundManagement.Domain.Extensions.Constants;

 namespace PostFundManagement.Application.Services.Projects;

-public record UpdateProgrammeRequest([Required] long ProgrammeId,
+public sealed record UpdateProgrammeRequest([Required] long ProgrammeId,
    [Required][MaxLength(LabelLength)] string Name, 
    [Required] Guid OwnerId, 
    [Required] ApprovalStatus Status);

-public record CreateProgrammeRequest(long PortfolioId, string Name, Guid OwnerId);
+public sealed record CreateProgrammeRequest(long PortfolioId, string Name, Guid OwnerId);

-public record UpdateProjectRequest([Required] long ProjectId, 
+public sealed record UpdateProjectRequest([Required] long ProjectId, 
    [Required][MaxLength(LabelLength)] string Name,
    [Required][MaxLength(TextLength)] string Description, 
    DateTime? StartedAt, DateTime? EndedAt, 
    [Required] IndustrySector Sector, 
    [Required] ProjectType ProjectType);

-public record UpdateMilestoneRequest([Required] long MilestoneId, 
+public sealed record UpdateMilestoneRequest([Required] long MilestoneId, 
    [Required] DateTime DueAt,
    [Required][MaxLength(LabelLength)] string Name, 
    [Required] Priority Priority, 
    [Required] ApprovalStatus Status);

-public record UpdateProjectStatusRequest([Required] long ProjectId, [Required] ApprovalStatus Status);
+public sealed record UpdateProjectStatusRequest([Required] long ProjectId, [Required] ApprovalStatus Status);

-public record CreateProjectRequest([Required] long ProgrammeId,
+public sealed record CreateProjectRequest([Required] long ProgrammeId,
    [Required][MaxLength(LabelLength)] string Name,
    [Required][MaxLength(TextLength)] string Description, 
    [Required] IndustrySector Sector, 
    [Required] ProjectType ProjectType);

-public record CreateActivityRequest([Required] long ProjectId, 
+public sealed record CreateActivityRequest([Required] long ProjectId, 
    [Required] long? MilestoneId,
    [Required][MaxLength(LabelLength)] string Category, 
    [Required] decimal Amount,
@@ -1,12 +0,0 @@
-using PostFundManagement.Application.Abstractions;
-using PostFundManagement.Domain.Abstractions;
-using static PostFundManagement.Domain.Extensions.Constants;
-
-namespace PostFundManagement.Application.Services.Shared;
-
-public sealed class ContractS3Service(IConfiguration configuration, [FromKeyedServices(ContractBucketName)] IAmazonS3 amazonS3) :
-    S3ServiceBase(amazonS3), IS3Service
-{
-    protected override string BucketName => configuration.GetSection($"{ContractS3SettingsSection}:BucketName").Value ?? string.Empty;
-    protected override string CdnBaseUrl => configuration.GetSection($"{ContractS3SettingsSection}:CdnBaseUrl").Value ?? string.Empty;
-}
@@ -1,12 +0,0 @@
-using PostFundManagement.Application.Abstractions;
-using PostFundManagement.Domain.Abstractions;
-using static PostFundManagement.Domain.Extensions.Constants;
-
-namespace PostFundManagement.Application.Services.Shared;
-
-public sealed class EvidenceS3Service(IConfiguration configuration, [FromKeyedServices(EvidenceBucketName)] IAmazonS3 amazonS3) :
-    S3ServiceBase(amazonS3), IS3Service
-{
-    protected override string BucketName => configuration.GetSection($"{EvidenceS3SettingsSection}:BucketName").Value ?? string.Empty;
-    protected override string CdnBaseUrl => configuration.GetSection($"{EvidenceS3SettingsSection}:CdnBaseUrl").Value ?? string.Empty;
-}
@@ -2,4 +2,4 @@

 namespace PostFundManagement.Application.Services.Users;

-public record UserFilterRequest(ActivityStatus? Status = null, string? Email = null, string? SortBy = null, bool SortDescending = false);
+public sealed record UserFilterRequest(ActivityStatus? Status = null, string? Email = null, string? SortBy = null, bool SortDescending = false);
@@ -6,13 +6,13 @@ WORKDIR /app
 # Enable corepack to use Yarn
 RUN corepack enable

-# Copy dependency definitions from the subdirectory
+# Copy dependency definitions from the UI subdirectory into the container's /app folder
 COPY PostFundManagement.ConsoleUI/package*.json PostFundManagement.ConsoleUI/yarn.lock* ./

 # Install dependencies via Yarn
 RUN yarn install --frozen-lockfile || yarn install

-# Copy application source from the subdirectory
+# Copy application source from the UI subdirectory into the container's /app folder
 COPY PostFundManagement.ConsoleUI/ ./

 # Build Vite application for production
@@ -38,4 +38,4 @@ EXPOSE 3000

 # Set entrypoint and default command
 ENTRYPOINT ["/docker-entrypoint.sh"]
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["nginx", "-g", "daemon off;"]
@@ -17,7 +17,7 @@ export interface AppConfig {
 export const defaultSecuritySettings: SecuritySettings = {
    Authority: (import.meta.env.VITE_OIDC_AUTHORITY as string) || 'https://sts.security.khongisa.co.za',
    Audience: (import.meta.env.VITE_OIDC_AUDIENCE as string) || 'pfm-api-dev',
-    ClientId: (import.meta.env.VITE_OIDC_CLIENT_ID as string) || 'pfm-admin-dev',
+    ClientId: (import.meta.env.VITE_OIDC_CLIENT_ID as string) || 'pfm-console-dev',
    ClientSecret: (import.meta.env.VITE_OIDC_CLIENT_SECRET as string) || 'secret_dcaeaa28097d9ba5b06ec324d9eac9d9c81de96e0a203cf2c6154c6dd7c89e94',
 };

@@ -2,6 +2,8 @@ namespace PostFundManagement.Domain.Abstractions;

 public interface IS3Service
 {
-    ValueTask<Result<string>> UploadFileAsync(string fileName, Stream fileStream, string contentType, CancellationToken cancellationToken = default);
+    string GenerateCdnUrl(string fileKey);
+    ValueTask<Result<string>> GeneratePresignedUrlAsync(string fileKey, TimeSpan duration, string? contentType = null, CancellationToken cancellationToken = default);    
+    ValueTask<Result<string>> UploadFileAsync(string fileName, string subPath, Stream fileStream, string contentType, CancellationToken cancellationToken = default);
    ValueTask<Result> DeleteFileAsync(string fileKey, CancellationToken cancellationToken = default);
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
khwezi	f200ccbf60	Merge pull request 'Added RequireCors() to RouteGroup' (#76 ) from garages3 into main Reviewed-on: #76	2026-09-15 08:45:25 +02:00
hermes	464c21e41d	Added RequireCors() to RouteGroup	2026-09-15 08:44:43 +02:00
khwezi	27f57150e1	Merge pull request 'Moved .RequireAuthentication() to endpoints, removed it from EndpointGroup' (#75 ) from garages3 into main Reviewed-on: #75	2026-09-15 08:37:43 +02:00
hermes	364fe65e0d	Moved .RequireAuthentication() to endpoints, removed it from EndpointGroup	2026-09-15 08:37:08 +02:00
khwezi	79c63107e9	Merge pull request 'Applied configurable CORS policy to API' (#74 ) from garages3 into main Reviewed-on: #74	2026-09-15 07:30:29 +02:00
hermes	b239c402fa	Applied configurable CORS policy to API	2026-09-15 07:29:58 +02:00
khwezi	d945731252	Merge pull request 'Fixed UI' (#73 ) from garages3 into main Reviewed-on: #73	2026-09-14 11:44:00 +02:00
hermes	f4a1064003	Fixed UI	2026-09-14 11:43:09 +02:00
khwezi	c979a4632e	Merge pull request 'Debug refactor' (#72 ) from garages3 into main Reviewed-on: #72	2026-09-14 10:46:59 +02:00
hermes	5f18478675	Debug refactor	2026-09-14 10:46:21 +02:00
khwezi	9eed3cff6b	Merge pull request 'Debugs refactor' (#71 ) from garages3 into main Reviewed-on: #71	2026-09-14 10:39:04 +02:00
hermes	e71ba99f9c	Debugs refactor	2026-09-14 10:38:25 +02:00
khwezi	6db1a2f367	Merge pull request 'Garages3' (#70 ) from garages3 into main Reviewed-on: #70	2026-09-14 10:34:46 +02:00
hermes	8de761e4e6	Fixed base image .net versions	2026-09-14 10:34:09 +02:00
hermes	ca6d04d528	Debug refactor	2026-09-14 10:33:18 +02:00
khwezi	06d9952cd7	Merge pull request 'Rebuilt pfm-api dockerfile' (#69 ) from garages3 into main Reviewed-on: #69	2026-09-14 10:29:13 +02:00
hermes	f607eaf152	Rebuilt pfm-api dockerfile	2026-09-14 10:28:48 +02:00
khwezi	92d481f75d	Merge pull request 'Light refactor' (#68 ) from garages3 into main Reviewed-on: #68	2026-09-14 10:23:19 +02:00
hermes	b631c6aa4b	Light refactor	2026-09-14 10:22:56 +02:00
khwezi	1c36602995	Merge pull request 'Simplified fpm-api dockerfile' (#67 ) from garages3 into main Reviewed-on: #67	2026-09-14 10:21:10 +02:00
hermes	cb59635882	Simplified fpm-api dockerfile	2026-09-14 10:20:42 +02:00
khwezi	5ae0c500ac	Merge pull request 'Added debug code' (#66 ) from garages3 into main Reviewed-on: #66	2026-09-14 10:13:58 +02:00
hermes	1cf019b3b9	Added debug code	2026-09-14 10:13:31 +02:00
khwezi	db04f800e9	Merge pull request 'Changed pfm-api dockerfile paths' (#65 ) from garages3 into main Reviewed-on: #65	2026-09-14 10:10:49 +02:00
hermes	0a4108d345	Changed pfm-api dockerfile paths	2026-09-14 10:10:12 +02:00
khwezi	e7a19611f0	Merge pull request 'Simplified dockerfile (pfm-api)' (#64 ) from garages3 into main Reviewed-on: #64	2026-09-14 10:04:10 +02:00
hermes	afaad43c47	Simplified dockerfile (pfm-api)	2026-09-14 10:03:45 +02:00
khwezi	5ad24da7cf	Merge pull request 'Refactored compose file to assign same context to both services' (#63 ) from garages3 into main Reviewed-on: #63	2026-09-14 10:02:01 +02:00
hermes	bccdab2ba8	Refactored compose file to assign same context to both services	2026-09-14 10:01:19 +02:00
khwezi	156dae40b7	Merge pull request 'Fixed missing file copy' (#62 ) from garages3 into main Reviewed-on: #62	2026-09-14 09:50:32 +02:00
hermes	5bdd2a5786	Fixed missing file copy	2026-09-14 09:50:03 +02:00
khwezi	1b67d9cf8b	Merge pull request 'Debug refactor on dockerfile' (#61 ) from garages3 into main Reviewed-on: #61	2026-09-14 09:47:00 +02:00
hermes	1acdb0ea7b	Debug refactor on dockerfile	2026-09-14 09:46:34 +02:00
khwezi	1bd05e64e5	Merge pull request 'Added better dotnet build handling' (#60 ) from garages3 into main Reviewed-on: #60	2026-09-14 09:42:10 +02:00
hermes	2047e440d8	Added better dotnet build handling	2026-09-14 09:41:47 +02:00
khwezi	303dba3c6f	Merge pull request 'Added more verbosity to dotnet build' (#59 ) from garages3 into main Reviewed-on: #59	2026-09-14 09:35:30 +02:00
hermes	1771d74b43	Added more verbosity to dotnet build	2026-09-14 09:35:03 +02:00
khwezi	1dd4f54a1d	Merge pull request 'Added .dockerignore' (#58 ) from garages3 into main Reviewed-on: #58	2026-09-14 09:32:21 +02:00
hermes	bad91e8090	Added .dockerignore	2026-09-14 09:25:46 +02:00
khwezi	fae1e080c4	Merge pull request 'Added stream redirection to dotnet commands' (#57 ) from garages3 into main Reviewed-on: #57	2026-09-14 09:14:17 +02:00
hermes	f9c0c5fe16	Added stream redirection to dotnet commands	2026-09-14 09:13:46 +02:00
khwezi	4de23d27b3	Merge pull request 'Commented out pfm-console to see if the api image will build' (#56 ) from garages3 into main Reviewed-on: #56	2026-09-14 09:06:50 +02:00
hermes	43c777dfe2	Commented out pfm-console to see if the api image will build	2026-09-14 09:06:15 +02:00
khwezi	d4bce12dbb	Merge pull request 'Removed stream redirection' (#55 ) from garages3 into main Reviewed-on: #55	2026-09-13 18:15:33 +02:00
hermes	5dba8d3dd4	Removed stream redirection	2026-09-13 18:15:16 +02:00
khwezi	299b876e1c	Merge pull request 'Fixed Api docker file paths' (#54 ) from garages3 into main Reviewed-on: #54	2026-09-13 18:13:13 +02:00
hermes	0d78affd3c	Fixed Api docker file paths	2026-09-13 18:12:49 +02:00
khwezi	dde1dbe056	Merge pull request 'Added debug code to dotnet build and publish lines' (#53 ) from garages3 into main Reviewed-on: #53	2026-09-13 18:09:51 +02:00
hermes	4bac2f58c2	Added debug code to dotnet build and publish lines	2026-09-13 18:09:38 +02:00
khwezi	b81e6feb45	Merge pull request 'Moved api dockerfile to project folder' (#52 ) from garages3 into main Reviewed-on: #52	2026-09-13 18:07:52 +02:00
hermes	2a8d72963d	Moved api dockerfile to project folder	2026-09-13 18:07:32 +02:00
khwezi	4138a1941f	Merge pull request 'Corrected compose service contexts' (#51 ) from garages3 into main Reviewed-on: #51	2026-09-13 18:01:52 +02:00
hermes	4b658bdfd5	Corrected compose service contexts	2026-09-13 18:01:31 +02:00
khwezi	17af31d810	Merge pull request 'Fixed dockerfile paths' (#50 ) from garages3 into main Reviewed-on: #50	2026-09-13 17:56:19 +02:00
hermes	9945b773db	Fixed dockerfile paths	2026-09-13 17:55:57 +02:00
khwezi	b85cf6a1cb	Merge pull request 'Light refactor' (#49 ) from garages3 into main Reviewed-on: #49	2026-09-13 17:51:45 +02:00
hermes	f98b102a2e	Light refactor	2026-09-13 17:51:25 +02:00
khwezi	81ddc11746	Merge pull request 'Refactored API dockerfile' (#48 ) from garages3 into main Reviewed-on: #48	2026-09-13 17:50:29 +02:00
hermes	f29ac65d7c	Refactored API dockerfile	2026-09-13 17:50:08 +02:00
khwezi	5b94672ff5	Merge pull request 'Stable API run' (#47 ) from garages3 into main Reviewed-on: #47	2026-09-13 17:41:42 +02:00
hermes	8450db51be	Stable API run	2026-09-13 17:39:29 +02:00
khwezi	c535392ef1	Merge pull request 'Added debug term' (#46 ) from garages3 into main Reviewed-on: #46	2026-09-12 12:22:43 +02:00
hermes	5c1e18a9a9	Added debug term	2026-09-12 12:22:24 +02:00
khwezi	0607de1802	Merge pull request 'Second fix' (#45 ) from garages3 into main Reviewed-on: #45	2026-09-12 12:19:34 +02:00
hermes	4f1b05bf33	Second fix	2026-09-12 12:19:15 +02:00
khwezi	4c1e52e452	Merge pull request 'Light refactor' (#44 ) from garages3 into main Reviewed-on: #44	2026-09-12 12:14:13 +02:00
hermes	3db6546a2b	Light refactor	2026-09-12 12:13:52 +02:00
khwezi	2414d74d1c	Merge pull request 'Light refactor' (#43 ) from garages3 into main Reviewed-on: #43	2026-09-12 12:10:17 +02:00
hermes	e270bf8db2	FROM fix	2026-09-12 12:09:58 +02:00
hermes	48dd9aaa1d	Light refactor	2026-09-12 12:08:55 +02:00
khwezi	93d9661a7f	Merge pull request 'Rewrite pfm-api docker file' (#42 ) from garages3 into main Reviewed-on: #42	2026-09-12 12:04:47 +02:00
hermes	3fa9f257ba	Rewrite pfm-api docker file	2026-09-12 12:04:23 +02:00
khwezi	dba401fe94	Merge pull request 'Fixed publish alias' (#41 ) from garages3 into main Reviewed-on: #41	2026-09-12 11:58:37 +02:00
hermes	12663a588f	Fixed publish alias	2026-09-12 11:57:58 +02:00
khwezi	42d73fe6cb	Merge pull request 'Added error output to dotnet build line' (#40 ) from garages3 into main Reviewed-on: #40	2026-09-12 11:54:57 +02:00
hermes	4738a20f80	Added error output to dotnet build line	2026-09-12 11:54:36 +02:00
khwezi	1475887a7f	Merge pull request 'Added working directory switch' (#39 ) from garages3 into main Reviewed-on: #39	2026-09-12 11:49:52 +02:00
hermes	7446659c0c	Added working directory switch	2026-09-12 11:49:26 +02:00
khwezi	730664d9c4	Merge pull request 'PFM Api docker refactor' (#38 ) from garages3 into main Reviewed-on: #38	2026-09-12 11:45:32 +02:00
hermes	e0b1b00f63	PFM Api docker refactor	2026-09-12 11:45:07 +02:00
khwezi	f38e569a34	Merge pull request 'Implemented missing file handling endpoints' (#37 ) from garages3 into main Reviewed-on: #37	2026-09-12 11:26:45 +02:00
hermes	1c1e2b9038	Implemented missing file handling endpoints Added contract update endpoint	2026-09-12 11:26:04 +02:00
khwezi	7e79171f97	Merge pull request 'Added image name to compose file for console' (#36 ) from endpoints into main Reviewed-on: #36	2026-09-11 16:24:11 +02:00
khwezi	d7b868f2c1	Merge pull request 'Added more cors origins' (#35 ) from endpoints into main Reviewed-on: #35	2026-09-11 16:17:07 +02:00
khwezi	d43a09b371	Merge pull request 'Refactored console dockerfile' (#34 ) from endpoints into main Reviewed-on: #34	2026-09-11 16:05:21 +02:00
khwezi	0dc0de1502	Merge pull request 'Fixed dockerfile paths' (#33 ) from endpoints into main Reviewed-on: #33	2026-09-11 15:47:30 +02:00
khwezi	de47dd4a4f	Merge pull request 'Supplied defaults to compose env variables' (#32 ) from endpoints into main Reviewed-on: #32	2026-09-11 15:33:47 +02:00
khwezi	2810cc669b	Merge pull request 'Fixed compose syntax error' (#31 ) from endpoints into main Reviewed-on: #31	2026-09-11 15:30:40 +02:00
khwezi	734af8c86f	Merge pull request 'Refactored compose file to include the ui in deployment' (#30 ) from endpoints into main Reviewed-on: #30	2026-09-11 15:29:21 +02:00
khwezi	a754c42d14	Merge pull request 'Updated Console compose file to use variables' (#29 ) from endpoints into main Reviewed-on: #29	2026-09-11 15:19:31 +02:00
khwezi	bd7ca9372f	Merge pull request 'Added specific origin' (#28 ) from endpoints into main Reviewed-on: #28	2026-09-11 14:59:34 +02:00
khwezi	0d01d91ab4	Merge pull request 'Added cors after routes' (#27 ) from endpoints into main Reviewed-on: #27	2026-09-11 14:54:47 +02:00
khwezi	2c817a8818	Merge pull request 'Endpoints' (#26 ) from endpoints into main Reviewed-on: #26	2026-09-11 14:35:02 +02:00
khwezi	4c3a96917b	Merge pull request 'Improved results handling in service layer' (#25 ) from endpoints into main Reviewed-on: #25	2026-09-11 10:33:47 +02:00
khwezi	e5c3a75795	Merge pull request 'Stable run with validations' (#24 ) from endpoints into main Reviewed-on: #24	2026-09-06 10:49:57 +02:00
khwezi	1bc7e65960	Merge pull request 'Added tooling' (#23 ) from endpoints into main Reviewed-on: #23	2026-09-05 18:27:35 +02:00
khwezi	094126d84b	Merge pull request 'Fixed endpointname uniqueness' (#22 ) from endpoints into main Reviewed-on: #22	2026-09-05 13:07:41 +02:00
khwezi	2506241a25	Merge pull request 'Fixed endpoint uniqueness' (#21 ) from endpoints into main Reviewed-on: #21	2026-09-05 12:58:17 +02:00
khwezi	cfe3530639	Merge pull request 'Endpoints' (#20 ) from endpoints into main Reviewed-on: #20	2026-09-05 12:50:04 +02:00
khwezi	985557bee4	Merge pull request 'Implemented caching on all get endpoints and service layer' (#19 ) from endpoints into main Reviewed-on: #19	2026-09-05 08:30:16 +02:00
khwezi	f0b8b3051a	Merge pull request 'Improved getusers cache key' (#18 ) from endpoints into main Reviewed-on: #18	2026-09-04 06:08:39 +02:00
khwezi	6c88b9e533	Merge pull request 'Endpoints' (#17 ) from endpoints into main Reviewed-on: #17	2026-09-04 05:54:30 +02:00
khwezi	7d67408d2c	Merge pull request 'Additional redis configs' (#16 ) from endpoints into main Reviewed-on: #16	2026-09-04 05:39:44 +02:00
khwezi	d1d58a6183	Merge pull request 'Added service level caching to IdentityService, Communication and Evidence' (#15 ) from endpoints into main Reviewed-on: #15	2026-09-03 16:38:08 +02:00
khwezi	60ad154841	Merge pull request 'Implemented distributed caching' (#14 ) from endpoints into main Reviewed-on: #14	2026-09-03 11:09:52 +02:00
khwezi	2c13170859	Merge pull request 'Endpoints' (#13 ) from endpoints into main Reviewed-on: #13	2026-09-02 16:14:34 +02:00
khwezi	d87c8aa3c9	Merge pull request 'Updated configurations' (#12 ) from endpoints into main Reviewed-on: #12	2026-09-02 09:45:38 +02:00
khwezi	6af7815ad1	Merge pull request 'Removed node tooling install' (#11 ) from endpoints into main Reviewed-on: #11	2026-09-02 09:30:06 +02:00
khwezi	a169f6c3f6	Merge pull request 'Endpoints' (#10 ) from endpoints into main Reviewed-on: #10	2026-09-02 09:28:17 +02:00
khwezi	65ea753c19	Merge pull request 'Endpoints' (#9 ) from endpoints into main Reviewed-on: #9	2026-09-01 12:29:47 +02:00
khwezi	e6d2663265	Merge pull request 'Endpoints' (#8 ) from endpoints into main Reviewed-on: #8	2026-08-30 17:47:24 +02:00
khwezi	91b5814b60	Merge pull request 'Endpoints' (#7 ) from endpoints into main Reviewed-on: #7	2026-08-30 16:27:37 +02:00
khwezi	0c4c848568	Merge pull request 'Endpoints' (#6 ) from endpoints into main Reviewed-on: #6	2026-08-30 16:11:53 +02:00
khwezi	fb05150ebf	Merge pull request 'Endpoints' (#5 ) from endpoints into main Reviewed-on: #5	2026-08-30 15:47:32 +02:00
khwezi	2f9c20020b	Merge pull request 'Reogranised API and Security assets' (#4 ) from endpoints into main Reviewed-on: #4	2026-08-30 15:09:32 +02:00
khwezi	a771957db3	Merge pull request 'Endpoints' (#3 ) from endpoints into main Reviewed-on: #3	2026-08-30 14:54:58 +02:00
khwezi	46267a2a34	Merge pull request 'Endpoints' (#2 ) from endpoints into main Reviewed-on: #2	2026-08-30 14:26:08 +02:00
khwezi	a7f360cc2a	Merge pull request 'Security' (#1 ) from security into main Reviewed-on: #1	2026-08-21 11:47:36 +02:00
hermes	67c08b40ca	Refactored gitignore	2026-08-21 11:45:33 +02:00