Merge pull request 'Endpoints' (#5) from endpoints into main

Reviewed-on: #5

.dockerignore

@@ -1,21 +0,0 @@
-# Exclude build output and caches
-**/bin/
-**/obj/
-**/out/
-.vs/
-.vscode/
-
-# Exclude git internal files
-.git/
-.gitignore
-
-# Exclude local environment/secret files
-.env
-*.env
-*.user
-*.suo
-
-# Exclude node modules and temporary logs
-**/node_modules/
-**/dist/
-*.log

.editorconfig

@@ -43,9 +43,6 @@ dotnet_diagnostic.MA0004.severity = none
 [**/*{Enums,Records}.cs]
 dotnet_diagnostic.MA0048.severity = none
 
-[*.{cs,vb}]
-dotnet_diagnostic.IDE0039.severity = none
-
 #### Core EditorConfig Options ####
 
 # Indentation and spacing

.gitignore

@@ -11,8 +11,6 @@
 *.sln.docstates
 *.env
 *.env.json
-certificates/
-package-lock.json
 
 # User-specific files (MonoDevelop/Xamarin Studio)
 *.userprefs
@@ -53,8 +51,6 @@ bld/
 
 # Build results on 'Bin' directories
 **/[Bb]in/*
-dist/assets/
-dist/
 # Uncomment if you have tasks that rely on *.refresh files to move binaries
 # (https://github.com/github/gitignore/pull/3736)
 #!**/[Bb]in/*.refresh
@@ -62,7 +58,8 @@ dist/
 # Visual Studio 2015/2017 cache/options directory
 .vs/
 .vscode/
-
+bin/
+certificates/
 # Uncomment if you have tasks that create the project's static files in wwwroot
 #wwwroot/
 
@@ -350,7 +347,6 @@ _Pvt_Extensions
 
 # Paket dependency manager
 **/.paket/paket.exe
-**/.paket/paket.exe
 paket-files/
 
 # FAKE - F# Make
@@ -436,9 +432,3 @@ FodyWeavers.xsd
 *.msix
 *.msm
 *.msp
-/PostFundManagement.ConsoleUI/dist/config.json
-/PostFundManagement.ConsoleUI/dist/env-config.js
-/PostFundManagement.ConsoleUI/dist/assets/index-BaOzkVJi.css
-/PostFundManagement.ConsoleUI/dist/assets/index-BU8qSe7k.js
-/PostFundManagement.ConsoleUI/dist/favicon.svg
-/PostFundManagement.ConsoleUI/dist/index.html

Architecture.md

@@ -1,192 +0,0 @@
-# PostFundManagement (PFM) Platform — Architectural Specification
-
-> **Document Version**: 2.0  
-> **Target Runtimes**: .NET 10.0 (C# 13) | React 19 / TypeScript 5.8 / Vite  
-> **Scope**: System Architecture, Security Topology, RBAC Enforcement, and Maker-Checker Pattern
-
----
-
-## 1. System Topology & Architectural Layers
-
-The PFM platform is constructed using **Clean Architecture** and **Domain-Driven Design (DDD)** principles to guarantee strict decoupling of business rules, persistence concerns, and user interfaces.
-
-```
-┌────────────────────────────────────────────────────────────────────────┐
-│                          PRESENTATION TIER                             │
-│  PostFundManagement.ConsoleUI      │  PostFundManagement.PartnerUI     │
-│  (Internal Staff & Governance)     │  (External Recipient Portal)      │
-│  React 19 + TypeScript + Vite      │  React 19 + WebGL (OGL) + Vite    │
-└───────────────────────────────────┬────────────────────────────────────┘
-                                    │ HTTPS / REST (v1/api/*) + OIDC PKCE
-┌───────────────────────────────────▼────────────────────────────────────┐
-│                             API GATEWAY                                │
-│  PostFundManagement.Api (ASP.NET Core Minimal APIs / Carter)           │
-│  Authentication: JWT Bearer + OpenTelemetry Observability              │
-└───────────────────────────────────┬────────────────────────────────────┘
-                                    │
-┌───────────────────────────────────▼────────────────────────────────────┐
-│                          APPLICATION LAYER                             │
-│  PostFundManagement.Application                                        │
-│  CQRS (Mediator), Business Validators, Domain Services, Quartz Jobs   │
-└──────────────────┬─────────────────────────────────┬───────────────────┘
-                   │                                 │
-┌──────────────────▼──────────────────┐   ┌──────────▼───────────────────┐
-│            DOMAIN LAYER             │   │    INFRASTRUCTURE LAYER      │
-│  PostFundManagement.Domain          │   │  PostFundManagement.Infrastr.│
-│  Entities, Value Objects, Enums,    │   │  PostgreSQL (EF Core 10),    │
-│  Domain Invariants, Audit Models    │   │  Skoruba STS, S3 Garage,     │
-└─────────────────────────────────────┘   │  Redis HybridCache           │
-                                          └──────────────────────────────┘
-```
-
----
-
-## 2. Security & Identity Architecture
-
-Authentication and authorization are separated cleanly across system boundaries:
-
-* **Security Token Service (STS)**: Duende IdentityServer / Skoruba Administration (`https://sts.security.khongisa.co.za`) issues cryptographically signed JWT access tokens using OpenID Connect (OIDC) with Proof Key for Code Exchange (PKCE).
-* **Audience & Scopes**: Web clients request standard OIDC scopes (`openid`, `profile`, `roles`, `email`, `address`) along with the target API resource scope (`pfm-api-dev`).
-* **Tenant Isolation**: Every authenticated principal carries a `tenant_id` claim. Multitenant query filters in EF Core enforce cross-tenant partition boundaries at the data access layer.
-* **Partner Isolation**: Grantees and external recipients possess the `partner` role. The `ConsoleUI` enforces immediate lockout for `partner` roles, restricting external users exclusively to `PartnerUI`.
-
----
-
-## 3. Role-Based Access Control (RBAC) Architecture
-
-PFM implements a fine-grained, claim-based RBAC model where system permissions are decomposed into **15 operational domains** and **5 progressive action capabilities**.
-
-### 3.1 Role Claims Inventory
-
-| Claim Key | Operational Domain | Functional Scope |
-| :--- | :--- | :--- |
-| `dashboard` | Executive Dashboard | Macro portfolio KPIs, disbursed capital, and ISO 31000 risk heatmap |
-| `governance` | Governance & Structure | Holding entities, funder portfolios, programmes, rules, and instruments |
-| `projects_milestones` | Projects & Milestones | Work breakdown structure (WBS), contractual milestones, and activities |
-| `grant_financials` | Grants & Financials | Statutory funding awards, budget lines, contracts, and disbursement tranches |
-| `evidence_risks` | M&E, Evidence & Risks | Deliverable evidence verification queue, indicators, and risk registers |
-| `beneficiaries` | Beneficiaries & Impact | Demographic targets, POPIA compliance items, and outcome deliverables |
-| `change_management` | Change Management | Project issues, contractual change requests, and budget variations |
-| `site_visits` | Site Visits | Physical field inspections, checklist observations, and inspector findings |
-| `settings_invites` | Settings Invites | Onboarding invitations and candidate notifications dispatch |
-| `settings_users` | Settings Users | User provisioning, role assignments, and account lockouts |
-| `settings_auditlog` | Settings Audit Log | Immutable audit ledger and system telemetry records |
-| `settings_notifications`| Settings Notifications | SMTP engines, notification channels, and dispatch telemetry |
-| `tenant_self_service` | Tenant Self-Service | Tenant profile configuration and delegated sub-user management |
-| `tenant_management` | Tenant Management | Multi-tenant directory, partition allocation, and solution ownership |
-| `unrestricted` | System Administration | Root administrative bypass across all system partitions |
-
-### 3.2 Claim Actions & Capability Hierarchy
-
-Action capabilities within a claim domain follow a strict subset hierarchy:
-
-$$\text{view} \subset \text{add} \subset \text{update} \quad \text{and} \quad \text{view} \subset \text{export}$$
-
-* **`view`**: Read-only access to entity lists, detailed records, metrics, and progress scores.
-* **`add`**: Can create new records, edit draft records, submit milestone evidence, and change workflow statuses *other than approval* (includes `view`).
-* **`update`**: Authoritative governance capability. Can execute **approval** status transitions (`Approved`, `Active` contracts) on records (includes `view` and `add`).
-* **`export`**: Can generate and download structured spreadsheets (`.xlsx`) and formal PDF reports (includes `view`).
-* **`all`**: Comprehensive authority (`view`, `add`, `update`, `export`) over the claim domain.
-
-### 3.3 Authoritative Role-to-Claims Matrix
-
-| Role | Assigned Claim Domains | Standard Capabilities | Record Approval Authority (`update`) |
-| :--- | :--- | :--- | :---: |
-| **`Admin`** | `unrestricted` | `all` | **Yes (System-wide)** |
-| **`Executive`** | `dashboard`, `governance`, `projects_milestones`, `grant_financials`, `evidence_risks`, `tenant_self_service` | `all` | **Yes** |
-| **`Manager`** | `dashboard`, `projects_milestones`, `grant_financials`, `evidence_risks`, `beneficiaries`, `change_management`, `site_visits`, `settings_invites`, `settings_users`, `settings_auditlog`, `settings_notifications`, `tenant_self_service` | `all` | **Yes** |
-| **`Supervisor`** | `dashboard`, `projects_milestones`, `grant_financials`, `evidence_risks`, `beneficiaries`, `change_management`, `site_visits`, `settings_invites`, `settings_users` | `view, add, update, export`<br>*(Dashboard: `view, export`)* | **Yes** |
-| **`Contributor`** | `projects_milestones`, `grant_financials`, `evidence_risks`, `beneficiaries`, `change_management`, `site_visits`, `settings_invites` | **`view, add`** | ❌ **Strictly Prohibited** |
-
----
-
-## 4. Maker-Checker Pattern Architecture
-
-To eliminate fraud risk, self-dealing, and conflicts of interest, PFM enforces the **Maker-Checker Pattern** (Segregation of Duties / Dual Authorization).
-
-### 4.1 Core Principle
-> **The user who creates or drafts a record (the "Maker") is strictly prohibited from verifying or approving that record (the "Checker"), regardless of their administrative role or RBAC claim privileges.**
-
-Even if an `Executive`, `Manager`, or `Supervisor` possesses the `update` claim action on a domain, they cannot approve a record if they are identified as the record's creator.
-
-```mermaid
-flowchart LR
-    A["Maker (User A)<br/>Creates Record"] --> B["Record Persisted<br/>with createdBy = User A"]
-    B --> C{"Checker Evaluation<br/>(Approver Login)"}
-    C -->|Checker == User A| D["Approval BLOCKED<br/>Maker-Checker Violation"]
-    C -->|Checker == User B<br/>with 'update' claim| E["Approval GRANTED<br/>Status -> Approved"]
-```
-
-### 4.2 Record Attribution Model
-Every operational domain entity immutably captures the creator identity:
-* `createdBy`: Cryptographic user identifier (Guid / Subject ID) populated from the verified token claim `context.GetUserId()` upon creation.
-* `approvedBy`: User identifier of the independent verifier populated upon successful transition to `Approved`.
-
-### 4.3 Client-Side Enforcement Hooks & Helpers
-In `PostFundManagement.ConsoleUI`, the Maker-Checker rule is evaluated dynamically via [`useRbac()`](file:///c:/Users/Admin/source/repos/PostFundManagement/PostFundManagement.ConsoleUI/src/auth/rbac.ts):
-
-* **`isMaker(createdBy)`**: Compares `createdBy` against current user `user.id`, `sub`, and `user.email`.
-* **`canApproveRecord(claim, createdBy)`**: Evaluates:
-  $$\text{canApproveRecord} = \text{canApprove}(\text{claim}) \land \neg\text{isMaker}(\text{createdBy})$$
-* **`getApprovalRestrictionReason(claim, createdBy)`**: Surfaces explanatory feedback:
-  - `"Requires update/approval permission"` if the claim lacks `update`.
-  - `"Maker-Checker policy: Record creators cannot approve their own records"` if `isMaker` is true.
-
-### 4.4 UI Guard Implementations
-1. **Status Dropdowns**: The `Approved` option in status `<select>` controls is disabled with contextual labels:
-   ```tsx
-   <option value={ApprovalStatus.Approved} disabled={!canApproveRecord('projects_milestones', record.createdBy)}>
-     Approved {isMaker(record.createdBy) ? '(Maker-Checker: Cannot approve own record)' : ''}
-   </option>
-   ```
-2. **Action Buttons**: Fast-track "Approve" buttons (e.g. Budget Approval, Disbursement Authorisation, Evidence Review) are hidden or accompanied by a Maker-Checker indicator badge when viewed by the creator.
-3. **Export Controls**: `<ExportButton>` enforces domain claim checks explicitly (`claim="grant_financials"`), rejecting unauthenticated exports.
-
----
-
-## 5. Caching Strategy, Mutation Versioning & Performance Optimization
-
-To achieve sub-50ms page transitions while guaranteeing data freshness across mutations in a distributed architecture, PFM employs a multi-tiered caching topology.
-
-```
-┌────────────────────────────────────────────────────────────────────────┐
-│ REACT QUERY CACHE (In-Memory Browser Tier)                             │
-│ staleTime: 2m (dynamic) | 5m (taxonomy) | gcTime: 10m                  │
-└───────────────────────────────────┬────────────────────────────────────┘
-                                    │ Cache Miss / Background Refetch
-┌───────────────────────────────────▼────────────────────────────────────┐
-│ AXIOS CLIENT INTERCEPTOR & MUTATION VERSIONING (_v)                     │
-│ Reads/Browsing: attaches active `_v` epoch token                       │
-│ Mutations (POST/PUT/PATCH/DELETE): auto-bumps epoch -> new `_v` token  │
-└───────────────────────────────────┬────────────────────────────────────┘
-                                    │ HTTP GET /v1/api/*?_v=<epoch>
-┌───────────────────────────────────▼────────────────────────────────────┐
-│ ASP.NET CORE OUTPUTCACHE (Redis / Memory Tier)                         │
-│ Base Policy: 2-minute expiration partitioned by URI + QueryString       │
-│ Hits same `_v` -> 2ms response | New `_v` -> DB query & cache refresh  │
-└────────────────────────────────────────────────────────────────────────┘
-```
-
-### 5.1 The OutputCache Stale Data Challenge
-ASP.NET Core Minimal APIs in `PostFundManagement.Api` attach `.CacheOutput()` to GET endpoints, using a 2-minute base sliding expiration backed by Redis / Memory cache. 
-
-Because OutputCache keys are generated from the HTTP Method, Host, Path, and **Query String**, a naive client refetch after a mutation (e.g. `queryClient.invalidateQueries({ queryKey: ['projects'] })`) calls `GET /v1/api/projects`. OutputCache intercepts this identical URI, returning the pre-mutation response cached earlier. The updated project status or approved milestone does not reflect in the UI until the 2-minute cache expires.
-
-### 5.2 Client-Side Mutation Epoch Versioning
-PFM solves this without modifying backend endpoints via **Client-Side Mutation Versioning**:
-1. **Epoch Tracking (`activeMutationEpoch`)**: `httpClient.ts` tracks an active mutation timestamp initialized from `sessionStorage` or `Date.now()`.
-2. **Automatic Mutation Interceptor**: Every successful mutating HTTP response (`POST`, `PUT`, `PATCH`, `DELETE` with HTTP 2xx) triggers `bumpMutationEpoch()`.
-3. **Query Parameter Injection**: Outgoing `GET` requests to internal APIs automatically append `_v: getMutationEpoch()`.
-4. **Instant Invalidation**: When a mutation succeeds, the epoch is bumped. Subsequent React Query refetches send the new `_v`, producing an immediate **cache miss** in ASP.NET Core OutputCache. The backend queries PostgreSQL, returns fresh data, and caches the new state under the new `_v` key.
-5. **Cache Hit Snappiness**: Navigations between pages while no mutations have occurred reuse the stable `_v`, yielding sub-5ms responses from Redis/Memory OutputCache and 0ms from React Query in-memory cache.
-6. **Explicit Freshness (`_t`)**: When `Cache-Control: no-cache` is specified or during explicit refresh operations, a unique timestamp `_t` is attached to force a guaranteed fresh fetch.
-
-### 5.3 RBAC Startup Pipeline Acceleration
-Following the introduction of fine-grained RBAC and Maker-Checker checks, startup performance was streamlined to eliminate sequential network waterfalls:
-* **Cache-First Role Claims**: `fetchAndCacheSystemRoles` and `fetchAndCacheRoleClaims` check in-memory and `localStorage` caches *before* dispatching network calls.
-* **Parallel User Resolution**: `getUserRolesFromApi` and `getUserClaimsFromApi` are resolved concurrently using `Promise.allSettled`.
-* **Parallel Claim Resolution**: Claims across all assigned roles are retrieved concurrently rather than in serial loops.
-* **Immediate Non-Blocking Session Render**: If valid session tokens and user profiles exist in `localStorage`, `AuthProvider` immediately unblocks UI rendering (`isLoading: false`) and runs tenant lockout checks, account synchronization, and claim revalidation asynchronously in the background.
-* **In-Memory User Sync & Lockout Caching**: `isUserSyncedInBrowser` and `verifyTenantLockout` maintain in-memory references to eliminate synchronous `JSON.parse` operations from the request pipeline.
-
-

Directory.Build.props

@@ -1,101 +0,0 @@
-<Project>
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-    <LangVersion>latest</LangVersion>
-    <NoWarn>$(NoWarn);1701;1702;MA0048;MA0051;AV0029;AV0030</NoWarn>
-  </PropertyGroup>
-
-  <!-- Assembly signing and licensing for non-test projects -->
-  <PropertyGroup Condition="!$(MSBuildProjectName.EndsWith('Tests'))">
-    <SignAssembly>true</SignAssembly>
-    <AssemblyOriginatorKeyFile>$(MSBuildThisFileDirectory)PostFundManagement.snk</AssemblyOriginatorKeyFile>
-    <PackageLicenseFile>$(MSBuildThisFileDirectory)LICENSE</PackageLicenseFile>
-  </PropertyGroup>
-
-  <!-- Centralized Common Usings across solution -->
-  <ItemGroup>
-    <!-- System & BCL -->
-    <Using Include="System.Collections.ObjectModel" />
-    <Using Include="System.ComponentModel.DataAnnotations" />
-    <Using Include="System.Globalization" />
-    <Using Include="System.Net" />
-    <Using Include="System.Reflection" />
-    <Using Include="System.Security.Cryptography" />
-    <Using Include="System.Security.Cryptography.X509Certificates" />
-    <Using Include="System.Text" />
-    <Using Include="System.Text.Json" />
-    <Using Include="System.Text.Json.Serialization" />
-    <Using Include="System.Text.RegularExpressions" />
-    <Using Include="System.Threading.Channels" />
-    <Using Include="System.Web" />
-
-    <!-- Microsoft Extensions & Web Core -->
-    <Using Include="Microsoft.AspNetCore.Builder" />
-    <Using Include="Microsoft.AspNetCore.Components.Server.ProtectedBrowserStorage" />
-    <Using Include="Microsoft.AspNetCore.DataProtection" />
-    <Using Include="Microsoft.AspNetCore.Http" />
-    <Using Include="Microsoft.AspNetCore.Routing" />
-    <Using Include="Microsoft.Extensions.Configuration" />
-    <Using Include="Microsoft.Extensions.DependencyInjection" />
-    <Using Include="Microsoft.Extensions.DependencyInjection.Extensions" />
-    <Using Include="Microsoft.Extensions.Hosting" />
-    <Using Include="Microsoft.Extensions.Logging" />
-    <Using Include="Microsoft.Extensions.Options" />
-    <Using Include="Microsoft.IdentityModel.Tokens" />
-
-    <!-- Domain Constants -->
-    <Using Static="true" Include="PostFundManagement.Domain.Extensions.Constants" />
-
-    <!-- CQRS, Utilities & Persistence -->
-    <Using Include="FluentResults" />
-    <Using Include="HashidsNet" />
-    <Using Include="Humanizer" />
-    <Using Include="Mediator" />
-    <Using Include="Microsoft.EntityFrameworkCore" />
-    <Using Include="Microsoft.EntityFrameworkCore.Design" />
-    <Using Include="Microsoft.EntityFrameworkCore.Metadata.Builders" />
-    <Using Include="Quartz" />
-    <Using Include="Refit" />
-
-    <!-- API & Documentation -->
-    <Using Include="Asp.Versioning" />
-    <Using Include="Microsoft.AspNetCore.OpenApi" />
-    <Using Include="Microsoft.OpenApi" />
-    <Using Include="Scalar.AspNetCore" />
-
-    <!-- Authentication -->
-    <Using Include="IdentityModel.AspNetCore.OAuth2Introspection" />
-    <Using Include="Microsoft.AspNetCore.Authentication" />
-    <Using Include="Microsoft.AspNetCore.Authentication.Cookies" />
-    <Using Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
-    <Using Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" />
-
-    <!-- Diagnostics & Health -->
-    <Using Include="Microsoft.AspNetCore.Diagnostics.HealthChecks" />
-    <Using Include="Microsoft.Extensions.Diagnostics.HealthChecks" />
-
-    <!-- Messaging & Cloud Storage -->
-    <Using Include="Amazon.Runtime" />
-    <Using Include="Amazon.S3" />
-    <Using Include="Amazon.S3.Model" />
-    <Using Include="MailKit.Net.Smtp" />
-    <Using Include="MimeKit" />
-  </ItemGroup>
-
-  <!-- Domain-specific Usings (Domain and downstream projects excluding Infrastructure where Claim/Activity/TokenRequest collide) -->
-  <ItemGroup Condition="'$(MSBuildProjectName)' == 'PostFundManagement.Domain'">
-    <Using Include="System.Security.Claims" />
-    <Using Include="AccessTokenClient" />
-  </ItemGroup>
-
-  <!-- Non-Domain / Non-Infrastructure Usings (Application, Api, Tests) -->
-  <ItemGroup Condition="'$(MSBuildProjectName)' != 'PostFundManagement.Domain' and '$(MSBuildProjectName)' != 'PostFundManagement.Infrastructure'">
-    <Using Include="System.Diagnostics" />
-    <Using Include="System.Security.Claims" />
-    <Using Include="AccessTokenClient" />
-    <Using Static="true" Include="PostFundManagement.Application.Extensions.General" />
-  </ItemGroup>
-</Project>
-

Directory.Packages.props

@@ -1,117 +0,0 @@
-<Project>
-  <PropertyGroup>
-    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <!-- Core & Utilities -->
-    <PackageVersion Include="Castle.Core.AsyncInterceptor" Version="2.1.0" />
-    <PackageVersion Include="Hashids.net" Version="1.7.0" />
-    <PackageVersion Include="Humanizer" Version="3.0.10" />
-    <PackageVersion Include="Scrutor" Version="7.0.0" />
-
-    <!-- Microsoft Extensions & Configuration -->
-    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.10.0" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Http.Polly" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.10.0" />
-    <PackageVersion Include="Microsoft.Extensions.Validation" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.7.0" />
-
-    <!-- Security, Authentication & Identity -->
-    <PackageVersion Include="AccessTokenClient.Extensions" Version="5.1.0" />
-    <PackageVersion Include="Duende.AccessTokenManagement" Version="4.2.0" />
-    <PackageVersion Include="Duende.AccessTokenManagement.OpenIdConnect" Version="4.2.0" />
-    <PackageVersion Include="IdentityModel" Version="6.2.0" />
-    <PackageVersion Include="IdentityModel.AspNetCore" Version="4.3.0" />
-    <PackageVersion Include="IdentityModel.AspNetCore.OAuth2introspection" Version="6.2.0" />
-    <PackageVersion Include="IdentityServer4.AccessTokenValidation" Version="3.0.1" />
-    <PackageVersion Include="KubernetesClient" Version="19.0.2" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.12" />
-    
-    <!-- Upgraded to latest non-vulnerable version -->
-    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
-
-    <!-- Resilience -->
-    <PackageVersion Include="Polly" Version="8.8.0" />
-    <PackageVersion Include="Polly.Extensions" Version="8.8.0" />
-
-    <!-- API, Web & Documentation -->
-    <PackageVersion Include="Asp.Versioning.Abstractions" Version="10.2.1" />
-    <PackageVersion Include="Asp.Versioning.Http" Version="10.2.3" />
-    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="10.2.1" />
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.AspNetCore.OutputCaching.StackExchangeRedis" Version="10.0.12" />
-    <PackageVersion Include="Refit.HttpClientFactory" Version="15.2.0" />
-    <PackageVersion Include="Scalar.AspNetCore" Version="2.17.4" />
-
-    <!-- Database & Entity Framework Core -->
-    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Abstractions" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Analyzers" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.12" />
-    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
-
-    <!-- Quartz Scheduler -->
-    <PackageVersion Include="Quartz" Version="4.1.0" />
-    <PackageVersion Include="Quartz.AspNetCore" Version="4.1.0" />
-    <PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="4.1.0" />
-    <PackageVersion Include="Quartz.Plugins" Version="4.1.0" />
-    <PackageVersion Include="Quartz.Plugins.TimeZoneConverter" Version="4.1.0" />
-    <PackageVersion Include="Quartz.Serialization.SystemTextJson" Version="4.1.0" />
-
-    <!-- Health Checks -->
-    <PackageVersion Include="AspNetCore.HealthChecks.NpgSql" Version="9.0.0" />
-    <PackageVersion Include="AspNetCore.HealthChecks.UI" Version="9.0.0" />
-    <PackageVersion Include="AspNetCore.HealthChecks.UI.Client" Version="9.0.0" />
-    <PackageVersion Include="AspNetCore.HealthChecks.UI.Core" Version="9.0.0" />
-    <PackageVersion Include="AspNetCore.HealthChecks.UI.Data" Version="9.0.0" />
-    <PackageVersion Include="AspNetCore.HealthChecks.UI.InMemory.Storage" Version="9.0.0" />
-
-    <!-- Observability & OpenTelemetry -->
-    <PackageVersion Include="OpenTelemetry" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.18.0" />
-
-    <!-- Email & Messaging -->
-    <PackageVersion Include="MailKit" Version="4.18.0" />
-    <PackageVersion Include="MimeKit" Version="4.18.0" />
-
-    <!-- CQRS & Mediator -->
-    <PackageVersion Include="FluentResults" Version="4.0.0" />
-    <PackageVersion Include="Mediator.Abstractions" Version="3.0.2" />
-    <PackageVersion Include="Mediator.SourceGenerator" Version="3.0.2" />
-
-    <!-- Cloud Storage -->
-    <PackageVersion Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.101.4" />
-    <PackageVersion Include="AWSSDK.S3" Version="4.0.103.3" />
-
-    <!-- Analyzers -->
-    <PackageVersion Include="Meziantou.Analyzer" Version="3.0.259" />
-
-    <!-- Testing -->
-    <PackageVersion Include="coverlet.collector" Version="6.0.4" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
-    <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />
-  </ItemGroup>
-</Project>
-

PostFundManagement.Api/Dockerfile

@@ -1,40 +0,0 @@
-# Stage 1: Runtime base
-FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
-USER app
-WORKDIR /app
-EXPOSE 8080
-
-# Stage 2: Build & Restore
-FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
-WORKDIR /src
-
-# Copy props and csproj files for layer caching
-COPY ["Directory.Build.props", "./"]
-COPY ["Directory.Packages.props", "./"]
-COPY ["PostFundManagement.snk", "./"]
-COPY ["LICENSE", "./"]
-COPY ["PostFundManagement.Api/PostFundManagement.Api.csproj", "PostFundManagement.Api/"]
-COPY ["PostFundManagement.Application/PostFundManagement.Application.csproj", "PostFundManagement.Application/"]
-COPY ["PostFundManagement.Domain/PostFundManagement.Domain.csproj", "PostFundManagement.Domain/"]
-COPY ["PostFundManagement.Infrastructure/PostFundManagement.Infrastructure.csproj", "PostFundManagement.Infrastructure/"]
-
-# Restore packages
-RUN dotnet restore "PostFundManagement.Api/PostFundManagement.Api.csproj"
-
-# Copy full source code
-COPY . .
-
-# Build from the project folder using relative filename
-WORKDIR "/src/PostFundManagement.Api"
-RUN dotnet build "PostFundManagement.Api.csproj" -c Release -o /app/build
-
-# Stage 3: Publish
-FROM build AS publish
-ARG BUILD_CONFIGURATION=Release
-RUN dotnet publish "PostFundManagement.Api.csproj" -c Release -o /app/publish /p:UseAppHost=false
-
-# Stage 4: Final Runtime
-FROM base AS final
-WORKDIR /app
-COPY --from=publish /app/publish .
-ENTRYPOINT ["dotnet", "PostFundManagement.Api.dll"]

PostFundManagement.Api/Endpoints/Communications/CreateNotificationEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Communications;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Communications;
-
-[ApiVersionTarget(1)]
-public sealed class CreateNotificationEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/communications/notifications", async (CreateNotificationRequest request,
-            HttpContext context, ICommunicationsService service, CancellationToken cancellationToken = default) =>
-                await service.CreateNotificationAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Created(),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Creates a new in-app or outbound notification record")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateNotificationEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status201Created)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Communications);
-    }
-}
-

PostFundManagement.Api/Endpoints/Communications/GetApplicantInviteEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Communications;
-
-[ApiVersionTarget(1)]
-public sealed class GetApplicantInviteEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/communications/invites/applicants/{applicantUserId:Guid}", async (Guid applicantUserId, ICommunicationsService service,
-            HttpContext context, CancellationToken cancellationToken = default) =>
-                await service.GetApplicantInviteAsync(applicantUserId, cancellationToken) switch
-                {
-                    {  IsSuccess: true, Value: var invite } => Results.Ok(invite),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
-                })
-            .WithDescription("Gets an applicant's invite")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetApplicantInviteEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Invite>(StatusCodes.Status200OK)        
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Communications)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Communications/GetApplicantInvitesEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Communications;
-
-[ApiVersionTarget(1)]
-public sealed class GetApplicantInvitesEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/communications/invites/{applicantUserId:Guid}", async (Guid applicantUserId, ICommunicationsService service,
-            HttpContext context, CancellationToken cancellationToken = default) =>
-                await service.GetApplicantInvitesAsync(applicantUserId, cancellationToken) switch
-                {
-                    {  IsSuccess: true, Value: var invite } => Results.Ok(invite),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
-                })
-            .WithDescription("Gets an applicant's invite list")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetApplicantInvitesEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Invite[]>(StatusCodes.Status200OK)        
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Communications)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Communications/GetIApplicantDataEndpoint.cs

@@ -1,35 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Communications;
-
-[ApiVersionTarget(1)]
-public sealed class GetIApplicantDataEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/communications/applicants/{applicantUserId:Guid}/all", async (Guid applicantUserId, 
-            ICommunicationsService service, CancellationToken cancellationtToken = default ) =>
-                await service.GetApplicantDataAsync(applicantUserId, cancellationtToken) switch
-                {
-                    { IsSuccess: true, Value: var applicantData } => Results.Ok(applicantData),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
-                })
-            .WithDescription("Gets an applicant's data")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetIApplicantDataEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Invite>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Communications)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Communications/GetInvitesEndpoint.cs

@@ -1,31 +1,34 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Communications;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
+using static PostFundManagement.Application.Extensions.General;
 
 namespace PostFundManagement.Api.Endpoints.Communications;
 
 [ApiVersionTarget(1)]
-public sealed class GetInvitesEndpoint : IEndpoint
+public class GetInvitesEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/communications/invites/{page:int}/{pageSize:int}", async (ICommunicationsService service,
+        builder.MapGet("api/communications/invites/{page:int}/{pageSize:int}", async (CommunicationsService service,
             int page = 1, int pageSize = 100, CancellationToken cancellationToken = default) =>
-                await service.GetInvitesAsync(Pagination.Create(page, pageSize), cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var invites } => Results.Ok(invites),
+            var result = await service.GetInvitesAsync(Pagination.Create(page, pageSize), cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Get a list of sent invitations")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetInvitesEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Invite[]>(StatusCodes.Status200OK)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .WithTags(EndpointTags.Communications)
         .CacheOutput();
     }

PostFundManagement.Api/Endpoints/Communications/GetNotificationsEndpoint.cs

@@ -1,35 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Communications;
-
-[ApiVersionTarget(1)]
-public sealed class GetNotificationsEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/communications/notifications/{organisationId}", async (string organisationId, 
-            ICommunicationsService service, CancellationToken cancellationToken = default) =>
-                await service.GetNotificationsAsync(organisationId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var notifications } => Results.Ok(notifications),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
-                })
-            .WithDescription("Retrieves the notification system report")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetNotificationsEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Notification[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Notification[]>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Communications)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Communications/GetUserNotificationsEndpoint.cs

@@ -1,49 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Communications;
-
-[ApiVersionTarget(1)]
-public sealed class GetUserNotificationsEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/communications/notifications/user/{userId:guid}", async (Guid userId,
-            ICommunicationsService service, CancellationToken cancellationToken = default) =>
-                await service.GetUserNotificationsAsync(userId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var notifications } => Results.Ok(notifications),
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
-                })
-            .WithDescription("Retrieves all notifications targeted at a specific user")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetUserNotificationsEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Notification[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Communications)
-            .CacheOutput();
-
-        builder.MapGet("api/communications/notifications/inbox", async (HttpContext context,
-            ICommunicationsService service, CancellationToken cancellationToken = default) =>
-                await service.GetUserNotificationsAsync(context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var notifications } => Results.Ok(notifications),
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
-                })
-            .WithDescription("Retrieves all in-app and system notifications targeted at the authenticated caller")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName($"{typeof(GetUserNotificationsEndpoint).ToEndpointName()}Inbox")
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Notification[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Communications)
-            .CacheOutput();
-    }
-}
-

PostFundManagement.Api/Endpoints/Communications/SendInviteEndpoint.cs

@@ -1,35 +1,30 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Communications;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Communications;
 
 [ApiVersionTarget(1)]
-public sealed class SendInviteEndpoint : IEndpoint
+public class SendInviteEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapPost("api/communications/invites", async (InviteRequest request,
+        builder.MapPost("api/communications/invite", async (InviteRequest request, 
-            HttpContext context, ICommunicationsService service, CancellationToken cancellationToken = default) =>
+            HttpContext context, CommunicationsService service, CancellationToken cancellationToken = default) =>
-                await service.SendInviteAsync(request, context.GetUserId(), cancellationToken) switch
         {            
-                    { IsSuccess: true, Value: var invite } => Results.Ok(invite),
+            var result = await service.SendInviteAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Trigger an invite to an organization or candidate (specifying NotificationPlatform)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(SendInviteEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
-            .Produces<Invite>(StatusCodes.Status200OK)
+        .Produces<Domain.Entities.Invite>(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .Produces(StatusCodes.Status401Unauthorized)
         .WithTags(EndpointTags.Communications);
     }

PostFundManagement.Api/Endpoints/Communications/UpdateNotificationEndpoint.cs

@@ -1,37 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Communications;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Communications;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateNotificationEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/communications/notifications", async (UpdateNotificationRequest request,
-            ICommunicationsService service, CancellationToken cancellationToken = default) =>
-                await service.UpdateNotificationAsync(request, cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.NoContent(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Updates a notification status, delivery timestamp, or error state")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdateNotificationEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status204NoContent)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Communications);
-    }
-}
-

PostFundManagement.Api/Endpoints/Evidence/CreateIndicatorEndpoint.cs

@@ -1,9 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Evidence;
 
@@ -13,23 +12,20 @@ public class CreateIndicatorEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/evidence/indicators", async (CreateIndicatorRequest request, HttpContext context,
-            IEvidenceService service, CancellationToken cancellationToken = default) =>
+            EvidenceService service, CancellationToken cancellationToken = default) =>
-                await service.CreateIndicatorAsync(request, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } => Results.Ok(),
+            var result = await service.CreateIndicatorAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                ? Results.Ok()
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Define indicators and baselines/targets (M08)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(CreateIndicatorEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .WithTags(EndpointTags.Evidence);
     }
 }

PostFundManagement.Api/Endpoints/Evidence/CreateMilestoneEndpoint.cs

@@ -1,9 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Evidence;
 
@@ -13,23 +12,20 @@ public class CreateMilestoneEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/evidence/milestones", async (CreateMilestoneRequest request, HttpContext context, 
-            IEvidenceService service, CancellationToken cancellationToken = default) =>
+            EvidenceService service, CancellationToken cancellationToken = default) =>
-                await service.CreateMilestoneAsync(request, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } => Results.Ok(),
+            var result = await service.CreateMilestoneAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                ? Results.Ok()
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Define contractual milestones (M07)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(CreateMilestoneRequest).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .WithTags(EndpointTags.Evidence);
     }
 }

PostFundManagement.Api/Endpoints/Evidence/GetEvidenceEndpoint.cs

@@ -1,35 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Evidence;
-
-[ApiVersionTarget(1)]
-public sealed class GetEvidenceEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/evidence/{evidenceId}", async (string evidenceId, IEvidenceService service,
-            CancellationToken cancellationToken = default) =>
-                await service.GetEvidenceAsync(evidenceId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var evidence } => Results.Ok(evidence),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get a specific evidence record and assiciated file URLs")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetEvidenceEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Domain.Models.Evidence>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Evidence)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Evidence/GetEvidenceFilesEndpoint.cs

@@ -1,8 +1,9 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Evidence;
 
@@ -11,19 +12,20 @@ public class GetEvidenceFilesEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/evidence/files/{page:int}/{pageSize:int}", async (IEvidenceService service, 
+        builder.MapGet("api/evidence/files/{page:int}/{pageSize:int}", async (EvidenceService service, 
             int page = 1, int pageSize = 100, CancellationToken cancellationToken = default) =>
-                await service.GetEvidenceFilesAsync(Pagination.Create(page, pageSize), cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var evidences} => Results.Ok(evidences),
+            var result = await service.GetEvidenceFilesAsync(Pagination.Create(page, pageSize), cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })        
         .WithDescription("Get a list of all uploaded evidence files metadata")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetEvidenceFilesEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Domain.Models.Evidence[]>(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
         .WithTags(EndpointTags.Evidence)
         .CacheOutput();

PostFundManagement.Api/Endpoints/Evidence/GetEvidenceUrlEndpoint.cs

@@ -1,35 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Evidence;
-
-[ApiVersionTarget(1)]
-public sealed class GetEvidenceUrlEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/evidence/{evidenceId}/securelink", async (string evidenceId, IEvidenceService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetEvidenceUrlAsync(evidenceIdHash: evidenceId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var evidenceUrl } => Results.Ok(evidenceUrl),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Gets a secure download URL of the evidence file, URL expires (default: 15min)")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetEvidenceUrlEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<string>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Grants)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Evidence/GetIndicatorEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Evidence;
-
-[ApiVersionTarget(1)]
-public sealed class GetIndicatorEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/evidence/indicators/{indicatorId}", async (string indicatorId, IEvidenceService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetIndicatorAsync(indicatorId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var indicator } => Results.Ok(indicator),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get a specific indicator.")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetIndicatorEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Indicator>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Evidence)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Evidence/GetIndicatorsEndpoint.cs

@@ -1,9 +1,10 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Evidence;
 
@@ -12,21 +13,21 @@ public class GetIndicatorsEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/evidence/indicators/{page:int}/{pageSize:int}", async (IEvidenceService service, 
+        builder.MapGet("api/evidence/indicators/{page:int}/{pageSize:int}", async (EvidenceService service, 
             int page = 1, int pageSize = 100, CancellationToken cancellationToken = default) =>
-                await service.GetIndicatorsAsync(Pagination.Create(page, pageSize), cancellationToken) switch
         {
-                    {  IsSuccess: true, Value: var indicators } => Results.Ok(indicators),
+            var result = await service.GetIndicatorsAsync(Pagination.Create(page, pageSize), cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })        
         .WithDescription("Get a list of indicators")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetIndicatorsEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Indicator[]>(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Evidence)
+        .WithTags(EndpointTags.Evidence);
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Evidence/GetMilestoneEvidenceEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Evidence;
-
-[ApiVersionTarget(1)]
-public class GetMilestoneEvidenceEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/evidence/milestone/{milestoneId}", async (string milestoneId, IEvidenceService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetMilestoneEvidencesAsync(milestoneId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var evidences } => Results.Ok(evidences),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get a list of all uploaded evidence metadata for a specific mliestone")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetMilestoneEvidenceEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Domain.Models.Evidence[]>(StatusCodes.Status200OK)        
-            .Produces(StatusCodes.Status404NotFound)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Evidence)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Evidence/GetMilestonesEndpoint.cs

@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Evidence;
+using PostFundManagement.Domain;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
+
+namespace PostFundManagement.Api.Endpoints.Evidence;
+
+[ApiVersionTarget(1)]
+public class GetMilestonesEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/evidence/milestones/{page:int}/{pageSize:int}", async (EvidenceService service,
+            int page = 1, int pageSize = 10, CancellationToken cancellationToken = default) =>
+        {
+            var result = await service.GetMilestonesAsync(Pagination.Create(page, pageSize), cancellationToken);
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
+        })
+        .RequireAuthorization()
+        .WithDescription("Get a list of all milestones")
+        .WithName(typeof(GetMilestonesEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces<Milestone[]>(StatusCodes.Status200OK)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .WithTags(EndpointTags.Evidence);
+    }
+}

PostFundManagement.Api/Endpoints/Evidence/GetProjectEvidenceEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Evidence;
-
-[ApiVersionTarget(1)]
-public class GetProjectEvidenceEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/evidence/{projectId}", async (string projectId, IEvidenceService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetProjectEvidencesAsync(projectId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var evidence } => Results.Ok(evidence),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
-                })
-            .WithDescription("Get a list of all uploaded evidence metadata for a specific project")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetProjectEvidenceEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Domain.Models.Evidence[]>(StatusCodes.Status200OK)        
-            .Produces(StatusCodes.Status404NotFound)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Evidence)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Evidence/GetProjectMilestonesEndpoint.cs

@@ -0,0 +1,32 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Evidence;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
+
+namespace PostFundManagement.Api.Endpoints.Evidence;
+
+[ApiVersionTarget(1)]
+public class GetProjectMilestonesEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/evidence/milestones/project/{projectId}", async (string projectId,
+            EvidenceService service, CancellationToken cancellationToken = default) =>
+        {
+            var result = await service.GetMilestonesByProjectIdAsync(projectId, cancellationToken);
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.NotFound();
+        })
+        .WithDescription("Get a list of milestones for a project")
+        .WithName(typeof(GetProjectMilestonesEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces<Milestone[]>(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status404NotFound)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .WithTags(EndpointTags.Evidence);
+    }
+}

PostFundManagement.Api/Endpoints/Evidence/RecordIndicatorAmountEndpoint.cs

@@ -1,8 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Evidence;
 
@@ -12,23 +12,20 @@ public class RecordIndicatorAmountEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/evidence/indicators/{indicatorId}/actuals/{actualAmount:decimal}", async (string indicatorId, decimal actualAmount,
-            HttpContext context, IEvidenceService service, CancellationToken cancellationToken = default) =>
+            HttpContext context, EvidenceService service, CancellationToken cancellationToken = default) =>
-                await service.RecordIndicatorActualAmountAsync(indicatorId, actualAmount, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } => Results.Ok(),
+            var result = await service.RecordIndicatorActualAmountAsync(indicatorId, actualAmount, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                ? Results.Ok()
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Record actual values for indicators (M08)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(RecordIndicatorAmountEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .WithTags(EndpointTags.Evidence);
     }
 }

PostFundManagement.Api/Endpoints/Evidence/UpdateEvidenceEndpoint.cs

@@ -1,37 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Evidence;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Evidence;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateEvidenceEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/evidence", async (UpdateEvidenceRequest request, HttpContext context, IEvidenceService service,
-            CancellationToken cancellationToken = default) =>
-                await service.UpdateEvidenceAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Updates a specific evidence record metadata")
-            .RequireAuthorization(Constants.MainScope)
-            .DisableAntiforgery()
-            .WithName(typeof(UpdateEvidenceEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Evidence);
-    }
-}

PostFundManagement.Api/Endpoints/Evidence/UploadEvidenceFilesEndpoint.cs

@@ -1,17 +1,17 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Evidence;
 
 [ApiVersionTarget(1)]
-public class CreateEvidenceEndpoint : IEndpoint
+public class UploadEvidenceFilesEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapPut("api/evidence/file", async (HttpRequest request, IEvidenceService service, 
+        builder.MapPost("api/evidence/files", async (HttpRequest request, EvidenceService service, 
             CancellationToken cancellationToken = default) =>
         {
             var userId = request.HttpContext.GetUserId();
@@ -25,21 +25,19 @@ public class CreateEvidenceEndpoint : IEndpoint
             if (file == null || file.Length == 0)
                 return Results.BadRequest("No file uploaded or file is empty.");
 
-            return await service.CreateEvidenceAsync(userId, form, file, cancellationToken) switch
+            var result = await service.UploadEvidenceFileAsync(userId, form, file, cancellationToken);
-            {
+
-                { IsSuccess: true } => Results.Ok(),
+            return result.IsSuccess
-                var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                ? Results.Ok()
-                var r => Results.InternalServerError(r.Errors.ToProblems())
+                : Results.BadRequest(result.Errors.ToProblems());
-            };
         })
-        .WithDescription("Upload supporting evidence file to S3 and register metadata (M14)")
+        .RequireAuthorization()
         .DisableAntiforgery()
-        .RequireAuthorization(Constants.MainScope)
+        .WithDescription("Upload supporting evidence file to S3 and register metadata (M14)")
-        .WithName(typeof(CreateEvidenceEndpoint).ToEndpointName())
+        .WithName(typeof(UploadEvidenceFilesEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
-        .Produces<Problems>(StatusCodes.Status400BadRequest)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
-        .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .Produces(StatusCodes.Status401Unauthorized)
         .WithTags(EndpointTags.Evidence);
     }

PostFundManagement.Api/Endpoints/Execution/ApproveDisbursementEndpoint.cs

@@ -1,8 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Execution;
 
@@ -12,23 +12,20 @@ public class ApproveDisbursementEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/execution/disbursements/{disbursementId}/approve", async (string disbursementId, 
-            IExecutionService service, HttpContext context, CancellationToken cancellationToken = default) =>
+            ExecutionService service, HttpContext context, CancellationToken cancellationToken = default) =>
-                await service.ApproveDisbursementAsync(disbursementId, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } => Results.Ok(),
+            var result = await service.ApproveDisbursementAsync(disbursementId, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                ? Results.Ok()
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Approve disbursement and release payment (M06)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(ApproveDisbursementEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .WithTags(EndpointTags.Execution);
     }
 }

PostFundManagement.Api/Endpoints/Execution/CreateDisbursementEndpoint.cs

@@ -1,9 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Execution;
 
@@ -13,23 +12,20 @@ public class CreateDisbursementEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/execution/disbursements", async (CreateDisbursementRequest request, 
-            IExecutionService service, HttpContext context, CancellationToken cancellationToken = default) =>
+            ExecutionService service, HttpContext context, CancellationToken cancellationToken = default) =>
-                await service.CreateDisbursementAsync(request, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } => Results.Ok(),
+            var result = await service.CreateDisbursementAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                ? Results.Ok()
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Create a new disbursement schedule (M06)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(CreateDisbursementEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .WithTags(EndpointTags.Execution);
     }
 }

PostFundManagement.Api/Endpoints/Execution/CreateRiskEndpoint.cs

@@ -1,9 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Execution;
 
@@ -12,24 +11,21 @@ public class CreateRiskEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapPost("api/execution/risks", async (CreateRiskRequest request, IExecutionService service, 
+        builder.MapPost("api/execution/risks", async (CreateRiskRequest request, ExecutionService service, 
             HttpContext context, CancellationToken cancellationToken = default) =>
-                await service.CreateRiskAsync(request, context.GetUserId(), cancellationToken) switch 
         {
-                    { IsSuccess: true } => Results.Ok(),
+            var result = await service.CreateRiskAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                ? Results.Ok()
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Add risk to risk register (M09)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(CreateRiskEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .WithTags(EndpointTags.Execution);
     }
 }

PostFundManagement.Api/Endpoints/Execution/CreateRuleEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Execution;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Execution;
-
-[ApiVersionTarget(1)]
-public sealed class CreateRuleEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/execution/rules", async (CreateRuleRequest request, HttpContext context,
-            IExecutionService service, CancellationToken cancellationToken = default) =>
-                await service.CreateRuleAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
-                })
-            .WithDescription("Add rule against a programme")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateRuleEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Execution);
-    }
-}

PostFundManagement.Api/Endpoints/Execution/GetDisbursementEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Execution;
-
-[ApiVersionTarget(1)]
-public sealed class GetDisbursementEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/execution/disbursements/{disbursementId}", async (string disbursementId, IExecutionService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetDisbursementAsync(disbursementIdHash: disbursementId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var disbursement } => Results.Ok(disbursement),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get a specific disbursement")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetDisbursementEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Disbursement>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Execution)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Execution/GetDisbursementsEndpoint.cs

@@ -1,9 +1,10 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Execution;
 
@@ -12,22 +13,21 @@ public class GetDisbursementsEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/execution/disbursements", async (IExecutionService service, 
+        builder.MapGet("api/execution/disbursements", async (ExecutionService service, 
             int page = 1, int pageSize = 10, CancellationToken cancellationToken = default) =>
-                await service.GetDisbursementsAsync(Pagination.Create(page, pageSize), cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var disbursements } => Results.Ok(disbursements),
+            var result = await service.GetDisbursementsAsync(Pagination.Create(page, pageSize), cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.NotFound();
         })
         .WithDescription("Get a list of disbursements")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetDisbursementsEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Disbursement[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
         .Produces(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Execution)
+        .WithTags(EndpointTags.Execution);
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Execution/GetProjectRisksEndpoint.cs

@@ -0,0 +1,32 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Execution;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
+
+namespace PostFundManagement.Api.Endpoints.Execution;
+
+[ApiVersionTarget(1)]
+public class GetProjectRisksEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/execution/risks/project/{projectId}", async (string projectId,
+            ExecutionService service, CancellationToken cancellationToken = default) =>
+        {
+            var result = await service.GetProjectRisksAsync(projectId, cancellationToken);
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.NotFound();
+        })
+        .WithDescription("Get a list of risks for a project")
+        .WithName(typeof(GetProjectRisksEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces<Risk[]>(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status404NotFound)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .WithTags(EndpointTags.Execution);
+    }
+}

PostFundManagement.Api/Endpoints/Execution/GetRiskEndpoint.cs

@@ -1,35 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Execution;
-
-[ApiVersionTarget(1)]
-public sealed class GetRiskEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/execution/risks/{riskId}", async (string riskId, IExecutionService service,
-            CancellationToken cancellationToken = default) =>
-                await service.GetRiskAsync(riskIdHash: riskId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var risk  } => Results.Ok(risk),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get a specific risk")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetRiskEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Risk>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Execution)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Execution/GetRisksEndpoint.cs

@@ -1,9 +1,9 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Execution;
 
@@ -12,21 +12,20 @@ public class GetRisksEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/execution/risks", async (IExecutionService service, 
+        builder.MapGet("api/execution/risks", async (ExecutionService service, 
             int page = 1, int pageSize = 100, CancellationToken cancellationToken = default) =>
-                await service.GetRisksAsync(Pagination.Create(page, pageSize), cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var risks } => Results.Ok(risks),
+            var result = await service.GetRisksAsync(Pagination.Create(page, pageSize), cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.NotFound();
         })
         .WithDescription("Get a list of all risks")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetRisksEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
-            .Produces<Risk[]>(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status200OK)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .WithTags(EndpointTags.Execution);
-            .WithTags(EndpointTags.Execution)
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Execution/GetRuleEndpoint.cs

@@ -1,35 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Execution;
-
-[ApiVersionTarget(1)]
-public sealed class GetRuleEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/execution/rules/{ruleId}", async (string ruleId, IExecutionService service,
-            CancellationToken cancellationToken = default) =>
-                await service.GetRuleAsync(ruleId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var rules } => Results.Ok(rules),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get a specific programme rule")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetRuleEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Rule>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Execution)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Execution/GetRulesEndpoint.cs

@@ -1,32 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Execution;
-
-[ApiVersionTarget(1)]
-public sealed class GetRulesEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/execution/programmes/rules", async (Pagination pagination, IExecutionService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetRulesAsync(pagination, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var rules } => Results.Ok(rules),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get a list of all programme rules")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetRulesEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Rule[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Execution)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Execution/UpdateDisbursementEndpoint.cs

@@ -1,33 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Execution;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Execution;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateDisbursementEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/execution/disbursements", async (UpdateDisbursementRequest request, HttpContext context, 
-            IExecutionService service, CancellationToken cancellationToken = default) =>
-                await service.UpdateDisbursementAsync(request, userId: context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Update the details of a specific disbursement")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdateDisbursementEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Execution);
-    }
-}

PostFundManagement.Api/Endpoints/Execution/UpdateRiskEndpoint.cs

@@ -1,33 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Execution;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Execution;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateRiskEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/execution/risks", async (UpdateRiskRequest request, 
-            IExecutionService service, CancellationToken cancellationToken = default) => 
-                await service.UpdateRiskAsync(request, cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Update the details of a specific risk")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdateRiskEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Execution);
-    }
-}

PostFundManagement.Api/Endpoints/Execution/UpdateRuleEndpoint.cs

@@ -1,33 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Execution;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Execution;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateRuleEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/execution/rules", async (UpdateRuleRequest request, HttpContext context,
-            IExecutionService service, CancellationToken cancellationToken = default) =>
-                await service.UpdateRuleAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Update the details of a specific programme rule (supplied version auto-increment)")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdateRuleEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Execution);
-    }
-}

PostFundManagement.Api/Endpoints/Governance/CreateInstrumentEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Governance;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class CreateInstrumentEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/governance/instruments", async (CreateInstrumentRequest request, HttpContext context,
-            IGovernanceService service, CancellationToken cancellationToken = default) =>
-                await service.CreateInstrumentAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true} => Results.Ok(),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Creates a new programme funding instrument")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateInstrumentEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Governance/CreateOrganisationEndpoint.cs

@@ -1,33 +1,30 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Governance;
 
 [ApiVersionTarget(1)]
-public sealed class CreateOrganisationEndpoint : IEndpoint
+public class CreateOrganisationEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/governance/organisations", async (CreateOrganisationRequest request, HttpContext context, 
-            IGovernanceService service, CancellationToken cancellationToken = default) =>
+            GovernanceService service, CancellationToken cancellationToken = default) =>
-                await service.CreateOrganisationAsync(request, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } => Results.Ok(),
+            var result = await service.CreateOrganisationAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                ? Results.Ok()
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Create a new organization profile")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(CreateOrganisationEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .Produces(StatusCodes.Status401Unauthorized)
         .WithTags(EndpointTags.Governance);
     }

PostFundManagement.Api/Endpoints/Governance/CreatePortfolioEndpoint.cs

@@ -1,37 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Governance;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class CreatePortfolioEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/governance/organisations/portfolio", async (CreatePortfolioRequest request, HttpContext context,
-            IGovernanceService service, CancellationToken cancellationToken = default) =>
-                await service.CreatePortfolioAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Create a new organization portfolio")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreatePortfolioEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Governance);
-    }
-}

PostFundManagement.Api/Endpoints/Governance/CreateTenantEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Governance;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class CreateTenantEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/governance/tenants", async (CreateTenantRequest request, IGovernanceService service, HttpContext context,
-            CancellationToken cancellationToken = default) =>
-                await service.CreateTenantAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Create a new tenant")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateTenantEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)                        
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance);
-    }
-}

PostFundManagement.Api/Endpoints/Governance/DashboardEndpoint.cs

@@ -1,8 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Governance;
 
@@ -11,21 +11,21 @@ public class DashboardEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/governance/dashboard", async (IGovernanceService service,
+        builder.MapGet("api/governance/dashboard", async (GovernanceService service,
             CancellationToken cancellationToken = default) =>
-                await service.GetDashboardAsync(cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var dashboard } => Results.Ok(dashboard),
+            var result = await service.GetDashboardAsync(cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Get executive portfolio dashboard metrics and KPIs")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(DashboardEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Dashboard>(StatusCodes.Status200OK)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .WithTags(EndpointTags.Governance);
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Governance/GetAuditLogsEndpoint.cs

@@ -1,33 +0,0 @@
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Shared;
-using PostFundManagement.Domain;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class GetAuditLogsEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/governance/auditlog", async (Pagination pagination, AuditService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetAuditLogsAsync(pagination, cancellationToken) switch
-                {
-                    {  IsSuccess: true, Value: var logs } => Results.Ok(logs),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Retrieves audit logs based on pagination parameters")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetAuditLogsEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<AuditLog[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Governance/GetInstrumentsEndpoint.cs

@@ -1,9 +1,9 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Governance;
 
@@ -12,23 +12,21 @@ public class GetInstrumentsEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/governance/instruments/{programmeId}", async (string programmeId, IGovernanceService service, 
+        builder.MapGet("api/governance/instruments", async (GovernanceService service, 
             CancellationToken cancellationToken = default) =>
-                await service.GetInstrumentsAsync(programmeId, cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var instruments } => Results.Ok(instruments),
+            var result = await service.GetInstrumentsAsync(cancellationToken);
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Get all funding instruments")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetInstrumentsEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Instrument[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .WithTags(EndpointTags.Governance);
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Governance/GetOrganisationByIdEndpoint.cs

@@ -0,0 +1,32 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public class GetOrganisationByIdEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/organisations/{organisationId}", async (string organisationId,
+            GovernanceService service, CancellationToken cancellationToken = default) =>
+        {
+            var result = await service.GetOrganisationByIdAsync(organisationId, cancellationToken);
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.NotFound();
+        })
+        .WithDescription("Get organization profile by ID")
+        .WithName(typeof(GetOrganisationByIdEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces<Organisation>(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status404NotFound)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .WithTags(EndpointTags.Governance);
+    }
+}

PostFundManagement.Api/Endpoints/Governance/GetOrganisationEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public class GetOrganisationEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/governance/organisations/{organisationId}", async (string organisationId,
-            IGovernanceService service, CancellationToken cancellationToken = default) =>
-                await service.GetOrganisationAsync(organisationId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var organisation } => Results.Ok(organisation),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get organization profile by ID")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetOrganisationEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Organisation>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Governance/GetOrganisationPortfoliosEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public class GetOrganisationPortfoliosEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/governance/organisations/{organisationId}/portfolio", async (string organisationId,
-            IGovernanceService service, CancellationToken cancellationToken = default) =>
-                await service.GetOrganisationPorfoliosAsync(organisationId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var portfolios } => Results.Ok(portfolios),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get all portfolios belonging to a specific organisation")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetOrganisationPortfoliosEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Portfolio[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Governance/GetOrganisationsEndpoint.cs

@@ -1,9 +1,10 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Governance;
 
@@ -12,21 +13,21 @@ public class GetOrganisationsEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/governance/organisations", async (IGovernanceService service, 
+        builder.MapGet("api/governance/organisations", async (GovernanceService service, 
             int page = 1, int pageSize = 100, CancellationToken cancellationToken = default) =>
-                await service.GetOrganisationsAsync(Pagination.Create(page, pageSize), cancellationToken) switch
         {
-                    {  IsSuccess: true, Value: var orgnanisations } => Results.Ok(orgnanisations),
+            var result = await service.GetOrganisationsAsync(Pagination.Create(page, pageSize), cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Get a paginated directory of organizations")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetOrganisationsEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Organisation[]>(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Governance)
+        .WithTags(EndpointTags.Governance);
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Governance/GetPorfolioValueEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class GetPorfolioValueEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/governance/portfolios/{portfolioId}/value", async (string portfolioId, IGovernanceService service,
-            CancellationToken cancellationToken = default) =>
-                await service.GetPorfolioValueAsync(portfolioId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var amount } => Results.Ok(amount),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Calculates and returns a portfolio's total project's budget value")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetPorfolioValueEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<decimal>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Governance/GetPortfolioEndpoint.cs

@@ -1,35 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class GetPortfolioEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/governance/portfolios/{portfolioId}", async (string portfolioId, IGovernanceService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetPortfolioAsync(portfolioIdHash: portfolioId, cancellationToken) switch
-                {
-                    {  IsSuccess: true, Value: var portfolio } => Results.Ok(portfolio),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get a specific portfolios")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetPortfolioEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Portfolio[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Governance/GetPortfolioProgrammesEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class GetPortfolioProgrammesEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/governance/portfolios/{portfolioId}/programmes", async (string portfolioId, IGovernanceService service,
-            CancellationToken cancellationToken = default) =>
-                await service.GetPortfolioProgrammesAsync(portfolioId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var portfolios } => Results.Ok(portfolios),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get a programme's portfolios")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetPortfolioProgrammesEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Programme[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Governance/GetPortfoliosEndpoint.cs

@@ -1,33 +1,32 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain;
+using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Governance;
 
 [ApiVersionTarget(1)]
-public sealed class GetPortfoliosEndpoint : IEndpoint
+public class GetPortfoliosEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapPost("api/governance/organisations/portfolios", async (Pagination pagination, IGovernanceService service, 
+        builder.MapGet("api/governance/portfolios", async (GovernanceService service, 
             CancellationToken cancellationToken = default) =>
-                await service.GetPorfoliosAsync(pagination, cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var portfolios } => Results.Ok(portfolios),
+            var result = await service.GetPorfoliosAsync(cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Get all portfolios")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetPortfoliosEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Portfolio[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .WithTags(EndpointTags.Governance);
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Governance/GetProgrammeValueEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class GetProgrammeValueEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/governance/programmes/{programmeId}/value", async (string programmeId, IGovernanceService service,
-            CancellationToken cancellationToken = default) =>
-                await service.GetProgrammeValueAsync(programmeId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var amount } => Results.Ok(amount),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Calculates and returns a programme's total project budget value")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetProgrammeValueEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<decimal>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Governance/GetProgrammesEndpoint.cs

@@ -1,9 +1,9 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Governance;
 
@@ -12,23 +12,21 @@ public class GetProgrammesEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/governance/programmes/{portfolioId}", async (string portfolioId, IGovernanceService service, 
+        builder.MapGet("api/governance/programmes", async (GovernanceService service, 
             CancellationToken cancellationToken = default) =>
-                await service.GetProgrammesAsync(portfolioId, cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var programmes } => Results.Ok(programmes),
+            var result = await service.GetProgrammesAsync(cancellationToken);
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Get all programmes")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetProgrammesEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Programme[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .WithTags(EndpointTags.Governance);
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Governance/GetTenantEndpoint.cs

@@ -1,35 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class GetTenantEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/governance/tenants/{tenantId}", async (string tenantId, IGovernanceService service,
-            CancellationToken cancellationToken = default) =>
-                await service.GetTenantAsync(tenantId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var tenant } => Results.Ok(tenant),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Gets a single tenant")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetTenantsEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Tenant>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance);
-    }
-}

PostFundManagement.Api/Endpoints/Governance/GetTenantOrganisationsEndpoint.cs

@@ -1,33 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class GetTenantOrganisationsEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/governance/tenants/{tenantIdHash}/organisations", async (IGovernanceService service, string tenantIdHash,
-            CancellationToken cancellationToken = default) =>
-                await service.GetTenantOrganisationsAsync(tenantIdHash, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var tenantOrganisations } => Results.Ok(tenantOrganisations),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Gets organisations created and managed by one tenant")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetTenantOrganisationsEndpoint).ToEndpointName("Retrieval"))
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<TenantOrganisation[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance);
-    }
-}

PostFundManagement.Api/Endpoints/Governance/GetTenantUsersEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class GetTenantUsersEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/governance/tenants/{tenantIdHash}/users", async (IGovernanceService service, string tenantIdHash,
-            CancellationToken cancellationToken = default) =>
-                await service.GetTenantUsersAsync(tenantIdHash, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var tenantUsers } => Results.Ok(tenantUsers),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Gets users created and managed by one tenant")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetTenantUsersEndpoint).ToEndpointName("Retrieval"))
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<TenantUser[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance);
-    }
-}
-

PostFundManagement.Api/Endpoints/Governance/GetTenantsEndpoint.cs

@@ -1,30 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Entities;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class GetTenantsEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/governance/tenants", async (IGovernanceService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetTenantsAsync(cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var tenants } => Results.Ok(tenants),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Gets system tenants")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetTenantsEndpoint).ToEndpointName("Retrieval"))
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Tenant[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance);
-    }
-}

PostFundManagement.Api/Endpoints/Governance/UpdateInstrumentEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Governance;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateInstrumentEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/governance/instruments", async (UpdateInstrumentRequest request, HttpContext context,
-            IGovernanceService service, CancellationToken cancellationToken = default) =>
-                await service.UpdateInstrumentAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
-                })
-            .WithDescription("Updates a programme funding instrument")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdateInstrumentEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Governance/UpdateOrganisationEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Governance;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateOrganisationEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/governance/organisations", async (UpdateOrganisationRequest request,
-            IGovernanceService service, HttpContext context, CancellationToken cancellationToken = default) =>
-                await service.UpdateOrganisationAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Update an existing organization profile")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdateOrganisationEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance);
-    }
-}

PostFundManagement.Api/Endpoints/Governance/UpdatePortfolioEndpoint.cs

@@ -1,37 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Governance;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class UpdatePortfolioEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/governance/organisations/portfolio", async (UpdatePortfolioRequest request, HttpContext context, 
-            IGovernanceService service, CancellationToken cancellationToken = default) =>
-                await service.UpdatePortfolioAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    {  IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Update an existing organization portfolio")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdatePortfolioEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance);
-    }
-}

PostFundManagement.Api/Endpoints/Governance/UpdateTenantEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Governance;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Governance;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateTenantEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/governance/tenants", async (UpdateTenantRequest request, HttpContext context, 
-            IGovernanceService service, CancellationToken cancellationToken = default) =>
-                await service.UpdateTenantAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Updates a specific tenant")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdateTenantEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance);
-    }
-}

PostFundManagement.Api/Endpoints/Grants/CreateAwardEndpoint.cs

@@ -1,9 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Grants;
 
@@ -13,24 +12,20 @@ public class CreateAwardEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/grants/awards", async (CreateAwardRequest request, HttpContext context, 
-            IGrantsService service, CancellationToken cancellationToken = default) =>
+            GrantsService service, CancellationToken cancellationToken = default) =>
-                await service.CreateAwardAsync(request, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } => Results.Ok(),
+            var result = await service.CreateAwardAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                ? Results.Ok()
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Register an approved funding award (M01)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(CreateAwardEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .WithTags(EndpointTags.Grants);
     }
 }

PostFundManagement.Api/Endpoints/Grants/CreateBudgetEndpoint.cs

@@ -1,9 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Grants;
 
@@ -13,24 +12,19 @@ public class CreateBudgetEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/grants/budgets", async (CreateBudgetRequest request, HttpContext context,
-            IGrantsService service, CancellationToken cancellationToken = default) =>
+            GrantsService service, CancellationToken cancellationToken = default) =>
-                await service.CreateBudgetAsync(request, context.GetUserId(), cancellationToken) switch
         {
-                    {  IsSuccess: true } => Results.Ok(),
+            var result = await service.CreateBudgetAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                ? Results.Ok()
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Create a new budget line (M05)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(CreateBudgetEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status400BadRequest)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .Produces(StatusCodes.Status401Unauthorized)
         .WithTags(EndpointTags.Grants);
     }

PostFundManagement.Api/Endpoints/Grants/CreateContractEndpoint.cs

@@ -1,9 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Grants;
 
@@ -13,22 +12,19 @@ public class CreateContractEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/grants/contracts", async (CreateContractRequest request, HttpContext context,
-            IGrantsService service, CancellationToken cancellationToken = default) =>
+            GrantsService service, CancellationToken cancellationToken = default) =>
-                await service.CreateContractAsync(request, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } => Results.Ok(),
+            var result = await service.CreateContractAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                ? Results.Ok()
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Create a contract record from an approved award (M02)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(CreateContractEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .Produces(StatusCodes.Status401Unauthorized)
         .WithTags(EndpointTags.Grants);
     }

PostFundManagement.Api/Endpoints/Grants/ExecuteContractEndpoint.cs

@@ -1,9 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Grants;
 
@@ -13,20 +12,19 @@ public class ExecuteContractEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/grants/contracts/execute", async (ExecuteContractRequest request, HttpContext context,
-            IGrantsService service, CancellationToken cancellationToken = default) =>
+            GrantsService service, CancellationToken cancellationToken = default) =>
-                await service.ExecuteContractAsync(request, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } => Results.Ok(),
+            var result = await service.ExecuteContractAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+            return result.IsSuccess
+                ? Results.Ok()
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Execute the contract and lock the contractual version")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(ExecuteContractEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .Produces(StatusCodes.Status401Unauthorized)
         .WithTags(EndpointTags.Grants);
     }

PostFundManagement.Api/Endpoints/Grants/GetAwardByIdEndpoint.cs

@@ -0,0 +1,32 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public class GetAwardByIdEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/grants/awards/{awardId}", async (string awardId, GrantsService service,
+            CancellationToken cancellationToken = default) =>
+        {
+            var result = await service.GetAwardByIdAsync(awardId, cancellationToken);
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.NotFound();
+        })
+        .WithDescription("Get award by ID")
+        .WithName(typeof(GetAwardByIdEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces<Award>(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status404NotFound)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .WithTags(EndpointTags.Grants);
+    }
+}

PostFundManagement.Api/Endpoints/Grants/GetAwardEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Grants;
-
-[ApiVersionTarget(1)]
-public class GetAwardEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/grants/awards/{awardId}", async (string awardId, IGrantsService service,
-            CancellationToken cancellationToken = default) =>
-                await service.GetAwardAsync(awardId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var award } => Results.Ok(award),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get award by ID")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetAwardEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Award>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Grants)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Grants/GetAwardsEndpoint.cs

@@ -1,9 +1,10 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Grants;
 
@@ -12,21 +13,21 @@ public class GetAwardsEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/grants/awards", async (IGrantsService service, 
+        builder.MapGet("api/grants/awards", async (GrantsService service, 
             int page = 1, int pageSize = 10, CancellationToken cancellationToken = default) =>
-                await service.GetAwardsAsync(Pagination.Create(page, pageSize), cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var awards } => Results.Ok(awards),
+            var result = await service.GetAwardsAsync(Pagination.Create(page, pageSize), cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Get a list of awards")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetAwardsEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Award[]>(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Grants)
+        .WithTags(EndpointTags.Grants);
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Grants/GetBudgetByIdEndpoint.cs

@@ -0,0 +1,32 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public class GetBudgetByIdEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/grants/budgets/{budgetId}", async (string budgetId, GrantsService service, 
+            CancellationToken cancellationToken = default) =>
+        {
+            var result = await service.GetBudgetByIdAsync(budgetId, cancellationToken);
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.NotFound();
+        })
+        .WithDescription("Get budget by ID")
+        .WithName(typeof(GetBudgetByIdEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces<Budget>(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status404NotFound)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .WithTags(EndpointTags.Grants);
+    }
+}

PostFundManagement.Api/Endpoints/Grants/GetBudgetEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Grants;
-
-[ApiVersionTarget(1)]
-public class GetBudgetEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/grants/budgets/{budgetId}", async (string budgetId, IGrantsService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetBudgetAsync(budgetId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var budget } => Results.Ok(budget),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get budget by ID")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetBudgetEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Budget>(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Grants)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Grants/GetBudgetsEndpoint.cs

@@ -1,9 +1,10 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Grants;
 
@@ -12,21 +13,21 @@ public class GetBudgetsEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/grants/budgets", async (IGrantsService service, 
+        builder.MapGet("api/grants/budgets", async (GrantsService service, 
             int page = 1, int pageSize = 100, CancellationToken cancellationToken = default) =>
-                await service.GetBudgetsAsync(Pagination.Create(page, pageSize), cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var budgets } => Results.Ok(budgets),
+            var result = await service.GetBudgetsAsync(Pagination.Create(page, pageSize), cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Get all budgets")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetBudgetsEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Budget[]>(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Grants)
+        .WithTags(EndpointTags.Grants);
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Grants/GetContractByIdEndpoint.cs

@@ -0,0 +1,32 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public class GetContractByIdEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/grants/contracts/{contractId}", async (string contractId, GrantsService service, 
+            CancellationToken cancellationToken = default) =>
+        {
+            var result = await service.GetContractByIdAsync(contractId, cancellationToken);
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.NotFound();
+        })
+        .WithDescription("Get contract by ID")
+        .WithName(typeof(GetContractByIdEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces<Contract>(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status404NotFound)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .WithTags(EndpointTags.Grants);
+    }
+}

PostFundManagement.Api/Endpoints/Grants/GetContractEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Grants;
-
-[ApiVersionTarget(1)]
-public class GetContractEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/grants/contracts/{contractId}", async (string contractId, IGrantsService service, 
-            CancellationToken cancellationToken = default) =>
-                await service.GetContractAsync(contractId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var contract } => Results.Ok(contract),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Get contract by ID")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetContractEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Contract>(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Grants)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Grants/GetContractUrlEndpoint.cs

@@ -1,35 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Grants;
-
-[ApiVersionTarget(1)]
-public sealed class GetContractUrlEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/grants/contracts/{contractId}/securelink", async (string contractId, IGrantsService service,
-            CancellationToken cancellationToken = default) =>
-                await service.GetContractUrlAsync(contractId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var contractUrl} => Results.Ok(contractUrl),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Gets a secure download URL, has expiry period (default 15min)")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetContractUrlEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<string>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Grants)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Grants/GetContractsEndpoint.cs

@@ -1,9 +1,10 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Grants;
 
@@ -12,21 +13,21 @@ public class GetContractsEndpoint : IEndpoint
 {
     public void Map(IEndpointRouteBuilder builder)
     {
-        builder.MapGet("api/grants/contracts", async (IGrantsService service, 
+        builder.MapGet("api/grants/contracts", async (GrantsService service, 
             int page = 1, int pageSize = 100, CancellationToken cancellationToken = default) =>
-                await service.GetContractsAsync(Pagination.Create(page, pageSize), cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var contracts } => Results.Ok(contracts),
+            var result = await service.GetContractsAsync(Pagination.Create(page, pageSize), cancellationToken);
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Get all contracts")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetContractsEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Contract[]>(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
         .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Grants)
+        .WithTags(EndpointTags.Grants);
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Grants/UpdateAwardEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Grants;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Grants;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateAwardEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/grants/awards", async (UpdateAwardRequest request, HttpContext context,
-            IGrantsService service, CancellationToken cancellationToken = default) =>
-                await service.UpdateAwardAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Updates a registered funding award")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdateAwardEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Grants);
-    }
-}

PostFundManagement.Api/Endpoints/Grants/UpdateBudgetEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Grants;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Grants;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateBudgetEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/grants/budgets", async (UpdateBudgetRequest request, HttpContext context,
-            IGrantsService service, CancellationToken cancellationToken = default) =>
-                await service.UpdateBudgetAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Updates a specific budget")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdateBudgetEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)            
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Governance)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Grants/UpdateContractEndpoint.cs

@@ -1,37 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Grants;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Grants;
-
-[ApiVersionTarget(1)]
-public sealed class UpdateContractEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPut("api/grants/contracts", async (UpdateContractRequest request, IGrantsService service,
-            CancellationToken cancellationToken = default) =>
-                await service.UpdateContractAsync(request, cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Updates a specific contract")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(UpdateContractEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Grants)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Grants/UploadContractEndpoint.cs

@@ -1,45 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Grants;
-
-[ApiVersionTarget(1)]
-public sealed class UploadContractEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/grants/contracts/{contractId}", async (string contractId, HttpRequest request, IGrantsService service, 
-            CancellationToken cancellationToken = default) =>
-        {
-            if (!request.HasFormContentType)
-                return Results.BadRequest("Request must be a multipart form.");
-
-            var form = await request.ReadFormAsync(cancellationToken);
-            var file = form.Files.GetFile("file");
-
-            if (file == null || file.Length == 0)
-                return Results.BadRequest("No file uploaded or file is empty.");
-
-            return await service.UploadContractAsync(contractId, request.HttpContext.GetUserId(), file, cancellationToken) switch
-            {
-                { IsSuccess: true } => Results.Ok(),
-                var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                var r => Results.InternalServerError(r.Errors.ToProblems())
-            };
-        })
-        .WithDescription("Uploads a contract file securely")
-        .RequireAuthorization(Constants.MainScope)
-        .DisableAntiforgery()
-        .WithName(typeof(UploadContractEndpoint).ToEndpointName())
-        .MapToApiVersion(new ApiVersion(1))
-        .Produces(StatusCodes.Status200OK)
-        .Produces(StatusCodes.Status403Forbidden)
-        .Produces(StatusCodes.Status401Unauthorized)
-        .Produces<Problems>(StatusCodes.Status500InternalServerError)
-        .WithTags(EndpointTags.Grants)
-        .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Projects/CreateActivityEndpoint.cs

@@ -1,9 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Projects;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Projects;
 
@@ -13,22 +12,19 @@ public class CreateActivityEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/projects/activities", async (CreateActivityRequest request, 
-            HttpContext context, IProjectService service, CancellationToken cancellationToken = default) =>
+            HttpContext context, ProjectService service, CancellationToken cancellationToken = default) =>
-                await service.CreateActivityAsync(request, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } result => Results.Ok(),
+            var result = await service.CreateActivityAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                ? Results.Ok()
+                : Results.BadRequest(result.Errors.ToProblems());
         })
-            .RequireAuthorization(Constants.MainScope)
         .WithDescription("Add a new activity under project (M04)")
         .WithName(typeof(CreateActivityEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
         .Produces(StatusCodes.Status401Unauthorized)
         .WithTags(EndpointTags.Projects);
     }

PostFundManagement.Api/Endpoints/Projects/CreateBeneficiaryEndpoint.cs

@@ -1,33 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Projects;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Projects;
-
-[ApiVersionTarget(1)]
-public sealed class CreateBeneficiaryEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/projects/beneficiaries", async (CreateBeneficiaryRequest request, HttpContext context,
-            IProjectService service, CancellationToken cancellationToken = default) =>
-                await service.CreateBeneficiaryAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Add a new project beneficiary")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateBeneficiaryEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Projects);
-    }
-}

PostFundManagement.Api/Endpoints/Projects/CreateChangeRequestEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Projects;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Projects;
-
-[ApiVersionTarget(1)]
-public sealed class CreateChangeRequestEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/projects/changerequests", async (CreateChangeRequest request, IProjectService service,
-            HttpContext context, CancellationToken cancellationToken = default) =>
-                await service.CreateChangeRequestAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems()),
-                })
-            .WithDescription("Create a new change request against an existing project")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateChangeRequestEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Projects);
-    }
-}

PostFundManagement.Api/Endpoints/Projects/CreateComplianceItemEndpoint.cs

@@ -1,34 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Projects;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Projects;
-
-[ApiVersionTarget(1)]
-public sealed class CreateComplianceItemEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/projects/complianceitems", async (CreateComplianceItemRequest request, HttpContext context,
-            IProjectService service, CancellationToken cancellationToken = default) => 
-                await service.CreateComplianceItemAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    {  IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Add a new beneficiary compliance item")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateComplianceItemEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Projects);
-    }
-}

PostFundManagement.Api/Endpoints/Projects/CreateIssueEndpoint.cs

@@ -1,33 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Projects;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Projects;
-
-[ApiVersionTarget(1)]
-public sealed class CreateIssueEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/projects/issues", async (CreateIssueRequest request, HttpContext context,
-            IProjectService service, CancellationToken cancellationToken = default) =>
-                await service.CreateIssueAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Add a new project issue")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateIssueEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Projects);
-    }
-}

PostFundManagement.Api/Endpoints/Projects/CreateOutcomeEndpoint.cs

@@ -1,46 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Projects;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Projects;
-
-[ApiVersionTarget(1)]
-public sealed class CreateOutcomeEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/projects/beneficiaries/outcomes", HandleCreateAsync)
-            .WithDescription("Add a new beneficiary outcome")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateOutcomeEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Projects);
-
-        builder.MapPost("api/projects/beneficiaris/outcomes", HandleCreateAsync)
-            .WithDescription("Add a new beneficiary outcome (legacy route)")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateOutcomeEndpoint).ToEndpointName("TypoAlias"))
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Projects);
-    }
-
-    private static async Task<IResult> HandleCreateAsync(CreateOutcomeRequest request, HttpContext context,
-        IProjectService service, CancellationToken cancellationToken = default) =>
-        await service.CreateOutcomeAsync(request, context.GetUserId(), cancellationToken) switch
-        {
-            { IsSuccess: true } => Results.Ok(),
-            var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-            var r => Results.InternalServerError(r.Errors.ToProblems())
-        };
-}

PostFundManagement.Api/Endpoints/Projects/CreateProgrammeEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Projects;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Projects;
-
-[ApiVersionTarget(1)]
-public sealed class CreateProgrammeEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/projects/programme", async (CreateProgrammeRequest request, HttpContext context,
-            IProjectService service, CancellationToken cancellationToken = default) =>
-                await service.CreateProgrammeAsync(request, userId: context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Create programme")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateProgrammeEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Projects);
-    }
-}

PostFundManagement.Api/Endpoints/Projects/CreateProjectEndpoint.cs

@@ -1,9 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Projects;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Projects;
 
@@ -13,23 +12,19 @@ public class CreateProjectEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("api/projects", async (CreateProjectRequest request, HttpContext context,
-            IProjectService service, CancellationToken cancellationToken = default) =>
+            ProjectService service, CancellationToken cancellationToken = default) =>
-                await service.CreateProjectAsync(request, context.GetUserId(), cancellationToken) switch
         {
-                    { IsSuccess: true } result => Results.Ok(),
+            var result = await service.CreateProjectAsync(request, context.GetUserId(), cancellationToken);
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+
-                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+            return result.IsSuccess
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                ? Results.Ok()
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                : Results.BadRequest(result.Errors.ToProblems());
         })
         .WithDescription("Create a new project (M04)")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(CreateProjectEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
+        .Produces<Microsoft.AspNetCore.Mvc.ProblemDetails>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
         .Produces(StatusCodes.Status401Unauthorized)
         .WithTags(EndpointTags.Projects);
     }

PostFundManagement.Api/Endpoints/Projects/CreateSiteVisitEndpoint.cs

@@ -1,33 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Application.Services.Projects;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Projects;
-
-[ApiVersionTarget(1)]
-public sealed class CreateSiteVisitEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapPost("api/projects/sitevisits", async (CreateSiteVisitRequest request, HttpContext context,
-            IProjectService service, CancellationToken cancellationToken = default) =>
-                await service.CreateSiteVisitAsync(request, context.GetUserId(), cancellationToken) switch
-                {
-                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Add a new project site visit")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(CreateSiteVisitEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .WithTags(EndpointTags.Projects);
-    }
-}

PostFundManagement.Api/Endpoints/Projects/GetActivitiesEndpoint.cs

@@ -1,8 +1,8 @@
-using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Security;
 
 namespace PostFundManagement.Api.Endpoints.Projects;
 
@@ -12,22 +12,19 @@ public class GetActivitiesEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapGet("api/projects/{projectId}/activities", async (string projectId,
-            IProjectService service, CancellationToken cancellationToken = default) =>
+            ProjectService service, CancellationToken cancellationToken = default) =>
-                await service.GetActivitiesAsync(projectId, cancellationToken) switch
         {
-                    { IsSuccess: true, Value: var activities } => Results.Ok(activities),
+            var result = await service.GetActivitiesAsync(projectId, cancellationToken);
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
+            return result.IsSuccess
+                ? Results.Ok(result.Value)
+                : Results.NotFound();
         })
         .WithDescription("Get a list of activities for a project")
-            .RequireAuthorization(Constants.MainScope)
         .WithName(typeof(GetActivitiesEndpoint).ToEndpointName())
         .MapToApiVersion(new ApiVersion(1))
         .Produces<Domain.Models.Activity[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
         .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .WithTags(EndpointTags.Projects);
-            .WithTags(EndpointTags.Projects)
-            .CacheOutput();
     }
 }

PostFundManagement.Api/Endpoints/Projects/GetActivityEndpoint.cs

@@ -1,35 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-
-namespace PostFundManagement.Api.Endpoints.Projects;
-
-[ApiVersionTarget(1)]
-public class GetActivityEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/projects/activities/{activityId}", async (string activityId,
-            IProjectService service, CancellationToken cancellationToken = default) =>
-                await service.GetActivityAsync(activityId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var activity } => Results.Ok(activity),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Gets a specific activity by it's id")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetActivityEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Domain.Models.Activity>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Projects)
-            .CacheOutput();
-    }
-}

PostFundManagement.Api/Endpoints/Projects/GetBeneficiariesEndpoint.cs

@@ -1,36 +0,0 @@
-using PostFundManagement.Application.Abstractions.Services;
-using PostFundManagement.Application.Extensions;
-using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
-using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Models;
-
-namespace PostFundManagement.Api.Endpoints.Projects;
-
-[ApiVersionTarget(1)]
-public sealed class GetBeneficiariesEndpoint : IEndpoint
-{
-    public void Map(IEndpointRouteBuilder builder)
-    {
-        builder.MapGet("api/projects/{projectId}/beneficiaries", async (string projectId, IProjectService service,
-            CancellationToken cancellationToken = default) =>
-                await service.GetBeneficiariesAsync(projectId, cancellationToken) switch
-                {
-                    { IsSuccess: true, Value: var beneficiaries } => Results.Ok(beneficiaries),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Gets project beneficiaries")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(GetBeneficiariesEndpoint).ToEndpointName("Retrieval"))
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces<Beneficiary[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status403Forbidden)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Projects)
-            .CacheOutput();
-    }
-}