LibraryOS

Clean Architecture and live availability for a community library.

open --live git clone

// stack

ASP.NET Core 8
React 19
SignalR
Clean Architecture
PostgreSQL
JWT refresh rotation
Azure App Service
Vercel

// THE PROBLEM

A community library needed to replace manual card-based cataloguing. Patrons and librarians needed real-time book availability — "is this book on the shelf right now?" — without refreshing a page. The auth layer also needed to be production-grade: refresh token rotation, rate limiting, and no silent auth failures under concurrent usage.

// WHAT I BUILT

A Clean Architecture REST API with 35+ endpoints across 7 controllers. JWT access + refresh token rotation with fixed-window rate limiting. SignalR group-based notifications: a background service probes active loans daily and pushes due-date alerts via WebSocket groups. Eliminated N+1 queries with eager-loaded GetAllAsync() + .Include(). PostgreSQL health check probes (/health/ready, /health/live) wired as Azure liveness and readiness probes — the deployment only promotes when the database connection is confirmed healthy.

// THE KEY DECISION

Fixing the JWT refresh race condition. When multiple Axios requests fired simultaneously and the access token expired mid-flight, each independently triggered a refresh — each one invalidating the previous token and sending the user into an infinite auth loop. The fix: a subscriber queue. The first request owns the refresh and sets a promise. All subsequent concurrent requests subscribe to that promise. When it resolves, every queued request resumes with the same new token.

// WHAT IT TAUGHT ME

Race conditions in auth flows are invisible in development (one user, one tab) and catastrophic in production (multiple tabs, slow mobile connections). The subscriber queue pattern is now my default approach for token refresh in any SPA. The N+1 audit also highlighted that ORM lazy loading is a performance trap at scale — every GetAll endpoint needs explicit Include chains.

// REAL-WORLD IMPACT

A real community library gains a cataloguing system that previously would have required purchasing commercial software. The health check probes mean a failed database connection is caught before Azure routes traffic to the instance, preventing silent 500 errors. The rate limiter prevents credential-stuffing attacks on the auth endpoints.