From 4221ca1f2c1efb33ff8c2dfc4be8f09ea72af072 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Sun, 29 Mar 2026 13:26:51 +0100
Subject: [PATCH 01/18] Checkpoint from VS Code for cloud agent session

---
 docker-compose.yaml                           | 13 ++++
 ...fE.CheckPerformanceData.Application.csproj |  9 +++
 .../DfESignInApiClient/IDfESignInApiClient.cs |  6 ++
 .../DfESignInApiClient/OrganisationDto.cs     | 67 +++++++++++++++++++
 ...CheckPerformanceData.Infrastructure.csproj | 24 +++++++
 .../DfeSignIn/DfeSignInAuthExtensions.cs      | 65 ++++++++++++++++++
 .../DfeSignInApiClient/DfeSignInApiClient.cs  | 21 ++++++
 .../DfeSignInApiClientExtensions.cs           | 42 ++++++++++++
 .../DfeSignInApiClient/DfeSigninSettings.cs   | 12 ++++
 .../Controllers/HomeController.cs             |  2 +
 .../Controllers/SecretController.cs           | 37 ++++++++++
 .../Controllers/SecretViewModel.cs            |  8 +++
 .../DfE.CheckPerformanceData.Web.csproj       |  3 +
 src/DfE.CheckPerformanceData.Web/Program.cs   | 14 +++-
 .../Views/Home/Index.cshtml                   | 10 +--
 .../Views/Secret/Index.cshtml                 |  9 +++
 src/DfE.CheckPerformanceData.slnx             |  2 +
 src/Directory.Packages.props                  |  9 +++
 18 files changed, 346 insertions(+), 7 deletions(-)
 create mode 100644 src/DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj
 create mode 100644 src/DfE.CheckPerformanceData.Application/DfESignInApiClient/IDfESignInApiClient.cs
 create mode 100644 src/DfE.CheckPerformanceData.Application/DfESignInApiClient/OrganisationDto.cs
 create mode 100644 src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj
 create mode 100644 src/DfE.CheckPerformanceData.Infrastructure/DfeSignIn/DfeSignInAuthExtensions.cs
 create mode 100644 src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClient.cs
 create mode 100644 src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClientExtensions.cs
 create mode 100644 src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSigninSettings.cs
 create mode 100644 src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
 create mode 100644 src/DfE.CheckPerformanceData.Web/Controllers/SecretViewModel.cs
 create mode 100644 src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml

diff --git a/docker-compose.yaml b/docker-compose.yaml
index d945f42..ae1b553 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -12,6 +12,13 @@
       - ASPNETCORE_URLS=http://+:8080
       - ConnectionStrings__Postgres=${POSTGRES_CONNECTION_STRING:-Host=db;Database=helloworld;Username=postgres;Password=postgres}
       - ConnectionStrings__AzureStorage=${AZURE_STORAGE_CONNECTION_STRING:-DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;QueueEndpoint=http://azurite:10001/devstoreaccount1;}
+      - DfeSignIn__BaseUrl=${DFESIGNIN_BASEURL:-https://test-api.signin.education.gov.uk/}
+      - DfeSignIn__ClientId=${DFESIGNIN_CLIENTID}
+      - DfeSignIn__ApiClientSecret=${DFESIGNIN_APICLIENTSECRET}
+      - DfeSignIn__Audience=${DFESIGNIN_AUDIENCE:-signin.education.gov.uk}
+      - DfeSignIn__MetadataAddress=${DFESIGNIN_METADATAADDRESS:-https://test-oidc.signin.education.gov.uk/.well-known/openid-configuration}
+      - DfeSignIn__ClientSecret=${DFESIGNIN_CLIENTSECRET}
+      
     depends_on:
       - db
       - azurite
@@ -25,6 +32,12 @@
     environment:
       - ConnectionStrings__Postgres=${POSTGRES_CONNECTION_STRING:-Host=db;Database=helloworld;Username=postgres;Password=postgres}
       - ConnectionStrings__AzureStorage=${AZURE_STORAGE_CONNECTION_STRING:-DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;QueueEndpoint=http://azurite:10001/devstoreaccount1;}
+      - DfeSignIn__BaseUrl=https://test-api.signin.education.gov.uk/
+      - DfeSignIn__ClientId=CheckPerformanceData
+      - DfeSignIn__ApiClientSecret=kineplasty-sickened-camomile-sestine
+      - DfeSignIn__Audience=signin.education.gov.uk
+      - DfeSignIn__MetadataAddress=https://test-oidc.signin.education.gov.uk/.well-known/openid-configuration
+      - DfeSignIn__ClientSecret=inelegant-provide-joining-atheism
       - RulesEngineOptions__QueueName=${RULESENGINEOPTIONS_QUEUENAME:-requests}
       - RulesEngineOptions__RetryDelayMs=${RULESENGINEOPTIONS_RETRYDELAYMS:-1000}
       - RulesEngineOptions__MaxMessagesPerPoll=${RULESENGINEOPTIONS_MAXMESSAGESPERPOLL:-10}
diff --git a/src/DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj b/src/DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj
new file mode 100644
index 0000000..237d661
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj
@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <Nullable>enable</Nullable>
+    </PropertyGroup>
+
+</Project>
diff --git a/src/DfE.CheckPerformanceData.Application/DfESignInApiClient/IDfESignInApiClient.cs b/src/DfE.CheckPerformanceData.Application/DfESignInApiClient/IDfESignInApiClient.cs
new file mode 100644
index 0000000..cbb7d9f
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Application/DfESignInApiClient/IDfESignInApiClient.cs
@@ -0,0 +1,6 @@
+namespace DfE.CheckPerformanceData.Application.DfESignInApiClient;
+
+public interface IDfESignInApiClient
+{
+    Task<OrganisationDto?> GetOrganisationAsync(string userId, string organisationId);
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Application/DfESignInApiClient/OrganisationDto.cs b/src/DfE.CheckPerformanceData.Application/DfESignInApiClient/OrganisationDto.cs
new file mode 100644
index 0000000..9949d57
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Application/DfESignInApiClient/OrganisationDto.cs
@@ -0,0 +1,67 @@
+namespace DfE.CheckPerformanceData.Application.DfESignInApiClient;
+
+public class OrganisationDto
+{
+    public string Id { get; init; }
+    public string Name { get; init; } = string.Empty;
+    public string? LegalName { get; init; }
+    
+    public string? Urn { get; init; }
+    public string? Uid { get; init; }
+    public string? Upin { get; init; }
+    public string? Ukprn { get; init; }
+    public string? EstablishmentNumber { get; init; }
+    
+    public string? Address { get; init; }
+    public string? Telephone { get; init; }
+    public int? StatutoryLowAge { get; init; }
+    public int? StatutoryHighAge { get; init; }
+    public string? LegacyId { get; init; }
+    public string? CompanyRegistrationNumber { get; init; }
+}
+
+
+//
+// [ {
+//     "id" : "09158CF5-A701-47E8-BDCD-4EA201B024A3",
+//     "name" : "Department for Education",
+//     "LegalName" : null,
+//     "category" : {
+//         "id" : "002",
+//         "name" : "Local Authority"
+//     },
+//     "urn" : null,
+//     "uid" : null,
+//     "upin" : null,
+//     "ukprn" : null,
+//     "establishmentNumber" : "001",
+//     "status" : {
+//         "id" : 1,
+//         "name" : "Open",
+//         "tagColor" : "green"
+//     },
+//     "closedOn" : null,
+//     "address" : null,
+//     "telephone" : null,
+//     "statutoryLowAge" : null,
+//     "statutoryHighAge" : null,
+//     "legacyId" : "1031237",
+//     "companyRegistrationNumber" : null,
+//     "SourceSystem" : null,
+//     "providerTypeName" : null,
+//     "ProviderTypeCode" : null,
+//     "GIASProviderType" : null,
+//     "PIMSProviderType" : null,
+//     "PIMSProviderTypeCode" : null,
+//     "PIMSStatusName" : null,
+//     "pimsStatus" : null,
+//     "GIASStatusName" : null,
+//     "GIASStatus" : null,
+//     "MasterProviderStatusName" : null,
+//     "MasterProviderStatusCode" : null,
+//     "OpenedOn" : null,
+//     "DistrictAdministrativeName" : null,
+//     "DistrictAdministrativeCode" : null,
+//     "DistrictAdministrative_code" : null,
+//     "IsOnAPAR" : null
+// } ]
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj b/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj
new file mode 100644
index 0000000..6147cf4
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj
@@ -0,0 +1,24 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <Nullable>enable</Nullable>
+    </PropertyGroup>
+
+    <ItemGroup>
+      <ProjectReference Include="..\DfE.CheckPerformanceData.Application\DfE.CheckPerformanceData.Application.csproj" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <PackageReference Include="Microsoft.AspNetCore.Authentication" />
+      <PackageReference Include="Microsoft.AspNetCore.Authentication.Cookies" />
+      <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" />
+      <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" />
+      <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
+      <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
+      <PackageReference Include="Microsoft.Extensions.Http" />
+      <PackageReference Include="System.IdentityModel.Tokens.Jwt" />
+    </ItemGroup>
+
+</Project>
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/DfeSignIn/DfeSignInAuthExtensions.cs b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignIn/DfeSignInAuthExtensions.cs
new file mode 100644
index 0000000..cad4519
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignIn/DfeSignInAuthExtensions.cs
@@ -0,0 +1,65 @@
+using DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Protocols.OpenIdConnect;
+
+namespace DfE.CheckPerformanceData.Infrastructure.DfeSignIn;
+
+public static class DfeSignInAuthExtensions
+{
+    public static IServiceCollection AddDfeSignInAuthentication(this IServiceCollection services, IConfiguration config)
+    {
+        var settings = config.GetSection(DfeSigninSettings.SectionName).Get<DfeSigninSettings>();
+        
+        services.AddAuthentication(options =>
+            {
+                options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+                options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+                options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
+            })
+            .AddCookie(o =>
+            {
+                o.ExpireTimeSpan = TimeSpan.FromMinutes(30);
+                o.SlidingExpiration = true;
+                // o.LogoutPath = "/auth/logout";
+                //
+                // o.Events.OnRedirectToAccessDenied = ctx =>
+                // {
+                //     ctx.Response.StatusCode = 403;
+                //     ctx.Response.Redirect("/user-with-no-role");
+                //     return Task.CompletedTask;
+                // };
+            }).AddOpenIdConnect(options =>
+            {
+                options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+                options.MetadataAddress = settings!.MetadataAddress;
+                options.ClientId = settings.ClientId;
+                options.ClientSecret = settings.ClientSecret;
+                options.ResponseType = OpenIdConnectResponseType.Code;
+                options.RequireHttpsMetadata = true;
+                options.GetClaimsFromUserInfoEndpoint = true;
+                options.SaveTokens = true;
+                options.CallbackPath = "/auth/callback";
+                options.SignedOutCallbackPath = "/auth/signout-callback";
+        
+                options.Scope.Clear();
+                options.Scope.Add("email");
+                options.Scope.Add("sub");
+                options.Scope.Add("openid");
+                options.Scope.Add("profile");
+                options.Scope.Add("organisationid");
+
+                options.Events.OnTokenResponseReceived = ctx =>
+                {
+                    //ctx.HttpContext.Response.Headers.Add("Cache-Control", "no-store");
+                    return Task.CompletedTask;
+                };        
+            });
+        
+        return services;
+    }
+}
+
+
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClient.cs b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClient.cs
new file mode 100644
index 0000000..29220ea
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClient.cs
@@ -0,0 +1,21 @@
+using System.Net.Http.Json;
+using DfE.CheckPerformanceData.Application.DfESignInApiClient;
+
+namespace DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
+
+public class DfeSignInApiClient : IDfESignInApiClient
+{
+    private readonly HttpClient _httpClient;
+
+    public DfeSignInApiClient(HttpClient httpClient)
+    {
+        _httpClient = httpClient;
+    }
+    
+    public async Task<OrganisationDto?> GetOrganisationAsync(string userId, string organisationId)
+    {
+        var userOrganisations = await _httpClient.GetFromJsonAsync<List<OrganisationDto>>($"users/{userId}/organisations");
+        
+        return userOrganisations?.FirstOrDefault(o => o.Id == organisationId);
+    }
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClientExtensions.cs b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClientExtensions.cs
new file mode 100644
index 0000000..802ee72
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClientExtensions.cs
@@ -0,0 +1,42 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Net.Http.Headers;
+using System.Text;
+using DfE.CheckPerformanceData.Application.DfESignInApiClient;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+
+namespace DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
+
+public static class DfeSignInApiClientExtensions
+{
+    public static IServiceCollection AddDfeApiClient(this IServiceCollection services, IConfiguration config)
+    {
+        services.Configure<DfeSigninSettings>(config.GetSection(DfeSigninSettings.SectionName));
+        
+        services.AddHttpClient<IDfESignInApiClient, DfeSignInApiClient>((serviceProvider, client) =>
+        {
+            var settings = serviceProvider.GetRequiredService<IOptions<DfeSigninSettings>>().Value;
+        
+            var tokenHandler = new JwtSecurityTokenHandler();
+            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(settings.ApiClientSecret));
+            var descriptor = new SecurityTokenDescriptor()
+            {
+                Issuer = settings.ClientId,
+                Audience = settings.Audience,
+                Expires = DateTime.UtcNow.AddMinutes(5),
+                SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256Signature)
+            };
+        
+            var token = tokenHandler.CreateEncodedJwt(descriptor);
+
+            client.BaseAddress = new Uri(settings.BaseUrl);
+            client.DefaultRequestHeaders.Accept.Clear();
+            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
+            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
+        });
+        
+        return services;
+    }
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSigninSettings.cs b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSigninSettings.cs
new file mode 100644
index 0000000..c3af133
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSigninSettings.cs
@@ -0,0 +1,12 @@
+namespace DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
+
+public class DfeSigninSettings
+{
+    public const string SectionName = "DfeSignIn";
+    public string BaseUrl { get; set; } = string.Empty;
+    public string ApiClientSecret { get; set; }
+    public string ClientId { get; set; }
+    public string Audience { get; set; }
+    public string? MetadataAddress { get; set; }
+    public string? ClientSecret { get; set; }
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Controllers/HomeController.cs b/src/DfE.CheckPerformanceData.Web/Controllers/HomeController.cs
index f379bce..686a4c5 100644
--- a/src/DfE.CheckPerformanceData.Web/Controllers/HomeController.cs
+++ b/src/DfE.CheckPerformanceData.Web/Controllers/HomeController.cs
@@ -20,6 +20,8 @@ public async Task<IActionResult> SendRequest()
     {
         var client = queueServiceClient.GetQueueClient("requests");
 
+        await client.CreateIfNotExistsAsync();
+        
         await client.SendMessageAsync($"Hello, World! Time is {DateTime.Now.ToShortTimeString()}");
         
         // Handle the POST here
diff --git a/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs b/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
new file mode 100644
index 0000000..838a540
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
@@ -0,0 +1,37 @@
+using System.Security.Claims;
+using System.Text.Json.Nodes;
+using DfE.CheckPerformanceData.Application.DfESignInApiClient;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace DfE.CheckPerformanceData.Web.Controllers;
+
+public class SecretController : Controller
+{
+    private readonly IDfESignInApiClient _dfeSignInApiClient;
+
+    public SecretController(IDfESignInApiClient dfeSignInApiClient)
+    {
+        _dfeSignInApiClient = dfeSignInApiClient;
+    }
+    
+    [Authorize]
+    public async Task<IActionResult> Index()
+    {
+        var userid = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+
+        var orgJson = User.FindFirst("organisation")?.Value ?? "{}";
+        var org = JsonNode.Parse(orgJson);
+        var orgId = org["id"]?.ToString() ?? string.Empty;
+        
+        var organisation = await _dfeSignInApiClient.GetOrganisationAsync(userid, orgId);
+
+        var vm = new SecretViewModel()
+        {
+            UserName = User.FindFirstValue(ClaimTypes.GivenName) + " " + User.FindFirstValue(ClaimTypes.Surname),
+            OrganisationName = organisation?.Name
+        };
+        
+        return View(vm);
+    }
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Controllers/SecretViewModel.cs b/src/DfE.CheckPerformanceData.Web/Controllers/SecretViewModel.cs
new file mode 100644
index 0000000..cb54988
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Web/Controllers/SecretViewModel.cs
@@ -0,0 +1,8 @@
+namespace DfE.CheckPerformanceData.Web.Controllers;
+
+public class SecretViewModel
+{
+    public string UserName { get; set; }
+    public string OrganisationName { get; set; }
+    
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj b/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj
index 5471c5f..b35e650 100644
--- a/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj
+++ b/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj
@@ -12,9 +12,12 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
+    <PackageReference Include="Microsoft.Identity.Web" />
   </ItemGroup>
   <ItemGroup>
+    <ProjectReference Include="..\DfE.CheckPerformanceData.Application\DfE.CheckPerformanceData.Application.csproj" />
     <ProjectReference
       Include="..\DfE.CheckPerformanceData.Data\DfE.CheckPerformanceData.Data.csproj" />
+    <ProjectReference Include="..\DfE.CheckPerformanceData.Infrastructure\DfE.CheckPerformanceData.Infrastructure.csproj" />
   </ItemGroup>
 </Project>
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Program.cs b/src/DfE.CheckPerformanceData.Web/Program.cs
index be85256..ec7447d 100644
--- a/src/DfE.CheckPerformanceData.Web/Program.cs
+++ b/src/DfE.CheckPerformanceData.Web/Program.cs
@@ -1,12 +1,19 @@
 using Azure.Storage.Queues;
 using DfE.CheckPerformanceData.Data;
+using DfE.CheckPerformanceData.Infrastructure.DfeSignIn;
+using DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
 using GovUk.Frontend.AspNetCore;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 
 var builder = WebApplication.CreateBuilder(args);
 
-// Add services to the container.
-builder.Services.AddControllersWithViews();
+builder.Services
+    .AddDfeApiClient(builder.Configuration)
+    .AddDfeSignInAuthentication(builder.Configuration)
+    .AddGovUkFrontend(options => options.Rebrand = true);
 
 builder.Services.AddDbContext<PortalDbContext>(options =>
     options.UseNpgsql(builder.Configuration.GetConnectionString("Postgres")));
@@ -17,7 +24,7 @@
         MessageEncoding = QueueMessageEncoding.Base64
     }));
 
-builder.Services.AddGovUkFrontend(options => options.Rebrand = true);
+builder.Services.AddControllersWithViews();
 
 builder.Services.AddHealthChecks();
 
@@ -38,6 +45,7 @@
 app.UseHttpsRedirection();
 app.UseRouting();
 
+app.UseAuthentication();
 app.UseAuthorization();
 
 app.MapStaticAssets();
diff --git a/src/DfE.CheckPerformanceData.Web/Views/Home/Index.cshtml b/src/DfE.CheckPerformanceData.Web/Views/Home/Index.cshtml
index d0543f1..5be8961 100644
--- a/src/DfE.CheckPerformanceData.Web/Views/Home/Index.cshtml
+++ b/src/DfE.CheckPerformanceData.Web/Views/Home/Index.cshtml
@@ -9,11 +9,13 @@
             <div class="govuk-grid-column-two-thirds">
                 <h1 class="govuk-heading-xl">Two-thirds column</h1>
                 
-                    <form asp-action="SendRequest" asp-controller="Home" method="post">
-                        @Html.AntiForgeryToken()
+                <form asp-action="SendRequest" asp-controller="Home" method="post">
+                    @Html.AntiForgeryToken()
                         
-                        <govuk-button is-start-button="true" type="submit"> Send Test Message</govuk-button>
-                    </form>
+                    <govuk-button is-start-button="true" type="submit"> Send Test Message</govuk-button>
+                </form>
+                
+                <a asp-controller="Secret">Secret page</a>
                 
             </div>
             <div class="govuk-grid-column-one-third">
diff --git a/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml b/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
new file mode 100644
index 0000000..1f76fce
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
@@ -0,0 +1,9 @@
+@using System.Security.Claims
+@model DfE.CheckPerformanceData.Web.Controllers.SecretViewModel;
+
+@{
+    ViewBag.Title = "title";
+    Layout = "_Layout";
+}
+
+<h2>Secret page.  Hello @Model.UserName of @Model.OrganisationName </h2>
diff --git a/src/DfE.CheckPerformanceData.slnx b/src/DfE.CheckPerformanceData.slnx
index 080a2d4..e29f607 100644
--- a/src/DfE.CheckPerformanceData.slnx
+++ b/src/DfE.CheckPerformanceData.slnx
@@ -5,7 +5,9 @@
         <File Path="../docker-compose.yaml" />
         <File Path="Directory.Packages.props" />
     </Folder>
+    <Project Path="DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj" />
     <Project Path="DfE.CheckPerformanceData.Data/DfE.CheckPerformanceData.Data.csproj" />
+    <Project Path="DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj" />
     <Project Path="DfE.CheckPerformanceData.RulesEngineWorker/DfE.CheckPerformanceData.RulesEngineWorker.csproj" />
     <Project Path="DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj" />
 </Solution>
\ No newline at end of file
diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index 264b9fb..1b7f97f 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -6,8 +6,16 @@
     <PackageVersion Include="Azure.Storage.Common" Version="12.26.0" />
     <PackageVersion Include="Azure.Storage.Queues" Version="12.25.0" />
     <PackageVersion Include="coverlet.collector" Version="6.0.4" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication" Version="2.3.9" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Cookies" Version="2.3.9" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.0" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.5" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.5" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.5" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.5" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.5" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.5" />
+    <PackageVersion Include="Microsoft.Identity.Web" Version="4.6.0" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.1" />
     <PackageVersion Include="NUnit" Version="4.3.2" />
@@ -15,5 +23,6 @@
     <PackageVersion Include="NUnit3TestAdapter" Version="5.0.0" />
     <PackageVersion Include="GovUk.Frontend.AspNetCore" Version="3.5.1" />
     <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.4" />
+    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.15.0" />
   </ItemGroup>
 </Project>
\ No newline at end of file

From 4aa5f8bf6f701ba15a1bcc4b702832305967be2f Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Sun, 29 Mar 2026 13:30:57 +0100
Subject: [PATCH 02/18] Using tidy

---
 src/DfE.CheckPerformanceData.Web/Program.cs | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/DfE.CheckPerformanceData.Web/Program.cs b/src/DfE.CheckPerformanceData.Web/Program.cs
index ec7447d..1ee2297 100644
--- a/src/DfE.CheckPerformanceData.Web/Program.cs
+++ b/src/DfE.CheckPerformanceData.Web/Program.cs
@@ -3,10 +3,7 @@
 using DfE.CheckPerformanceData.Infrastructure.DfeSignIn;
 using DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
 using GovUk.Frontend.AspNetCore;
-using Microsoft.AspNetCore.Authentication.Cookies;
-using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 
 var builder = WebApplication.CreateBuilder(args);
 

From 4ac19353e2950cb0659b818964020bcd7a3ef871 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Sun, 29 Mar 2026 14:25:11 +0100
Subject: [PATCH 03/18] Refactor of persistence

---
 .../DfE.CheckPerformanceData.Application.csproj      |  8 ++++++++
 .../IPortalDbContext.cs                              | 10 ++++++++++
 .../DfE.CheckPerformanceData.Data.csproj             | 12 ------------
 src/DfE.CheckPerformanceData.Data/PortalDbContext.cs |  9 ---------
 .../DfE.CheckPerformanceData.Domain.csproj           |  9 +++++++++
 .../Entities/Workflow.cs                             |  2 +-
 .../DfE.CheckPerformanceData.Infrastructure.csproj   |  7 +++++++
 .../Persistence/PortalDbContext.cs                   | 10 ++++++++++
 .../Controllers/HomeController.cs                    |  5 ++---
 .../Controllers/SecretController.cs                  |  1 +
 .../Controllers/{ => ViewModels}/SecretViewModel.cs  |  2 +-
 .../DfE.CheckPerformanceData.Web.csproj              |  2 --
 src/DfE.CheckPerformanceData.Web/Program.cs          |  5 ++++-
 .../Views/Secret/Index.cshtml                        |  2 +-
 src/DfE.CheckPerformanceData.slnx                    |  2 +-
 src/Directory.Packages.props                         |  1 +
 16 files changed, 56 insertions(+), 31 deletions(-)
 create mode 100644 src/DfE.CheckPerformanceData.Application/IPortalDbContext.cs
 delete mode 100644 src/DfE.CheckPerformanceData.Data/DfE.CheckPerformanceData.Data.csproj
 delete mode 100644 src/DfE.CheckPerformanceData.Data/PortalDbContext.cs
 create mode 100644 src/DfE.CheckPerformanceData.Domain/DfE.CheckPerformanceData.Domain.csproj
 rename src/{DfE.CheckPerformanceData.Data => DfE.CheckPerformanceData.Domain}/Entities/Workflow.cs (64%)
 create mode 100644 src/DfE.CheckPerformanceData.Infrastructure/Persistence/PortalDbContext.cs
 rename src/DfE.CheckPerformanceData.Web/Controllers/{ => ViewModels}/SecretViewModel.cs (67%)

diff --git a/src/DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj b/src/DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj
index 237d661..65f0f97 100644
--- a/src/DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj
+++ b/src/DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj
@@ -6,4 +6,12 @@
         <Nullable>enable</Nullable>
     </PropertyGroup>
 
+    <ItemGroup>
+      <PackageReference Include="Microsoft.EntityFrameworkCore" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <ProjectReference Include="..\DfE.CheckPerformanceData.Domain\DfE.CheckPerformanceData.Domain.csproj" />
+    </ItemGroup>
+
 </Project>
diff --git a/src/DfE.CheckPerformanceData.Application/IPortalDbContext.cs b/src/DfE.CheckPerformanceData.Application/IPortalDbContext.cs
new file mode 100644
index 0000000..e2cc0b0
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Application/IPortalDbContext.cs
@@ -0,0 +1,10 @@
+using DfE.CheckPerformanceData.Domain.Entities;
+using Microsoft.EntityFrameworkCore;
+
+namespace DfE.CheckPerformanceData.Application;
+
+public interface IPortalDbContext
+{
+    DbSet<Workflow> Workflows { get; }
+    Task<int> SaveChangesAsync(CancellationToken cancellationToken = default);
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Data/DfE.CheckPerformanceData.Data.csproj b/src/DfE.CheckPerformanceData.Data/DfE.CheckPerformanceData.Data.csproj
deleted file mode 100644
index c85341b..0000000
--- a/src/DfE.CheckPerformanceData.Data/DfE.CheckPerformanceData.Data.csproj
+++ /dev/null
@@ -1,12 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-  </PropertyGroup>
-  <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" />
-    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" />
-  </ItemGroup>
-</Project>
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Data/PortalDbContext.cs b/src/DfE.CheckPerformanceData.Data/PortalDbContext.cs
deleted file mode 100644
index 425fb02..0000000
--- a/src/DfE.CheckPerformanceData.Data/PortalDbContext.cs
+++ /dev/null
@@ -1,9 +0,0 @@
-using DfE.CheckPerformanceData.Data.Entities;
-using Microsoft.EntityFrameworkCore;
-
-namespace DfE.CheckPerformanceData.Data;
-
-public class PortalDbContext(DbContextOptions<PortalDbContext> options) : DbContext(options)
-{
-    public DbSet<Workflow> Workflows => Set<Workflow>();
-}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Domain/DfE.CheckPerformanceData.Domain.csproj b/src/DfE.CheckPerformanceData.Domain/DfE.CheckPerformanceData.Domain.csproj
new file mode 100644
index 0000000..237d661
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Domain/DfE.CheckPerformanceData.Domain.csproj
@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <Nullable>enable</Nullable>
+    </PropertyGroup>
+
+</Project>
diff --git a/src/DfE.CheckPerformanceData.Data/Entities/Workflow.cs b/src/DfE.CheckPerformanceData.Domain/Entities/Workflow.cs
similarity index 64%
rename from src/DfE.CheckPerformanceData.Data/Entities/Workflow.cs
rename to src/DfE.CheckPerformanceData.Domain/Entities/Workflow.cs
index c0914bd..f4b4807 100644
--- a/src/DfE.CheckPerformanceData.Data/Entities/Workflow.cs
+++ b/src/DfE.CheckPerformanceData.Domain/Entities/Workflow.cs
@@ -1,5 +1,5 @@
 
-namespace DfE.CheckPerformanceData.Data.Entities;
+namespace DfE.CheckPerformanceData.Domain.Entities;
 
 public class Workflow
 {
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj b/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj
index 6147cf4..594a606 100644
--- a/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj
+++ b/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj
@@ -8,17 +8,24 @@
 
     <ItemGroup>
       <ProjectReference Include="..\DfE.CheckPerformanceData.Application\DfE.CheckPerformanceData.Application.csproj" />
+      <ProjectReference Include="..\DfE.CheckPerformanceData.Domain\DfE.CheckPerformanceData.Domain.csproj" />
     </ItemGroup>
 
     <ItemGroup>
       <PackageReference Include="Microsoft.AspNetCore.Authentication" />
       <PackageReference Include="Microsoft.AspNetCore.Authentication.Cookies" />
       <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" />
+      <PackageReference Include="Microsoft.EntityFrameworkCore" />
       <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" />
       <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
       <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
       <PackageReference Include="Microsoft.Extensions.Http" />
+      <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" />
       <PackageReference Include="System.IdentityModel.Tokens.Jwt" />
     </ItemGroup>
 
+    <ItemGroup>
+      <Folder Include="Persistence\Repositories\" />
+    </ItemGroup>
+
 </Project>
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/Persistence/PortalDbContext.cs b/src/DfE.CheckPerformanceData.Infrastructure/Persistence/PortalDbContext.cs
new file mode 100644
index 0000000..aef69fe
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Infrastructure/Persistence/PortalDbContext.cs
@@ -0,0 +1,10 @@
+using DfE.CheckPerformanceData.Application;
+using DfE.CheckPerformanceData.Domain.Entities;
+using Microsoft.EntityFrameworkCore;
+
+namespace DfE.CheckPerformanceData.Infrastructure.Persistence;
+
+public class PortalDbContext(DbContextOptions<PortalDbContext> options) : DbContext(options), IPortalDbContext
+{
+    public DbSet<Workflow> Workflows => Set<Workflow>();
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Controllers/HomeController.cs b/src/DfE.CheckPerformanceData.Web/Controllers/HomeController.cs
index 686a4c5..794b9cd 100644
--- a/src/DfE.CheckPerformanceData.Web/Controllers/HomeController.cs
+++ b/src/DfE.CheckPerformanceData.Web/Controllers/HomeController.cs
@@ -1,13 +1,12 @@
 using System.Diagnostics;
 using Azure.Storage.Queues;
-using DfE.CheckPerformanceData.Data;
-using DfE.CheckPerformanceData.Data.Entities;
+using DfE.CheckPerformanceData.Application;
 using Microsoft.AspNetCore.Mvc;
 using DfE.CheckPerformanceData.Web.Models;
 
 namespace DfE.CheckPerformanceData.Web.Controllers;
 
-public class HomeController(PortalDbContext context, QueueServiceClient queueServiceClient) : Controller
+public class HomeController(IPortalDbContext context, QueueServiceClient queueServiceClient) : Controller
 {
     public async Task<IActionResult> Index()
     {
diff --git a/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs b/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
index 838a540..2abc1ab 100644
--- a/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
+++ b/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
@@ -1,6 +1,7 @@
 using System.Security.Claims;
 using System.Text.Json.Nodes;
 using DfE.CheckPerformanceData.Application.DfESignInApiClient;
+using DfE.CheckPerformanceData.Web.Controllers.ViewModels;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
diff --git a/src/DfE.CheckPerformanceData.Web/Controllers/SecretViewModel.cs b/src/DfE.CheckPerformanceData.Web/Controllers/ViewModels/SecretViewModel.cs
similarity index 67%
rename from src/DfE.CheckPerformanceData.Web/Controllers/SecretViewModel.cs
rename to src/DfE.CheckPerformanceData.Web/Controllers/ViewModels/SecretViewModel.cs
index cb54988..d80f816 100644
--- a/src/DfE.CheckPerformanceData.Web/Controllers/SecretViewModel.cs
+++ b/src/DfE.CheckPerformanceData.Web/Controllers/ViewModels/SecretViewModel.cs
@@ -1,4 +1,4 @@
-namespace DfE.CheckPerformanceData.Web.Controllers;
+namespace DfE.CheckPerformanceData.Web.Controllers.ViewModels;
 
 public class SecretViewModel
 {
diff --git a/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj b/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj
index b35e650..934f1ad 100644
--- a/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj
+++ b/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj
@@ -16,8 +16,6 @@
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\DfE.CheckPerformanceData.Application\DfE.CheckPerformanceData.Application.csproj" />
-    <ProjectReference
-      Include="..\DfE.CheckPerformanceData.Data\DfE.CheckPerformanceData.Data.csproj" />
     <ProjectReference Include="..\DfE.CheckPerformanceData.Infrastructure\DfE.CheckPerformanceData.Infrastructure.csproj" />
   </ItemGroup>
 </Project>
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Program.cs b/src/DfE.CheckPerformanceData.Web/Program.cs
index 1ee2297..4153438 100644
--- a/src/DfE.CheckPerformanceData.Web/Program.cs
+++ b/src/DfE.CheckPerformanceData.Web/Program.cs
@@ -1,7 +1,8 @@
 using Azure.Storage.Queues;
-using DfE.CheckPerformanceData.Data;
+using DfE.CheckPerformanceData.Application;
 using DfE.CheckPerformanceData.Infrastructure.DfeSignIn;
 using DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
+using DfE.CheckPerformanceData.Infrastructure.Persistence;
 using GovUk.Frontend.AspNetCore;
 using Microsoft.EntityFrameworkCore;
 
@@ -15,6 +16,8 @@
 builder.Services.AddDbContext<PortalDbContext>(options =>
     options.UseNpgsql(builder.Configuration.GetConnectionString("Postgres")));
 
+builder.Services.AddScoped<IPortalDbContext>(sp => sp.GetRequiredService<PortalDbContext>());
+
 builder.Services.AddSingleton(_ => new QueueServiceClient(builder.Configuration.GetConnectionString("AzureStorage"),
     new QueueClientOptions(QueueClientOptions.ServiceVersion.V2025_11_05)
     {
diff --git a/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml b/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
index 1f76fce..f1eb74e 100644
--- a/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
+++ b/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
@@ -1,5 +1,5 @@
 @using System.Security.Claims
-@model DfE.CheckPerformanceData.Web.Controllers.SecretViewModel;
+@model DfE.CheckPerformanceData.Web.Controllers.ViewModels.SecretViewModel;
 
 @{
     ViewBag.Title = "title";
diff --git a/src/DfE.CheckPerformanceData.slnx b/src/DfE.CheckPerformanceData.slnx
index e29f607..3bbdbe3 100644
--- a/src/DfE.CheckPerformanceData.slnx
+++ b/src/DfE.CheckPerformanceData.slnx
@@ -6,7 +6,7 @@
         <File Path="Directory.Packages.props" />
     </Folder>
     <Project Path="DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj" />
-    <Project Path="DfE.CheckPerformanceData.Data/DfE.CheckPerformanceData.Data.csproj" />
+    <Project Path="DfE.CheckPerformanceData.Domain/DfE.CheckPerformanceData.Domain.csproj" />
     <Project Path="DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj" />
     <Project Path="DfE.CheckPerformanceData.RulesEngineWorker/DfE.CheckPerformanceData.RulesEngineWorker.csproj" />
     <Project Path="DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj" />
diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index 1b7f97f..63f93c9 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -9,6 +9,7 @@
     <PackageVersion Include="Microsoft.AspNetCore.Authentication" Version="2.3.9" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.Cookies" Version="2.3.9" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.0" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.5" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.5" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.5" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.5" />

From 8b5e6c0fa117f8c20ebc395083a6edc47023c69a Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Sun, 29 Mar 2026 14:42:56 +0100
Subject: [PATCH 04/18] Updated readme

---
 README.md                         | 6 +++++-
 src/DfE.CheckPerformanceData.slnx | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index ed06772..af1ebd1 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Prerequisites
 - [Git](https://git-scm.com/downloads) (for getting a copy of the source code and contributing changes)
 - [.NET 10 SDK](https://dotnet.microsoft.com/en-us/download/dotnet/10.0) (for building and running the C#/.NET web
   application)
-- [Node.js](https://nodejs.org/en/download/) (for building web artefacts: (S)CSS, JS, etc.)
+- ~~[Node.js](https://nodejs.org/en/download/) (for building web artefacts: (S)CSS, JS, etc.)~~
 - IDE/Editor of choice (e.g., Visual Studio, Visual Studio Code, JetBrains Rider, etc.)
 - [Docker Desktop](https://docs.docker.com/desktop/) (for development time hosting of dependencies)
     
@@ -25,4 +25,8 @@ dotnet build
 Confirm tests are passing locally
 ```sh
 dotnet test
+```
+
+```sh
+docker compose up --build -d
 ```
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.slnx b/src/DfE.CheckPerformanceData.slnx
index 3bbdbe3..dfe5228 100644
--- a/src/DfE.CheckPerformanceData.slnx
+++ b/src/DfE.CheckPerformanceData.slnx
@@ -3,6 +3,7 @@
         <File Path="../.env" />
         <File Path="../.github/workflows/build.yml" />
         <File Path="../docker-compose.yaml" />
+        <File Path="../README.md" />
         <File Path="Directory.Packages.props" />
     </Folder>
     <Project Path="DfE.CheckPerformanceData.Application/DfE.CheckPerformanceData.Application.csproj" />

From 7df5ddd04f9735ec986ab48c0df6964a344c4593 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Tue, 31 Mar 2026 08:18:57 +0100
Subject: [PATCH 05/18] Secret display

---
 .../Controllers/SecretController.cs           |  19 ++-
 .../Controllers/ViewModels/SecretViewModel.cs |   6 +-
 .../Views/Home/Index.cshtml                   |  53 +++++++--
 .../Views/Secret/Index.cshtml                 |  83 +++++++++++++-
 .../Views/Shared/_Layout.cshtml               | 108 +++++++++++++-----
 5 files changed, 223 insertions(+), 46 deletions(-)

diff --git a/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs b/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
index 2abc1ab..ac478f1 100644
--- a/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
+++ b/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
@@ -2,6 +2,9 @@
 using System.Text.Json.Nodes;
 using DfE.CheckPerformanceData.Application.DfESignInApiClient;
 using DfE.CheckPerformanceData.Web.Controllers.ViewModels;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
@@ -30,9 +33,23 @@ public async Task<IActionResult> Index()
         var vm = new SecretViewModel()
         {
             UserName = User.FindFirstValue(ClaimTypes.GivenName) + " " + User.FindFirstValue(ClaimTypes.Surname),
-            OrganisationName = organisation?.Name
+            Organisation = organisation
         };
         
         return View(vm);
     }
+
+    public async Task<IActionResult> SignOut()
+    {
+        await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+        await HttpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme);
+        return SignOut(
+            new AuthenticationProperties
+            {
+                RedirectUri = Url.Action("Index", "Home")
+            },
+            CookieAuthenticationDefaults.AuthenticationScheme,
+            OpenIdConnectDefaults.AuthenticationScheme
+        );
+    }
 }
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Controllers/ViewModels/SecretViewModel.cs b/src/DfE.CheckPerformanceData.Web/Controllers/ViewModels/SecretViewModel.cs
index d80f816..c5bc914 100644
--- a/src/DfE.CheckPerformanceData.Web/Controllers/ViewModels/SecretViewModel.cs
+++ b/src/DfE.CheckPerformanceData.Web/Controllers/ViewModels/SecretViewModel.cs
@@ -1,8 +1,10 @@
+using DfE.CheckPerformanceData.Application.DfESignInApiClient;
+
 namespace DfE.CheckPerformanceData.Web.Controllers.ViewModels;
 
 public class SecretViewModel
 {
     public string UserName { get; set; }
-    public string OrganisationName { get; set; }
-    
+    //public string OrganisationName { get; set; }
+    public OrganisationDto Organisation { get; set; }
 }
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Views/Home/Index.cshtml b/src/DfE.CheckPerformanceData.Web/Views/Home/Index.cshtml
index 5be8961..199b8dc 100644
--- a/src/DfE.CheckPerformanceData.Web/Views/Home/Index.cshtml
+++ b/src/DfE.CheckPerformanceData.Web/Views/Home/Index.cshtml
@@ -2,26 +2,55 @@
     ViewData["Title"] = "Home Page";
 }
 
-<div class="govuk-width-container">
-    <a href="#" class="govuk-back-link">Back</a>
-    <main class="govuk-main-wrapper">
         <div class="govuk-grid-row">
             <div class="govuk-grid-column-two-thirds">
-                <h1 class="govuk-heading-xl">Two-thirds column</h1>
+                <h1 class="govuk-heading-xl">Check your performance measures data</h1>
                 
-                <form asp-action="SendRequest" asp-controller="Home" method="post">
+                <p class="govuk-body">
+                    Review and confirm the pupil data that will be used to calculate your school or college's performance measures.
+                </p>
+                
+                <p class="govuk-body">
+                    Use this service to:
+                </p>
+                <ul class="govuk-list govuk-list--bullet">
+                    <li>check which pupils are included in your performance data</li>
+                    <li>request changes if a pupil should not be counted</li>
+                    <li>upload evidence to support removal requests</li>
+                    <li>review summary information before it is finalised</li>
+                </ul>
+                <p class="govuk-body">
+                    This helps make sure your school's published performance data is accurate and up to date.
+                </p>
+                <p class="govuk-body">
+                    You can use this service if you are:
+                </p>
+                <ul class="govuk-list govuk-list--bullet">
+                    <li>a school or college with pupils included in performance measures</li>
+                    <li>responsible for checking or submitting data (for example, headteacher or data manager)</li>
+                </ul>
+                
+                @*<form asp-action="SendRequest" asp-controller="Home" method="post">
                     @Html.AntiForgeryToken()
                         
                     <govuk-button is-start-button="true" type="submit"> Send Test Message</govuk-button>
-                </form>
-                
-                <a asp-controller="Secret">Secret page</a>
+                </form>*@
+
+                <a href="@Url.Action("Index", "Secret")" role="button" draggable="false" class="govuk-button govuk-button--start">
+                    Start now
+                    <svg class="govuk-button__start-icon" xmlns="http://www.w3.org/2000/svg" width="17.5" height="19" viewBox="0 0 33 40" aria-hidden="true" focusable="false">
+                        <path fill="currentColor" d="M0 0h13l20 20-20 20H0l20-20z" />
+                    </svg>
+                </a>
                 
+                <p class="govuk-body">
+                    Sign up to <a href="#" class="govuk-link">get email notifications</a> about this service. 
+                </p>
             </div>
             <div class="govuk-grid-column-one-third">
-                <h2 class="govuk-heading-m">One-third column</h2>
-                <p class="govuk-body"></p>
+                <h2 class="govuk-heading-m">Guidance</h2>
+                <p class="govuk-body">
+                    <a href="#" class="govuk-link">How to check your performance data</a>
+                </p>
             </div>
         </div>
-    </main>
-</div>
diff --git a/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml b/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
index f1eb74e..8bc87b6 100644
--- a/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
+++ b/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
@@ -1,9 +1,86 @@
-@using System.Security.Claims
-@model DfE.CheckPerformanceData.Web.Controllers.ViewModels.SecretViewModel;
+@model DfE.CheckPerformanceData.Web.Controllers.ViewModels.SecretViewModel;
 
 @{
     ViewBag.Title = "title";
     Layout = "_Layout";
 }
 
-<h2>Secret page.  Hello @Model.UserName of @Model.OrganisationName </h2>
+<h2 class="govuk-heading-m">Hello @Model.UserName of @Model.Organisation.Name</h2>
+
+<dl class="govuk-summary-list">
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">ID</dt>
+        <dd class="govuk-summary-list__value">@Model.Organisation.Id</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">Name</dt>
+        <dd class="govuk-summary-list__value">@Model.Organisation.Name</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">Legal name</dt>
+        <dd class="govuk-summary-list__value">@(Model.Organisation.LegalName ?? "Not provided")</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">URN</dt>
+        <dd class="govuk-summary-list__value">@(Model.Organisation.Urn ?? "Not provided")</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">UID</dt>
+        <dd class="govuk-summary-list__value">@(Model.Organisation.Uid ?? "Not provided")</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">UPIN</dt>
+        <dd class="govuk-summary-list__value">@(Model.Organisation.Upin ?? "Not provided")</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">UKPRN</dt>
+        <dd class="govuk-summary-list__value">@(Model.Organisation.Ukprn ?? "Not provided")</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">Establishment number</dt>
+        <dd class="govuk-summary-list__value">@(Model.Organisation.EstablishmentNumber ?? "Not provided")</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">Address</dt>
+        <dd class="govuk-summary-list__value">@(Model.Organisation.Address ?? "Not provided")</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">Telephone</dt>
+        <dd class="govuk-summary-list__value">@(Model.Organisation.Telephone ?? "Not provided")</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">Statutory age range</dt>
+        <dd class="govuk-summary-list__value">
+            @if (Model.Organisation.StatutoryLowAge.HasValue && Model.Organisation.StatutoryHighAge.HasValue)
+            {
+                @($"{Model.Organisation.StatutoryLowAge} to {Model.Organisation.StatutoryHighAge}")
+            }
+            else
+            {
+                <span>Not provided</span>
+            }
+        </dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">Legacy ID</dt>
+        <dd class="govuk-summary-list__value">@(Model.Organisation.LegacyId ?? "Not provided")</dd>
+    </div>
+
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">Company registration number</dt>
+        <dd class="govuk-summary-list__value">@(Model.Organisation.CompanyRegistrationNumber ?? "Not provided")</dd>
+    </div>
+
+</dl>
diff --git a/src/DfE.CheckPerformanceData.Web/Views/Shared/_Layout.cshtml b/src/DfE.CheckPerformanceData.Web/Views/Shared/_Layout.cshtml
index 4b87524..1253eee 100644
--- a/src/DfE.CheckPerformanceData.Web/Views/Shared/_Layout.cshtml
+++ b/src/DfE.CheckPerformanceData.Web/Views/Shared/_Layout.cshtml
@@ -20,39 +20,91 @@
 }
 
 @section Header {
-    <govuk-header home-page-url="https://gov.uk/" />
-
+    <govuk-header home-page-url="https://gov.uk/"/>
     <govuk-service-navigation service-name="Check Performance Data" service-url="#">
-        @* <govuk-service-navigation-nav> *@
-        @*     <govuk-service-navigation-nav-item href="#">Navigation item 1</govuk-service-navigation-nav-item> *@
-        @*     <govuk-service-navigation-nav-item href="#" active="true">Navigation item 2</govuk-service-navigation-nav-item> *@
-        @*     <govuk-service-navigation-nav-item href="#">Navigation item 3</govuk-service-navigation-nav-item> *@
-        @* </govuk-service-navigation-nav> *@
+        <govuk-service-navigation-nav>
+            @if (@User.Identity is { IsAuthenticated: true })
+            {
+                <govuk-service-navigation-nav-item href="@Url.Action("SignOut", "Secret")">Sign out
+                </govuk-service-navigation-nav-item>
+            }
+        </govuk-service-navigation-nav>
     </govuk-service-navigation>
+    <div class="govuk-phase-banner govuk-width-container">
+        <p class="govuk-phase-banner__content">
+            <strong class="govuk-tag govuk-phase-banner__content__tag">
+                Beta
+            </strong>
+            <span class="govuk-phase-banner__text">
+                This is a new service – your <a class="govuk-link" href="#">feedback</a> will help us to improve it.
+            </span>
+        </p>
+    </div>
 }
 
 @RenderBody()
 
 @section Footer {
-    <govuk-footer>
-        <govuk-footer-nav width="two-thirds" columns="2">
-            <govuk-footer-nav-title>Two column list</govuk-footer-nav-title>
-            <govuk-footer-nav-items>
-                <govuk-footer-nav-item href="#">Navigation item 1</govuk-footer-nav-item>
-                <govuk-footer-nav-item href="#">Navigation item 2</govuk-footer-nav-item>
-                <govuk-footer-nav-item href="#">Navigation item 3</govuk-footer-nav-item>
-                <govuk-footer-nav-item href="#">Navigation item 4</govuk-footer-nav-item>
-                <govuk-footer-nav-item href="#">Navigation item 5</govuk-footer-nav-item>
-                <govuk-footer-nav-item href="#">Navigation item 6</govuk-footer-nav-item>
-            </govuk-footer-nav-items>
-        </govuk-footer-nav>
-        <govuk-footer-nav width="one-third">
-            <govuk-footer-nav-title>Single column list</govuk-footer-nav-title>
-            <govuk-footer-nav-items>
-                <govuk-footer-nav-item href="#">Navigation item 1</govuk-footer-nav-item>
-                <govuk-footer-nav-item href="#">Navigation item 2</govuk-footer-nav-item>
-                <govuk-footer-nav-item href="#">Navigation item 3</govuk-footer-nav-item>
-            </govuk-footer-nav-items>
-        </govuk-footer-nav>
-    </govuk-footer>
+    <footer class="govuk-footer">
+        <div class="govuk-width-container">
+            <svg focusable="false" role="presentation" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 60"
+                 height="30" width="32" fill="currentcolor" class="govuk-footer__crown">
+                <g>
+                    <circle cx="20" cy="17.6" r="3.7"></circle>
+                    <circle cx="10.2" cy="23.5" r="3.7"></circle>
+                    <circle cx="3.7" cy="33.2" r="3.7"></circle>
+                    <circle cx="31.7" cy="30.6" r="3.7"></circle>
+                    <circle cx="43.3" cy="17.6" r="3.7"></circle>
+                    <circle cx="53.2" cy="23.5" r="3.7"></circle>
+                    <circle cx="59.7" cy="33.2" r="3.7"></circle>
+                    <circle cx="31.7" cy="30.6" r="3.7"></circle>
+                    <path
+                        d="M33.1,9.8c.2-.1.3-.3.5-.5l4.6,2.4v-6.8l-4.6,1.5c-.1-.2-.3-.3-.5-.5l1.9-5.9h-6.7l1.9,5.9c-.2.1-.3.3-.5.5l-4.6-1.5v6.8l4.6-2.4c.1.2.3.3.5.5l-2.6,8c-.9,2.8,1.2,5.7,4.1,5.7h0c3,0,5.1-2.9,4.1-5.7l-2.6-8ZM37,37.9s-3.4,3.8-4.1,6.1c2.2,0,4.2-.5,6.4-2.8l-.7,8.5c-2-2.8-4.4-4.1-5.7-3.8.1,3.1.5,6.7,5.8,7.2,3.7.3,6.7-1.5,7-3.8.4-2.6-2-4.3-3.7-1.6-1.4-4.5,2.4-6.1,4.9-3.2-1.9-4.5-1.8-7.7,2.4-10.9,3,4,2.6,7.3-1.2,11.1,2.4-1.3,6.2,0,4,4.6-1.2-2.8-3.7-2.2-4.2.2-.3,1.7.7,3.7,3,4.2,1.9.3,4.7-.9,7-5.9-1.3,0-2.4.7-3.9,1.7l2.4-8c.6,2.3,1.4,3.7,2.2,4.5.6-1.6.5-2.8,0-5.3l5,1.8c-2.6,3.6-5.2,8.7-7.3,17.5-7.4-1.1-15.7-1.7-24.5-1.7h0c-8.8,0-17.1.6-24.5,1.7-2.1-8.9-4.7-13.9-7.3-17.5l5-1.8c-.5,2.5-.6,3.7,0,5.3.8-.8,1.6-2.3,2.2-4.5l2.4,8c-1.5-1-2.6-1.7-3.9-1.7,2.3,5,5.2,6.2,7,5.9,2.3-.4,3.3-2.4,3-4.2-.5-2.4-3-3.1-4.2-.2-2.2-4.6,1.6-6,4-4.6-3.7-3.7-4.2-7.1-1.2-11.1,4.2,3.2,4.3,6.4,2.4,10.9,2.5-2.8,6.3-1.3,4.9,3.2-1.8-2.7-4.1-1-3.7,1.6.3,2.3,3.3,4.1,7,3.8,5.4-.5,5.7-4.2,5.8-7.2-1.3-.2-3.7,1-5.7,3.8l-.7-8.5c2.2,2.3,4.2,2.7,6.4,2.8-.7-2.3-4.1-6.1-4.1-6.1h10.6,0Z"></path>
+                </g>
+            </svg>
+            <h2 class="govuk-heading-m">Support and guidance</h2>
+            <p>If you have a question, or you're having a problem using this service, you can <a href="#" class="govuk-link">send us a message</a> or call us on 0300 131 2762</p>
+            <p>
+                <a href="#" class="govuk-footer__link">Privacy</a>
+                <a href="#" class="govuk-footer__link">Cookies</a>
+                <a href="#" class="govuk-footer__link">Accessibility statement</a>
+                <a href="#" class="govuk-footer__link">Guidance</a>
+            </p>
+            @* <div class="govuk-footer__navigation"> *@
+            @*     <div class="govuk-footer__section govuk-grid-column-two-thirds"><h2 *@
+            @*             class="govuk-footer__heading govuk-heading-m">Two column list</h2> *@
+            @*         <ul class="govuk-footer__list govuk-footer__list--columns-2"> *@
+            @*             <li class="govuk-footer__list-item"><a class="govuk-footer__link" href="#">Navigation item 1</a> *@
+            @*             </li> *@
+            @*             <li class="govuk-footer__list-item"><a class="govuk-footer__link" href="#">Navigation item 2</a> *@
+            @*             </li> *@
+            @*             <li class="govuk-footer__list-item"><a class="govuk-footer__link" href="#">Navigation item 3</a> *@
+            @*             </li> *@
+            @*             <li class="govuk-footer__list-item"><a class="govuk-footer__link" href="#">Navigation item 4</a> *@
+            @*             </li> *@
+            @*             <li class="govuk-footer__list-item"><a class="govuk-footer__link" href="#">Navigation item 5</a> *@
+            @*             </li> *@
+            @*             <li class="govuk-footer__list-item"><a class="govuk-footer__link" href="#">Navigation item 6</a> *@
+            @*             </li> *@
+            @*         </ul> *@
+            @*     </div> *@
+            @* </div> *@
+            <hr class="govuk-footer__section-break">
+            <div class="govuk-footer__meta">
+                <div class="govuk-footer__meta-item govuk-footer__meta-item--grow">
+                    <svg aria-hidden="true" focusable="false" class="govuk-footer__licence-logo"
+                         xmlns="http://www.w3.org/2000/svg" viewBox="0 0 483.2 195.7" height="17" width="41">
+                        <path fill="currentColor"
+                              d="M421.5 142.8V.1l-50.7 32.3v161.1h112.4v-50.7zm-122.3-9.6A47.12 47.12 0 0 1 221 97.8c0-26 21.1-47.1 47.1-47.1 16.7 0 31.4 8.7 39.7 21.8l42.7-27.2A97.63 97.63 0 0 0 268.1 0c-36.5 0-68.3 20.1-85.1 49.7A98 98 0 0 0 97.8 0C43.9 0 0 43.9 0 97.8s43.9 97.8 97.8 97.8c36.5 0 68.3-20.1 85.1-49.7a97.76 97.76 0 0 0 149.6 25.4l19.4 22.2h3v-87.8h-80l24.3 27.5zM97.8 145c-26 0-47.1-21.1-47.1-47.1s21.1-47.1 47.1-47.1 47.2 21 47.2 47S123.8 145 97.8 145"></path>
+                    </svg>
+                    <span class="govuk-footer__licence-description">All content is available under the <a
+                            class="govuk-footer__link"
+                            href="https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
+                            rel="license">Open Government Licence v3.0</a>, except where otherwise stated</span></div>
+                <div class="govuk-footer__meta-item"><a class="govuk-footer__link govuk-footer__copyright-logo"
+                                                        href="https://www.nationalarchives.gov.uk/information-management/re-using-public-sector-information/uk-government-licensing-framework/crown-copyright/">©
+                        Crown copyright</a></div>
+            </div>
+        </div>
+    </footer>
 }
\ No newline at end of file

From c5fcb690a03261e05df547d1b4ad16f207bba046 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Tue, 31 Mar 2026 08:38:14 +0100
Subject: [PATCH 06/18] Added serilog

---
 .../DfE.CheckPerformanceData.Web.csproj       |   4 +
 src/DfE.CheckPerformanceData.Web/Program.cs   | 113 ++++++++++++------
 .../appsettings.json                          |  16 ++-
 src/Directory.Packages.props                  |   4 +
 4 files changed, 95 insertions(+), 42 deletions(-)

diff --git a/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj b/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj
index 934f1ad..8faf55b 100644
--- a/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj
+++ b/src/DfE.CheckPerformanceData.Web/DfE.CheckPerformanceData.Web.csproj
@@ -13,6 +13,10 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
     <PackageReference Include="Microsoft.Identity.Web" />
+    <PackageReference Include="Serilog.AspNetCore" />
+    <PackageReference Include="Serilog.Expressions" />
+    <PackageReference Include="Serilog.Formatting.Compact" />
+    <PackageReference Include="Serilog.Sinks.Console" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\DfE.CheckPerformanceData.Application\DfE.CheckPerformanceData.Application.csproj" />
diff --git a/src/DfE.CheckPerformanceData.Web/Program.cs b/src/DfE.CheckPerformanceData.Web/Program.cs
index 4153438..c3c7bc4 100644
--- a/src/DfE.CheckPerformanceData.Web/Program.cs
+++ b/src/DfE.CheckPerformanceData.Web/Program.cs
@@ -5,55 +5,90 @@
 using DfE.CheckPerformanceData.Infrastructure.Persistence;
 using GovUk.Frontend.AspNetCore;
 using Microsoft.EntityFrameworkCore;
+using Serilog;
+using Serilog.Formatting.Compact;
+using Serilog.Templates;
+using Serilog.Templates.Themes;
 
-var builder = WebApplication.CreateBuilder(args);
+Log.Logger = new LoggerConfiguration()
+    .WriteTo.Console(new CompactJsonFormatter())
+    .CreateBootstrapLogger();
 
-builder.Services
-    .AddDfeApiClient(builder.Configuration)
-    .AddDfeSignInAuthentication(builder.Configuration)
-    .AddGovUkFrontend(options => options.Rebrand = true);
-
-builder.Services.AddDbContext<PortalDbContext>(options =>
-    options.UseNpgsql(builder.Configuration.GetConnectionString("Postgres")));
+try
+{
+    Log.Information("Starting application");
 
-builder.Services.AddScoped<IPortalDbContext>(sp => sp.GetRequiredService<PortalDbContext>());
+    var builder = WebApplication.CreateBuilder(args);
 
-builder.Services.AddSingleton(_ => new QueueServiceClient(builder.Configuration.GetConnectionString("AzureStorage"),
-    new QueueClientOptions(QueueClientOptions.ServiceVersion.V2025_11_05)
+    builder.Host.UseSerilog((context, services, configuration) =>
     {
-        MessageEncoding = QueueMessageEncoding.Base64
-    }));
-
-builder.Services.AddControllersWithViews();
-
-builder.Services.AddHealthChecks();
-
-var app = builder.Build();
-
-app.UseGovUkFrontend();
-
-app.UseHealthChecks("/healthcheck");
+        var isDevelopment = context.HostingEnvironment.IsDevelopment();
+        
+        configuration
+            .ReadFrom.Configuration(context.Configuration)
+            .ReadFrom.Services(services)
+            .Enrich.FromLogContext()
+            .WriteTo.Console(isDevelopment 
+                ?  new ExpressionTemplate(
+                    "[{@t:HH:mm:ss} {@l:u3}] {SourceContext}\n  {@m}\n{@x}",
+                    theme: TemplateTheme.Code)
+                : new CompactJsonFormatter());
+    });
+    
+    builder.Services
+        .AddDfeApiClient(builder.Configuration)
+        .AddDfeSignInAuthentication(builder.Configuration)
+        .AddGovUkFrontend(options => options.Rebrand = true);
+
+    builder.Services.AddDbContext<PortalDbContext>(options =>
+        options.UseNpgsql(builder.Configuration.GetConnectionString("Postgres")));
+
+    builder.Services.AddScoped<IPortalDbContext>(sp => sp.GetRequiredService<PortalDbContext>());
+
+    builder.Services.AddSingleton(_ => new QueueServiceClient(builder.Configuration.GetConnectionString("AzureStorage"),
+        new QueueClientOptions(QueueClientOptions.ServiceVersion.V2025_11_05)
+        {
+            MessageEncoding = QueueMessageEncoding.Base64
+        }));
+
+    builder.Services.AddControllersWithViews();
+
+    builder.Services.AddHealthChecks();
+
+    var app = builder.Build();
+
+    app.UseSerilogRequestLogging();
+    
+    app.UseGovUkFrontend();
+
+    app.UseHealthChecks("/healthcheck");
 
 // Configure the HTTP request pipeline.
-if (!app.Environment.IsDevelopment())
-{
-    app.UseExceptionHandler("/Home/Error");
-    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
-    app.UseHsts();
-}
+    if (!app.Environment.IsDevelopment())
+    {
+        app.UseExceptionHandler("/Home/Error");
+        // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
+        app.UseHsts();
+    }
 
-app.UseHttpsRedirection();
-app.UseRouting();
+    app.UseHttpsRedirection();
+    app.UseRouting();
 
-app.UseAuthentication();
-app.UseAuthorization();
+    app.UseAuthentication();
+    app.UseAuthorization();
 
-app.MapStaticAssets();
+    app.MapStaticAssets();
 
-app.MapControllerRoute(
-    name: "default",
-    pattern: "{controller=Home}/{action=Index}/{id?}")
-    .WithStaticAssets();
+    app.MapControllerRoute(
+            name: "default",
+            pattern: "{controller=Home}/{action=Index}/{id?}")
+        .WithStaticAssets();
 
 
-app.Run();
+    app.Run();
+}
+catch (Exception e)
+{
+    Console.WriteLine(e);
+    throw;
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/appsettings.json b/src/DfE.CheckPerformanceData.Web/appsettings.json
index 10f68b8..463f06b 100644
--- a/src/DfE.CheckPerformanceData.Web/appsettings.json
+++ b/src/DfE.CheckPerformanceData.Web/appsettings.json
@@ -1,9 +1,19 @@
 {
-  "Logging": {
-    "LogLevel": {
+  "Serilog": {
+    "MinimumLevel": {
       "Default": "Information",
-      "Microsoft.AspNetCore": "Warning"
+      "Override": {
+        "Microsoft": "Warning",
+        "Microsoft.Hosting.Lifetime": "Information",
+        "System": "Warning"
+      }
     }
   },
+//  "Logging": {
+//    "LogLevel": {
+//      "Default": "Information",
+//      "Microsoft.AspNetCore": "Warning"
+//    }
+//  },
   "AllowedHosts": "*"
 }
diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index 63f93c9..560f80f 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -24,6 +24,10 @@
     <PackageVersion Include="NUnit3TestAdapter" Version="5.0.0" />
     <PackageVersion Include="GovUk.Frontend.AspNetCore" Version="3.5.1" />
     <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.4" />
+    <PackageVersion Include="Serilog.AspNetCore" Version="10.0.0" />
+    <PackageVersion Include="Serilog.Expressions" Version="5.0.0" />
+    <PackageVersion Include="Serilog.Formatting.Compact" Version="3.0.0" />
+    <PackageVersion Include="Serilog.Sinks.Console" Version="6.1.1" />
     <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.15.0" />
   </ItemGroup>
 </Project>
\ No newline at end of file

From 96c22aba56cd9c3b35ffaeffbc06e3335b3f54a8 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Tue, 31 Mar 2026 08:52:09 +0100
Subject: [PATCH 07/18] Added dfe signin env vars to review deployment

---
 terraform/application/config/review.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/terraform/application/config/review.yml b/terraform/application/config/review.yml
index 1cdbc6a..12d4eb3 100644
--- a/terraform/application/config/review.yml
+++ b/terraform/application/config/review.yml
@@ -1,2 +1,5 @@
 ---
-EXAMPLE_KEY: example value 1
+DfeSignIn__BaseUrl: https://test-api.signin.education.gov.uk/
+DfeSignIn__ClientId: CheckPerformanceData
+DfeSignIn__Audience: signin.education.gov.uk
+DfeSignIn__MetadataAddress: https://test-oidc.signin.education.gov.uk/.well-known/openid-configuration

From 9c9d8d2c8dc6d0b7c3f2b41e2c651b3f5a949375 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Tue, 31 Mar 2026 09:04:29 +0100
Subject: [PATCH 08/18] Added startup code to make sure RequestPath, Status etc
 are present

---
 src/DfE.CheckPerformanceData.Web/Program.cs | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/DfE.CheckPerformanceData.Web/Program.cs b/src/DfE.CheckPerformanceData.Web/Program.cs
index c3c7bc4..311af06 100644
--- a/src/DfE.CheckPerformanceData.Web/Program.cs
+++ b/src/DfE.CheckPerformanceData.Web/Program.cs
@@ -57,7 +57,16 @@
 
     var app = builder.Build();
 
-    app.UseSerilogRequestLogging();
+    app.UseSerilogRequestLogging(options =>
+    {
+        options.EnrichDiagnosticContext = (diagnosticContext, httpContext) =>
+        {
+            diagnosticContext.Set("RequestPath", httpContext.Request.Path);
+            diagnosticContext.Set("StatusCode", httpContext.Response.StatusCode);
+            diagnosticContext.Set("RequestMethod", httpContext.Request.Method);
+            diagnosticContext.Set("UserAgent", httpContext.Request.Headers.UserAgent.ToString());
+        };
+    });
     
     app.UseGovUkFrontend();
 

From 2c5f023107bc86cc0e80ce753fb18661b49b1f7b Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Tue, 31 Mar 2026 12:06:27 +0100
Subject: [PATCH 09/18] Updated readme

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index af1ebd1..e333b7f 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,8 @@ Prerequisites
 - ~~[Node.js](https://nodejs.org/en/download/) (for building web artefacts: (S)CSS, JS, etc.)~~
 - IDE/Editor of choice (e.g., Visual Studio, Visual Studio Code, JetBrains Rider, etc.)
 - [Docker Desktop](https://docs.docker.com/desktop/) (for development time hosting of dependencies)
-    
+   
+ 
 
 Clone the repository
 ```sh

From ea9a211bf92ddb74ff5ff0a9eb0b4525aae30b19 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Wed, 1 Apr 2026 16:58:46 +0100
Subject: [PATCH 10/18] LAESTAB field for org dto

---
 .../DfESignInApiClient/OrganisationDto.cs     |  5 +++
 .../DfeSignInApiClient/DfeSignInApiClient.cs  | 34 ++++++++++++++++++-
 .../Views/Secret/Index.cshtml                 |  5 +++
 3 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/src/DfE.CheckPerformanceData.Application/DfESignInApiClient/OrganisationDto.cs b/src/DfE.CheckPerformanceData.Application/DfESignInApiClient/OrganisationDto.cs
index 9949d57..80b442f 100644
--- a/src/DfE.CheckPerformanceData.Application/DfESignInApiClient/OrganisationDto.cs
+++ b/src/DfE.CheckPerformanceData.Application/DfESignInApiClient/OrganisationDto.cs
@@ -1,3 +1,5 @@
+using System.Text.Json.Serialization;
+
 namespace DfE.CheckPerformanceData.Application.DfESignInApiClient;
 
 public class OrganisationDto
@@ -18,6 +20,9 @@ public class OrganisationDto
     public int? StatutoryHighAge { get; init; }
     public string? LegacyId { get; init; }
     public string? CompanyRegistrationNumber { get; init; }
+    
+    [JsonIgnore]
+    public string? LAESTAB { get; set; }
 }
 
 
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClient.cs b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClient.cs
index 29220ea..2a5d058 100644
--- a/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClient.cs
+++ b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignInApiClient/DfeSignInApiClient.cs
@@ -1,4 +1,6 @@
 using System.Net.Http.Json;
+using System.Text.Json;
+using System.Text.Json.Serialization;
 using DfE.CheckPerformanceData.Application.DfESignInApiClient;
 
 namespace DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
@@ -14,8 +16,38 @@ public DfeSignInApiClient(HttpClient httpClient)
     
     public async Task<OrganisationDto?> GetOrganisationAsync(string userId, string organisationId)
     {
-        var userOrganisations = await _httpClient.GetFromJsonAsync<List<OrganisationDto>>($"users/{userId}/organisations");
+        //var organisationsJson = await _httpClient.GetStringAsync($"users/{userId}/organisations");
+        var userOrganisations = await _httpClient.GetFromJsonAsync<List<OrganisationDto>>($"users/{userId}/organisations", 
+            new JsonSerializerOptions()
+            {
+                Converters = { new OrganisationDtoJsonConverter() }
+            });
         
         return userOrganisations?.FirstOrDefault(o => o.Id == organisationId);
     }
+}
+
+public class OrganisationDtoJsonConverter : JsonConverter<OrganisationDto>
+{
+    public override OrganisationDto Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+    {
+        using var document = JsonDocument.ParseValue(ref reader);
+        var root = document.RootElement;
+        
+        var dto = JsonSerializer.Deserialize<OrganisationDto>(root.GetRawText(), new JsonSerializerOptions() { PropertyNameCaseInsensitive = true });
+        
+        
+        if (root.TryGetProperty("localAuthority", out var localAuthorityElement))
+        {
+            var orgCode = localAuthorityElement.GetProperty("code").GetString();
+            var orgId = root.GetProperty("establishmentNumber").GetString();
+        
+            dto.LAESTAB = $"{orgCode}{orgId}";   
+        }
+        
+        return dto;
+    }
+
+    public override void Write(Utf8JsonWriter writer, OrganisationDto value, JsonSerializerOptions options) => 
+        throw new NotImplementedException();
 }
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml b/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
index f1883e8..b114481 100644
--- a/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
+++ b/src/DfE.CheckPerformanceData.Web/Views/Secret/Index.cshtml
@@ -13,6 +13,11 @@
         <dt class="govuk-summary-list__key">ID</dt>
         <dd class="govuk-summary-list__value">@Model.Organisation.Id</dd>
     </div>
+    
+    <div class="govuk-summary-list__row">
+        <dt class="govuk-summary-list__key">LAESTAB</dt>
+        <dd class="govuk-summary-list__value">@Model.Organisation.LAESTAB</dd>
+    </div>
 
     <div class="govuk-summary-list__row">
         <dt class="govuk-summary-list__key">Name</dt>

From 9ee7bf375c7cb8584bd8f76050e3268a243327a9 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Wed, 1 Apr 2026 17:00:05 +0100
Subject: [PATCH 11/18] Merge from stash

---
 .../IPortalDbContext.cs                       |  2 +-
 .../Entities/CheckingWindow.cs                | 17 ++++++
 .../Entities/Workflow.cs                      |  8 ---
 ...CheckPerformanceData.Infrastructure.csproj |  4 --
 .../20260331100046_InitialCreate.Designer.cs  | 56 +++++++++++++++++++
 .../20260331100046_InitialCreate.cs           | 39 +++++++++++++
 .../PortalDbContextModelSnapshot.cs           | 53 ++++++++++++++++++
 .../Persistence/PortalDbContext.cs            |  2 +-
 .../Extensions/MigrationExtensions.cs         | 17 ++++++
 src/DfE.CheckPerformanceData.Web/Program.cs   |  3 +
 10 files changed, 187 insertions(+), 14 deletions(-)
 create mode 100644 src/DfE.CheckPerformanceData.Domain/Entities/CheckingWindow.cs
 delete mode 100644 src/DfE.CheckPerformanceData.Domain/Entities/Workflow.cs
 create mode 100644 src/DfE.CheckPerformanceData.Infrastructure/Migrations/20260331100046_InitialCreate.Designer.cs
 create mode 100644 src/DfE.CheckPerformanceData.Infrastructure/Migrations/20260331100046_InitialCreate.cs
 create mode 100644 src/DfE.CheckPerformanceData.Infrastructure/Migrations/PortalDbContextModelSnapshot.cs
 create mode 100644 src/DfE.CheckPerformanceData.Web/Extensions/MigrationExtensions.cs

diff --git a/src/DfE.CheckPerformanceData.Application/IPortalDbContext.cs b/src/DfE.CheckPerformanceData.Application/IPortalDbContext.cs
index e2cc0b0..6fbbeb7 100644
--- a/src/DfE.CheckPerformanceData.Application/IPortalDbContext.cs
+++ b/src/DfE.CheckPerformanceData.Application/IPortalDbContext.cs
@@ -5,6 +5,6 @@ namespace DfE.CheckPerformanceData.Application;
 
 public interface IPortalDbContext
 {
-    DbSet<Workflow> Workflows { get; }
+    DbSet<CheckingWindow> CheckingWindows { get; }
     Task<int> SaveChangesAsync(CancellationToken cancellationToken = default);
 }
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Domain/Entities/CheckingWindow.cs b/src/DfE.CheckPerformanceData.Domain/Entities/CheckingWindow.cs
new file mode 100644
index 0000000..4ad9e1f
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Domain/Entities/CheckingWindow.cs
@@ -0,0 +1,17 @@
+namespace DfE.CheckPerformanceData.Domain.Entities;
+
+public class CheckingWindow
+{
+    public int Id { get; set; }
+    public DateTime StartDate { get; set; }
+    public DateTime EndDate { get; set; }
+    public OrganisationTypes OrganisationType { get; set; }
+    public string Title { get; set; }
+}
+
+public enum OrganisationTypes
+{
+    KS2,
+    KS4,
+    Post16
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Domain/Entities/Workflow.cs b/src/DfE.CheckPerformanceData.Domain/Entities/Workflow.cs
deleted file mode 100644
index f4b4807..0000000
--- a/src/DfE.CheckPerformanceData.Domain/Entities/Workflow.cs
+++ /dev/null
@@ -1,8 +0,0 @@
-
-namespace DfE.CheckPerformanceData.Domain.Entities;
-
-public class Workflow
-{
-    public int Id { get; set; }
-    public string Name { get; set; }
-}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj b/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj
index 594a606..721156e 100644
--- a/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj
+++ b/src/DfE.CheckPerformanceData.Infrastructure/DfE.CheckPerformanceData.Infrastructure.csproj
@@ -24,8 +24,4 @@
       <PackageReference Include="System.IdentityModel.Tokens.Jwt" />
     </ItemGroup>
 
-    <ItemGroup>
-      <Folder Include="Persistence\Repositories\" />
-    </ItemGroup>
-
 </Project>
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/Migrations/20260331100046_InitialCreate.Designer.cs b/src/DfE.CheckPerformanceData.Infrastructure/Migrations/20260331100046_InitialCreate.Designer.cs
new file mode 100644
index 0000000..6029338
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Infrastructure/Migrations/20260331100046_InitialCreate.Designer.cs
@@ -0,0 +1,56 @@
+// <auto-generated />
+using System;
+using DfE.CheckPerformanceData.Infrastructure.Persistence;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace DfE.CheckPerformanceData.Infrastructure.Migrations
+{
+    [DbContext(typeof(PortalDbContext))]
+    [Migration("20260331100046_InitialCreate")]
+    partial class InitialCreate
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.5")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("DfE.CheckPerformanceData.Domain.Entities.CheckingWindow", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<DateTime>("EndDate")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("OrganisationType")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTime>("StartDate")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("CheckingWindows");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/Migrations/20260331100046_InitialCreate.cs b/src/DfE.CheckPerformanceData.Infrastructure/Migrations/20260331100046_InitialCreate.cs
new file mode 100644
index 0000000..addf8f7
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Infrastructure/Migrations/20260331100046_InitialCreate.cs
@@ -0,0 +1,39 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace DfE.CheckPerformanceData.Infrastructure.Migrations
+{
+    /// <inheritdoc />
+    public partial class InitialCreate : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "CheckingWindows",
+                columns: table => new
+                {
+                    Id = table.Column<int>(type: "integer", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    StartDate = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    EndDate = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    OrganisationType = table.Column<int>(type: "integer", nullable: false),
+                    Title = table.Column<string>(type: "text", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_CheckingWindows", x => x.Id);
+                });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "CheckingWindows");
+        }
+    }
+}
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/Migrations/PortalDbContextModelSnapshot.cs b/src/DfE.CheckPerformanceData.Infrastructure/Migrations/PortalDbContextModelSnapshot.cs
new file mode 100644
index 0000000..6106f74
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Infrastructure/Migrations/PortalDbContextModelSnapshot.cs
@@ -0,0 +1,53 @@
+// <auto-generated />
+using System;
+using DfE.CheckPerformanceData.Infrastructure.Persistence;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace DfE.CheckPerformanceData.Infrastructure.Migrations
+{
+    [DbContext(typeof(PortalDbContext))]
+    partial class PortalDbContextModelSnapshot : ModelSnapshot
+    {
+        protected override void BuildModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.5")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("DfE.CheckPerformanceData.Domain.Entities.CheckingWindow", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<DateTime>("EndDate")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("OrganisationType")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTime>("StartDate")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Title")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("CheckingWindows");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/Persistence/PortalDbContext.cs b/src/DfE.CheckPerformanceData.Infrastructure/Persistence/PortalDbContext.cs
index aef69fe..2c96531 100644
--- a/src/DfE.CheckPerformanceData.Infrastructure/Persistence/PortalDbContext.cs
+++ b/src/DfE.CheckPerformanceData.Infrastructure/Persistence/PortalDbContext.cs
@@ -6,5 +6,5 @@ namespace DfE.CheckPerformanceData.Infrastructure.Persistence;
 
 public class PortalDbContext(DbContextOptions<PortalDbContext> options) : DbContext(options), IPortalDbContext
 {
-    public DbSet<Workflow> Workflows => Set<Workflow>();
+    public DbSet<CheckingWindow> CheckingWindows => Set<CheckingWindow>();
 }
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Extensions/MigrationExtensions.cs b/src/DfE.CheckPerformanceData.Web/Extensions/MigrationExtensions.cs
new file mode 100644
index 0000000..ec04840
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Web/Extensions/MigrationExtensions.cs
@@ -0,0 +1,17 @@
+using DfE.CheckPerformanceData.Infrastructure.Persistence;
+using Microsoft.EntityFrameworkCore;
+
+namespace DfE.CheckPerformanceData.Web.Extensions;
+
+public static class MigrationExtensions
+{
+    public static async Task MigrateDatabaseAsync(this WebApplication app)
+    {
+        if (!app.Environment.IsDevelopment())
+            return;
+
+        await using var scope = app.Services.CreateAsyncScope();
+        var db = scope.ServiceProvider.GetRequiredService<PortalDbContext>();
+        await db.Database.MigrateAsync();
+    }
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Program.cs b/src/DfE.CheckPerformanceData.Web/Program.cs
index 311af06..2c3fb81 100644
--- a/src/DfE.CheckPerformanceData.Web/Program.cs
+++ b/src/DfE.CheckPerformanceData.Web/Program.cs
@@ -3,6 +3,7 @@
 using DfE.CheckPerformanceData.Infrastructure.DfeSignIn;
 using DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
 using DfE.CheckPerformanceData.Infrastructure.Persistence;
+using DfE.CheckPerformanceData.Web.Extensions;
 using GovUk.Frontend.AspNetCore;
 using Microsoft.EntityFrameworkCore;
 using Serilog;
@@ -57,6 +58,8 @@
 
     var app = builder.Build();
 
+    await app.MigrateDatabaseAsync();
+    
     app.UseSerilogRequestLogging(options =>
     {
         options.EnrichDiagnosticContext = (diagnosticContext, httpContext) =>

From 40205d40897a2bef12080fa0476a6115e9d8e029 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Wed, 1 Apr 2026 18:40:25 +0100
Subject: [PATCH 12/18] Added startup logging and force migration

---
 .../Extensions/MigrationExtensions.cs         |  4 ++--
 src/DfE.CheckPerformanceData.Web/Program.cs   | 19 +++++++++++--------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/src/DfE.CheckPerformanceData.Web/Extensions/MigrationExtensions.cs b/src/DfE.CheckPerformanceData.Web/Extensions/MigrationExtensions.cs
index ec04840..4b51087 100644
--- a/src/DfE.CheckPerformanceData.Web/Extensions/MigrationExtensions.cs
+++ b/src/DfE.CheckPerformanceData.Web/Extensions/MigrationExtensions.cs
@@ -7,8 +7,8 @@ public static class MigrationExtensions
 {
     public static async Task MigrateDatabaseAsync(this WebApplication app)
     {
-        if (!app.Environment.IsDevelopment())
-            return;
+        // if (!app.Environment.IsDevelopment())
+        //     return;
 
         await using var scope = app.Services.CreateAsyncScope();
         var db = scope.ServiceProvider.GetRequiredService<PortalDbContext>();
diff --git a/src/DfE.CheckPerformanceData.Web/Program.cs b/src/DfE.CheckPerformanceData.Web/Program.cs
index 2c3fb81..c27a3a4 100644
--- a/src/DfE.CheckPerformanceData.Web/Program.cs
+++ b/src/DfE.CheckPerformanceData.Web/Program.cs
@@ -24,18 +24,18 @@
     builder.Host.UseSerilog((context, services, configuration) =>
     {
         var isDevelopment = context.HostingEnvironment.IsDevelopment();
-        
+
         configuration
             .ReadFrom.Configuration(context.Configuration)
             .ReadFrom.Services(services)
             .Enrich.FromLogContext()
-            .WriteTo.Console(isDevelopment 
-                ?  new ExpressionTemplate(
+            .WriteTo.Console(isDevelopment
+                ? new ExpressionTemplate(
                     "[{@t:HH:mm:ss} {@l:u3}] {SourceContext}\n  {@m}\n{@x}",
                     theme: TemplateTheme.Code)
                 : new CompactJsonFormatter());
     });
-    
+
     builder.Services
         .AddDfeApiClient(builder.Configuration)
         .AddDfeSignInAuthentication(builder.Configuration)
@@ -59,7 +59,7 @@
     var app = builder.Build();
 
     await app.MigrateDatabaseAsync();
-    
+
     app.UseSerilogRequestLogging(options =>
     {
         options.EnrichDiagnosticContext = (diagnosticContext, httpContext) =>
@@ -70,7 +70,7 @@
             diagnosticContext.Set("UserAgent", httpContext.Request.Headers.UserAgent.ToString());
         };
     });
-    
+
     app.UseGovUkFrontend();
 
     app.UseHealthChecks("/healthcheck");
@@ -101,6 +101,9 @@
 }
 catch (Exception e)
 {
-    Console.WriteLine(e);
-    throw;
+    Log.Fatal(e, "Application terminated unexpectedly");
+}
+finally
+{
+    Log.CloseAndFlush();   
 }
\ No newline at end of file

From cfdd334a0d199bff19a17bec52b9de0c048e4147 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Sat, 4 Apr 2026 15:08:22 +0100
Subject: [PATCH 13/18] test

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index e333b7f..ef517ef 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ git clone https://github.com/DFE-Digital/check-performance-data
 Build the C#/.NET solution
 ```sh
 dotnet build
-```
+``` 
 
 Confirm tests are passing locally
 ```sh

From 995c5d7104023385afe3db5039625861b23449ee Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Sat, 4 Apr 2026 15:10:26 +0100
Subject: [PATCH 14/18] test

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index ef517ef..ddaf7a2 100644
--- a/README.md
+++ b/README.md
@@ -30,4 +30,4 @@ dotnet test
 
 ```sh
 docker compose up --build -d
-```
\ No newline at end of file
+``` 
\ No newline at end of file

From bc1f1b616ab005450bafc72573834997432a9a8e Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Sat, 4 Apr 2026 15:10:59 +0100
Subject: [PATCH 15/18] test

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index ddaf7a2..e333b7f 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ git clone https://github.com/DFE-Digital/check-performance-data
 Build the C#/.NET solution
 ```sh
 dotnet build
-``` 
+```
 
 Confirm tests are passing locally
 ```sh
@@ -30,4 +30,4 @@ dotnet test
 
 ```sh
 docker compose up --build -d
-``` 
\ No newline at end of file
+```
\ No newline at end of file

From 885434a2dfbb9809281e40c21b6f603433e1b0b2 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Sat, 4 Apr 2026 17:41:01 +0100
Subject: [PATCH 16/18] test

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index e333b7f..22606e6 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ dotnet build
 Confirm tests are passing locally
 ```sh
 dotnet test
-```
+``` 
 
 ```sh
 docker compose up --build -d

From e43ebe8f2a0b7ba90bfc38ad053c85c4b40c24a0 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Sun, 5 Apr 2026 20:59:28 +0100
Subject: [PATCH 17/18] Claims Enrichment test

---
 docker-compose.yaml                           |  4 +--
 .../IClaimsEnrichmentService.cs               | 34 ++++++++++++++++++
 .../Entities/CheckingWindow.cs                |  6 ++--
 .../DfeSignIn/DfeSignInAuthExtensions.cs      | 19 ++++++++--
 .../Seeding/DevDataSeeder.cs                  | 35 +++++++++++++++++++
 .../Controllers/SecretController.cs           | 10 +++++-
 src/DfE.CheckPerformanceData.Web/Program.cs   | 12 +++++++
 .../appsettings.json                          |  6 ----
 8 files changed, 112 insertions(+), 14 deletions(-)
 create mode 100644 src/DfE.CheckPerformanceData.Application/ClaimsEnrichment/IClaimsEnrichmentService.cs
 create mode 100644 src/DfE.CheckPerformanceData.Infrastructure/Seeding/DevDataSeeder.cs

diff --git a/docker-compose.yaml b/docker-compose.yaml
index c0d8c99..d9f99be 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -10,7 +10,7 @@
     environment:
       - ASPNETCORE_ENVIRONMENT=${ASPNETCORE_ENVIRONMENT:-Development}
       - ASPNETCORE_URLS=http://+:8080
-      - ConnectionStrings__Postgres=${POSTGRES_CONNECTION_STRING:-Host=db;Database=helloworld;Username=postgres;Password=postgres}
+      - ConnectionStrings__Postgres=${POSTGRES_CONNECTION_STRING:-Host=db;Database=cypd;Username=postgres;Password=postgres}
       - ConnectionStrings__AzureStorage=${AZURE_STORAGE_CONNECTION_STRING:-DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;QueueEndpoint=http://azurite:10001/devstoreaccount1;}
       - DfeSignIn__BaseUrl=${DFESIGNIN_BASEURL:-https://test-api.signin.education.gov.uk/}
       - DfeSignIn__ClientId=${DFESIGNIN_CLIENTID}
@@ -52,7 +52,7 @@
     container_name: cypd_db
     image: postgres:16
     environment:
-      - POSTGRES_DB=helloworld
+      - POSTGRES_DB=cypd
       - POSTGRES_USER=postgres
       - POSTGRES_PASSWORD=postgres
     ports:
diff --git a/src/DfE.CheckPerformanceData.Application/ClaimsEnrichment/IClaimsEnrichmentService.cs b/src/DfE.CheckPerformanceData.Application/ClaimsEnrichment/IClaimsEnrichmentService.cs
new file mode 100644
index 0000000..c89aa25
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Application/ClaimsEnrichment/IClaimsEnrichmentService.cs
@@ -0,0 +1,34 @@
+using System.Security.Claims;
+using System.Text.Json.Nodes;
+using DfE.CheckPerformanceData.Application.DfESignInApiClient;
+
+namespace DfE.CheckPerformanceData.Application.ClaimsEnrichment;
+
+public interface IClaimsEnrichmentService
+{
+    Task EnrichAsync(ClaimsIdentity identity);
+}
+
+
+public class ClaimsEnrichmentService: IClaimsEnrichmentService
+{
+    private readonly IDfESignInApiClient _apiClient;
+
+    public ClaimsEnrichmentService(IDfESignInApiClient apiClient)
+    {
+        _apiClient = apiClient;
+    }
+    public async Task EnrichAsync(ClaimsIdentity identity)
+    {
+        var userid = identity.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        
+        var orgJson = identity.FindFirst("organisation")?.Value ?? "{}";
+        var org = JsonNode.Parse(orgJson);
+        var orgId = org["id"]?.ToString() ?? string.Empty;
+        
+        var organisation = await _apiClient.GetOrganisationAsync(userid, orgId);
+
+        identity.AddClaim(new Claim("low_age", organisation.StatutoryLowAge.ToString()));
+        identity.AddClaim(new Claim("high_age", organisation.StatutoryHighAge.ToString()));
+    }
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Domain/Entities/CheckingWindow.cs b/src/DfE.CheckPerformanceData.Domain/Entities/CheckingWindow.cs
index 4ad9e1f..70f23ac 100644
--- a/src/DfE.CheckPerformanceData.Domain/Entities/CheckingWindow.cs
+++ b/src/DfE.CheckPerformanceData.Domain/Entities/CheckingWindow.cs
@@ -11,7 +11,7 @@ public class CheckingWindow
 
 public enum OrganisationTypes
 {
-    KS2,
-    KS4,
-    Post16
+    KS2, //3-11
+    KS4, //11-16
+    Post16 //16-18
 }
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/DfeSignIn/DfeSignInAuthExtensions.cs b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignIn/DfeSignInAuthExtensions.cs
index cad4519..31dd4a5 100644
--- a/src/DfE.CheckPerformanceData.Infrastructure/DfeSignIn/DfeSignInAuthExtensions.cs
+++ b/src/DfE.CheckPerformanceData.Infrastructure/DfeSignIn/DfeSignInAuthExtensions.cs
@@ -1,4 +1,6 @@
-using DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
+using System.Security.Claims;
+using DfE.CheckPerformanceData.Application.ClaimsEnrichment;
+using DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.Extensions.Configuration;
@@ -55,7 +57,20 @@ public static IServiceCollection AddDfeSignInAuthentication(this IServiceCollect
                 {
                     //ctx.HttpContext.Response.Headers.Add("Cache-Control", "no-store");
                     return Task.CompletedTask;
-                };        
+                };
+
+                options.Events.OnUserInformationReceived = ctx =>
+                {
+                    return Task.CompletedTask;
+                };
+
+                options.Events.OnTokenValidated = async ctx =>
+                {
+                    var enrichmentService = ctx.HttpContext.RequestServices
+                        .GetRequiredService<IClaimsEnrichmentService>();
+
+                    await enrichmentService.EnrichAsync((ClaimsIdentity)ctx.Principal!.Identity!);
+                };
             });
         
         return services;
diff --git a/src/DfE.CheckPerformanceData.Infrastructure/Seeding/DevDataSeeder.cs b/src/DfE.CheckPerformanceData.Infrastructure/Seeding/DevDataSeeder.cs
new file mode 100644
index 0000000..14fc13b
--- /dev/null
+++ b/src/DfE.CheckPerformanceData.Infrastructure/Seeding/DevDataSeeder.cs
@@ -0,0 +1,35 @@
+using DfE.CheckPerformanceData.Application;
+using DfE.CheckPerformanceData.Domain.Entities;
+using Microsoft.EntityFrameworkCore;
+
+namespace DfE.CheckPerformanceData.Infrastructure.Seeding;
+
+public class DevDataSeeder(IPortalDbContext dbContext)
+{
+    public async Task SeedAsync()
+    {
+        if (await dbContext.CheckingWindows.AnyAsync())
+            return;
+
+        await dbContext.CheckingWindows.AddRangeAsync(
+            new CheckingWindow()
+            {
+                Id = 1,
+                StartDate = DateTime.UtcNow.AddDays(-1),
+                EndDate = DateTime.UtcNow.AddDays(+13), 
+                OrganisationType = OrganisationTypes.KS4, 
+                Title = "KS4 June"
+            },
+            new CheckingWindow()
+            {
+                Id = 2,
+                StartDate = DateTime.UtcNow.AddDays(-3),
+                EndDate = DateTime.UtcNow.AddDays(+11), 
+                OrganisationType = OrganisationTypes.KS2, 
+                Title = "KS2"
+            }
+        );
+        
+        await dbContext.SaveChangesAsync();
+    }
+}
\ No newline at end of file
diff --git a/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs b/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
index ac478f1..b26e587 100644
--- a/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
+++ b/src/DfE.CheckPerformanceData.Web/Controllers/SecretController.cs
@@ -1,5 +1,6 @@
 using System.Security.Claims;
 using System.Text.Json.Nodes;
+using DfE.CheckPerformanceData.Application;
 using DfE.CheckPerformanceData.Application.DfESignInApiClient;
 using DfE.CheckPerformanceData.Web.Controllers.ViewModels;
 using Microsoft.AspNetCore.Authentication;
@@ -7,16 +8,19 @@
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
 
 namespace DfE.CheckPerformanceData.Web.Controllers;
 
 public class SecretController : Controller
 {
     private readonly IDfESignInApiClient _dfeSignInApiClient;
+    private readonly IPortalDbContext _dbContext;
 
-    public SecretController(IDfESignInApiClient dfeSignInApiClient)
+    public SecretController(IDfESignInApiClient dfeSignInApiClient, IPortalDbContext dbContext)
     {
         _dfeSignInApiClient = dfeSignInApiClient;
+        _dbContext = dbContext;
     }
     
     [Authorize]
@@ -35,6 +39,10 @@ public async Task<IActionResult> Index()
             UserName = User.FindFirstValue(ClaimTypes.GivenName) + " " + User.FindFirstValue(ClaimTypes.Surname),
             Organisation = organisation
         };
+
+        var now = DateTime.UtcNow;
+        var currentWindowsForUser = await _dbContext.CheckingWindows.Where(w => w.StartDate <= now && w.EndDate >= now)
+            .AsNoTracking().ToListAsync();
         
         return View(vm);
     }
diff --git a/src/DfE.CheckPerformanceData.Web/Program.cs b/src/DfE.CheckPerformanceData.Web/Program.cs
index c27a3a4..92bcec2 100644
--- a/src/DfE.CheckPerformanceData.Web/Program.cs
+++ b/src/DfE.CheckPerformanceData.Web/Program.cs
@@ -1,8 +1,10 @@
 using Azure.Storage.Queues;
 using DfE.CheckPerformanceData.Application;
+using DfE.CheckPerformanceData.Application.ClaimsEnrichment;
 using DfE.CheckPerformanceData.Infrastructure.DfeSignIn;
 using DfE.CheckPerformanceData.Infrastructure.DfeSignInApiClient;
 using DfE.CheckPerformanceData.Infrastructure.Persistence;
+using DfE.CheckPerformanceData.Infrastructure.Seeding;
 using DfE.CheckPerformanceData.Web.Extensions;
 using GovUk.Frontend.AspNetCore;
 using Microsoft.EntityFrameworkCore;
@@ -41,6 +43,11 @@
         .AddDfeSignInAuthentication(builder.Configuration)
         .AddGovUkFrontend(options => options.Rebrand = true);
 
+    if (builder.Environment.IsDevelopment()) 
+        builder.Services.AddScoped<DevDataSeeder>();
+    
+    builder.Services.AddScoped<IClaimsEnrichmentService, ClaimsEnrichmentService>();
+    
     builder.Services.AddDbContext<PortalDbContext>(options =>
         options.UseNpgsql(builder.Configuration.GetConnectionString("Postgres")));
 
@@ -82,6 +89,11 @@
         // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
         app.UseHsts();
     }
+    else
+    {
+        using var scope = app.Services.CreateScope();
+        await scope.ServiceProvider.GetRequiredService<DevDataSeeder>().SeedAsync();
+    }
 
     app.UseHttpsRedirection();
     app.UseRouting();
diff --git a/src/DfE.CheckPerformanceData.Web/appsettings.json b/src/DfE.CheckPerformanceData.Web/appsettings.json
index 463f06b..55aa94c 100644
--- a/src/DfE.CheckPerformanceData.Web/appsettings.json
+++ b/src/DfE.CheckPerformanceData.Web/appsettings.json
@@ -9,11 +9,5 @@
       }
     }
   },
-//  "Logging": {
-//    "LogLevel": {
-//      "Default": "Information",
-//      "Microsoft.AspNetCore": "Warning"
-//    }
-//  },
   "AllowedHosts": "*"
 }

From 729e4abcf7e36e3619df7a06a3432417c4037608 Mon Sep 17 00:00:00 2001
From: Dave Gouge <davegouge@gmail.com>
Date: Mon, 6 Apr 2026 20:11:46 +0100
Subject: [PATCH 18/18] Altered compose file to allow easy starting of just
 background services

---
 docker-compose.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index d9f99be..c52507a 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -1,5 +1,6 @@
 services:
   web:
+    profiles: [web, all]
     container_name: cypd_web
     build:
       context: ./src
@@ -24,6 +25,7 @@
       - azurite
 
   rules_engine:
+    profiles: [rules_engine, all]
     container_name: cypd_rules_engine
     build:
       context: ./src