BACKEND DEVELOPMENTCOMPLETE REFERENCE

Design Principles

Coding Standards

Follow PascalCase for public members and camelCase for private fields. Use clear, descriptive names that express intent.

public class OrderProcessor
{
  private List _orders; // camelCase
  public void ProcessOrder(Order order) { } // PascalCase
  private bool ValidatePayment(Payment payment) { }
}

Use snake_case for variables and functions, UPPER_CASE for constants. 4-space indentation. Max line length 79 chars (PEP 8) or 88 (Black).

def process_order(order: Order) -> bool:
    TIMEOUT_SECONDS = 30
    valid_items = validate_items(order.items)
    return valid_items and order.total > 0

Use snake_case for variables, functions, and modules. PascalCase for types and constants. Follow Rust API guidelines for clarity.

pub struct OrderProcessor {
    active_orders: Vec,
}

pub fn process_order(order: Order) -> Result<(), Error> {
    let ORDER_LIMIT = 1000;
    Ok(())
}

One public class per file. Organize members: public methods, properties, private methods. Use namespaces to organize by feature or domain.

namespace Domain.Orders
{
  public class Order
  {
    public int Id { get; set; }
    public List Items { get; set; }
    
    public decimal GetTotal() => Items.Sum(i => i.Price);
    private void ValidateItems() { }
  }
}

Standard structure: src/package_name for code, tests/ for tests, setup.py/pyproject.toml for config. Use __init__.py for packages.

project/
├── src/myapp/
│   ├── __init__.py
│   ├── models.py
│   └── services.py
├── tests/
│   └── test_models.py
├── pyproject.toml
└── README.md

Use workspaces for multi-crate projects. Separate library crates from binary crates. Clear module hierarchy with mod.rs.

[workspace]
members = ["crates/api", "crates/domain"]

// src/lib.rs
pub mod domain;
pub mod services;

// domain/mod.rs
pub struct Order { }
pub mod validators;

Paradigms

Organize code around objects with state and behavior. Emphasizes encapsulation, inheritance, and polymorphism. Natural for modeling real-world entities.

Treat computation as the evaluation of pure functions. Emphasizes immutability, higher-order functions, and avoiding side effects. Easier reasoning and testing.

Build responsive systems using observable streams and event-driven architecture. Components react to data changes. Good for handling async operations.

Organize code as a sequence of procedures/functions that modify state. Direct control flow. Good for straightforward, step-by-step logic.

Specify what you want rather than how to achieve it. Let the system figure out the steps. Examples: SQL, configuration-based systems.

Concurrent systems based on independent actors communicating via messages. Avoids shared state and race conditions. Excellent for distributed systems.

Architectural Patterns

Concentric layers separating concerns: Entities, Use Cases, Interface Adapters, Frameworks. Dependencies point inward. Highly testable and decoupled.

Ports and Adapters. Core business logic at center with external dependencies as adapters. Enables multiple entry/exit points without changing core logic.

Independently deployable services built around business capabilities. Each service has its own database. Scaled and developed independently. Increased complexity.

Single deployment unit with clear module boundaries. Modules communicate through well-defined interfaces. Balances simplicity of monolith with organization of microservices.

Align software structure with business domain. Use ubiquitous language shared between developers and domain experts. Organize around bounded contexts.

Components communicate through events. Decoupled producers and consumers. Excellent for real-time systems and maintaining eventual consistency across services.

Business capabilities exposed as reusable services. Heavy use of messaging and protocols. Enterprise-level approach, often with ESB and SOAP.

Run code without managing servers. Scale automatically. Pay per execution. Good for event-driven workloads and variable traffic patterns.

Design Patterns

Enterprise Patterns

Abstract data access logic behind a repository interface. Clients interact with repositories instead of directly accessing data. Enables switching persistence mechanisms.

public interface IOrderRepository {
  Task GetByIdAsync(int id);
  Task> GetAllAsync();
  Task SaveAsync(Order order);
}

public class OrderRepository : IOrderRepository {
  private readonly DbContext _db;
  public Task GetByIdAsync(int id) => _db.Orders.FindAsync(id);
}

Maintain a collection of objects affected by a business transaction and coordinates writing changes and handling concurrency. Ensures all changes are atomic.

public interface IUnitOfWork {
  IOrderRepository Orders { get; }
  ICustomerRepository Customers { get; }
  Task SaveChangesAsync();
}

var order = await _uow.Orders.GetByIdAsync(1);
order.Status = OrderStatus.Shipped;
await _uow.SaveChangesAsync();

Encapsulate query logic in reusable specification objects. Separate complex filtering rules from repositories. Makes queries composable and testable.

public class ActiveOrdersSpec : Specification {
  public ActiveOrdersSpec() {
    AddCriteria(o => o.Status == OrderStatus.Active);
    AddInclude(o => o.Items);
  }
}

var orders = await repo.GetAsync(new ActiveOrdersSpec());

Create a layer that translates between external system contracts and your domain model. Isolates domain from changes in external systems.

public class LegacyOrderAdapter {
  public Order AdaptFromLegacy(LegacyOrderDto dto) {
    return new Order {
      Id = dto.OrderId,
      Status = MapLegacyStatus(dto.Status),
      Items = dto.Items.Select(AdaptItem).ToList()
    };
  }
}

Maintain denormalized, query-optimized views of data separate from write models. Each read model is optimized for specific queries. Common in CQRS.

Coordinate long-running, distributed transactions across multiple services. Sagas are event-driven; Process Managers route messages. Handle compensating transactions for failures.

Data Handling

Map objects to database tables. Handle hydration and persistence automatically. Examples: Entity Framework, SQLAlchemy, SeaORM. Trade flexibility for convenience.

Write SQL with less boilerplate through fluent APIs. Dapper, Linq2Db (C#), SQLAlchemy Core (Python), sqlx (Rust). More control than ORMs, less verbose than raw SQL.

var orders = await connection.QueryAsync(
  "SELECT * FROM Orders WHERE CustomerId = @CustomerId",
  new { CustomerId = 123 }
);

Version control your schema changes. Migrations are versioned scripts or code that evolve schema over time. Reversible and trackable. Examples: Flyway, EF Migrations, Alembic.

public class AddOrderTableMigration : Migration {
  public override void Up() {
    CreateTable("Orders")
      .WithColumn("Id").AsInt32().PrimaryKey()
      .WithColumn("CustomerId").AsInt32()
      .WithColumn("Total").AsDecimal();
  }
}

Reduce database hits with in-memory or distributed caches. Cache-aside, write-through, write-behind patterns. Know cache invalidation strategies.

Denormalized views optimized for specific queries. Kept in sync with write model via events. Critical for read-heavy workloads and analytics.

Full-text search and analytics via Elasticsearch, Solr, or similar. Index documents for fast, flexible querying beyond SQL capabilities.

CQRS & Event Sourcing

Client sends a command or query to the API endpoint.

Receives request, validates input, routes to command/query handler.

Cross-cutting concerns: logging, validation, authorization, error handling.

Processes command, validates business rules, emits domain events. Single source of truth.

Persists events transactionally. Ensures no loss. Published asynchronously via message broker.

Subscribe to events, build denormalized read models for fast queries.

Database Patterns

Each microservice owns its database schema. Enables independent scaling and schema evolution. Requires eventual consistency across services.

Multiple services share a database schema. Simpler to query across services but tight coupling. Hard to scale independently.

Serve multiple tenants in a single database. Shared or separate schemas. Requires careful data isolation and querying. Cost-effective but complex.

Replicate data to read-only copies for scaling read workloads. Asynchronous replication. Introduces eventual consistency window.

Partition data across multiple database instances by a shard key (e.g., customer_id). Horizontal scaling for write-heavy workloads.

Separate read and write databases. Writes go to normalized write DB, reads from optimized read DB. Projections keep them in sync.

Capture database changes as a stream of events. Trigger downstream processes, update caches, replicate to other systems.

Mark records as deleted with a timestamp rather than removing them. Preserves history and allows recovery. Add filter to queries.

Database-native versioning. Track row changes over time. Queries can see historical versions. Available in SQL Server, PostgreSQL.

Use version numbers or timestamps instead of locks. Last writer wins after checking version hasn't changed. Good for distributed systems.

API Patterns

Resource-oriented APIs using HTTP verbs (GET, POST, PUT, DELETE). Stateless, cacheable, standardized. Most common pattern. Status codes indicate outcome.

POST /api/orders
GET /api/orders/123
PUT /api/orders/123
DELETE /api/orders/123

Query language for APIs. Clients request exact data needed, avoiding over-fetching. Strong typing, introspection, aggregates data from multiple sources.

query {
  order(id: 123) {
    id
    customer { name email }
    items { sku quantity }
  }
}

High-performance RPC using HTTP/2 and Protocol Buffers. Typed contracts, streaming, multiplexing. Excellent for service-to-service communication.

Real-time bidirectional (WebSocket) or server-to-client (SSE) communication. Avoid polling. Good for notifications and live updates.

Light-weight, convention-free API definition. Map HTTP endpoints directly to handler functions. Less ceremony than controllers. Common in .NET 6+.

Single entry point for clients. Routes requests, handles authentication, rate limiting, response transformation. Decouples clients from backend services.

Messaging & Events

Publishers send messages to a topic; subscribers receive copies. Decouples producers from consumers. Examples: Azure Service Bus Topics, AWS SNS, RabbitMQ Topic Exchange.

FIFO delivery of messages to a queue. Single consumer per message. Guarantees order and delivery. Examples: Azure Queue Storage, RabbitMQ Queues, SQS.

Append-only log of events. Consumers read from any offset. Replay-able history. Examples: Kafka, Pulsar, Azure Event Hubs.

Messages that fail processing multiple times are moved to a DLQ for investigation. Prevents poison pill messages from blocking queue.

Multiple instances consume from same queue in parallel. Each message processed once. Scale processing by adding consumers.

Sender publishes request on a queue, receiver processes and replies on reply queue. Synchronous semantics over async transport.

Large message payload moved to blob storage; message contains reference/claim check. Reduces message size and bus load.

Services communicate directly via events. Each service knows what events trigger its actions. Distributed decision-making. Can get tangled.

Central orchestrator/saga manager directs the flow. Services do not know about each other. Clearer flow but central point of failure.

Concurrency

Non-blocking operations that free up threads while waiting. Efficient use of thread pool. Syntactically simple with async/await keywords. Standard pattern.

public async Task GetOrderAsync(int id) {
  var order = await _db.Orders.FindAsync(id);
  var items = await _db.OrderItems
    .Where(i => i.OrderId == id)
    .ToListAsync();
  return order;
}

Mutual exclusion for accessing shared resources. Mutex (binary), Lock (reentrant), Semaphore (count). Risk of deadlock. Use sparingly in async code.

Thread-safe communication between concurrent tasks/goroutines. Producer-consumer pattern. Typed, built-in cancellation. Rust: mpsc channels, C#: System.Threading.Channels.

Automatically manage thread creation and reuse. Task Parallel Library (C#) coordinates work. Avoids manual thread creation and context switching overhead.

Coalesce multiple identical concurrent requests into a single operation. Return same result to all requesters. Avoid thundering herd.

Compile-time concurrency safety. Ownership rules prevent data races. Move vs borrow semantics. No need for locks on immutable shared data.

Testing

Test individual functions/methods in isolation with mocks. Fast, fine-grained feedback. Cover happy paths and edge cases.

Test components working together (database, external services). Use test doubles or in-memory databases. Slower but more realistic.

Verify API contracts between services without full E2E testing. Consumer-driven contracts. Catch integration issues early.

Generate random inputs and verify invariants hold. Examples: QuickCheck, Hypothesis. Find edge cases you didn't think of.

Capture output (JSON, HTML) and verify against stored snapshots. Good for UI, configuration, complex data structures.

Verify code structure adheres to design rules. ArchUnit (Java), NArchitecture (C#). Enforce layering, dependencies, naming conventions.

Simulate realistic load. Measure throughput, latency, resource usage. Find bottlenecks. Examples: K6, JMeter, Apache Bench.

Inject small code changes and verify tests catch them. Low mutation score indicates insufficient test coverage.

Error Handling

Return Result<T, E> or Either<L, R> instead of throwing exceptions. Explicit error handling. Composable with map/flatMap. Rust Result, Scala Either.

pub fn process_order(order: Order) -> Result {
  let payment = process_payment(&order)?;
  let confirmation = create_confirmation(&order, &payment)?;
  Ok(confirmation)
}

Create domain-specific exception classes inheriting from base. Catch specific exceptions. Avoid catching generic Exception.

public class OrderException : Exception { }
public class InsufficientFundsException : OrderException { }
public class ItemOutOfStockException : OrderException { }

Exponential or fixed backoff for transient failures. Jitter to avoid thundering herd. Max retries to avoid infinite loops. Use Polly (C#), tenacity (Python).

var policy = Policy
  .Handle()
  .WaitAndRetry(new[] {
    TimeSpan.FromSeconds(1),
    TimeSpan.FromSeconds(2),
    TimeSpan.FromSeconds(4)
  });
await policy.ExecuteAsync(() => client.GetAsync(url));

Prevent cascading failures by stopping requests to failing service. Open → Half-Open → Closed states. Polly, Hystrix, or cloud SDK.

Security

Delegate authentication to identity provider. OAuth 2.0 for authorization, OIDC adds identity. Authorization Code flow for web, PKCE for SPAs.

Stateless authentication with JWTs. Short-lived access tokens + long-lived refresh tokens. No session storage needed. Verify signature server-side.

Role-Based (RBAC) or Attribute-Based (ABAC) access control. RBAC: users have roles with permissions. ABAC: fine-grained rules on user/resource attributes.

Simple token-based auth for service-to-service or public APIs. Stateless, easy to revoke. Send in header or query. Less secure than OAuth.

Validate all input at API boundaries. Type, length, format, range. Use libraries like FluentValidation (C#), Pydantic (Python). Prevent injection attacks.

Use parameterized statements to prevent SQL injection. Never concatenate user input into SQL. All major ORMs and drivers support this.

Store secrets (API keys, passwords, connection strings) in secure vaults, not code. Azure Key Vault, AWS Secrets Manager, HashiCorp Vault.

Control which origins can access API. Specify allowed origins, methods, headers. Prevents unauthorized cross-site requests.

Limit requests per IP/user/key to prevent abuse and DoS. Use token bucket or sliding window algorithm. Return 429 Too Many Requests.

Never trust, always verify. Authenticate and authorize every request/connection. Encrypt in transit and at rest. Assume breach mentality.

API operations should be safe to retry. Use idempotency keys to prevent duplicate processing. Critical for payment systems.

Log all security events: authentication, authorization, data access, changes. Immutable logs for compliance and investigation.

Observability

Log as JSON with consistent fields (timestamp, level, trace-id, user-id, message). Query and aggregate logs by field. Tools: ELK, Loki, CloudWatch.

{
  "timestamp": "2024-01-15T10:30:00Z",
  "level": "INFO",
  "trace_id": "abc123",
  "user_id": 456,
  "message": "Order created",
  "order_id": 789
}

Quantitative measurements: request rate, latency, error rate, queue depth. Emit via Prometheus, Datadog, or cloud provider. Alert on thresholds.

Track request flow across services using trace and span IDs. Visualize latency bottlenecks. Tools: Jaeger, Zipkin, Datadog APM.

Expose /health endpoint returning service health status. Check dependencies (database, cache). Used for load balancing and orchestration.

Set up alerts on metrics, logs, and traces. Alert on anomalies and thresholds. Route to on-call via PagerDuty, OpsGenie, etc.

Performance

In-memory (Redis, Memcached), application-level, HTTP caching. Cache-aside pattern. Set appropriate TTLs. Handle invalidation carefully.

Return large result sets in pages. Cursor-based pagination scales better than offset. Include total count carefully (can be expensive).

Group operations to reduce round trips. Bulk insert/update queries. Batch message publishing. Trade latency for throughput.

Add indexes on frequently queried columns. Watch N+1 queries. Analyze query plans. Composite indexes for multi-column filters.

Use async I/O for network calls, file access, database queries. Free up threads. Apply backpressure to avoid overload.

Reuse database/HTTP connections via pools. Reduce connection overhead. Configure pool size based on workload.

Deployment

Run two identical production environments. Switch traffic from blue to green. Zero downtime. Instant rollback by switching back.

Gradually shift traffic to new version. Start with 5%, monitor, increase to 50%, then 100%. Catch issues with partial rollout.

Toggle features on/off at runtime without redeploy. A/B test, gradual rollout, kill switches. LaunchDarkly, Unleash, or custom.

Gradually replace old instances with new version. Requires load balancer and health checks. Brief period with mixed versions.

Build versioned machine images (AMI, Docker image). Deploy by replacing entire instances, never modify in-place. Reproducible and reliable.

Git repo as source of truth for infrastructure and applications. Declarative config, automated sync. Tools: ArgoCD, Flux.

Automated checks before deployment: tests pass, security scan clears, performance benchmarks acceptable. Prevent bad deployments.

Plan schema changes to work with both old and new code. Deploy code before schema or vice versa. Use feature flags to control behavior.

.NET/C# Specific

Built-in DI container in .NET. Register services with IServiceCollection. Constructor injection. Transient, scoped, singleton lifetimes.

services.AddScoped();
services.AddSingleton();
services.AddTransient();

Request flows through middleware components. Each adds behavior (logging, auth, error handling). Order matters. Use app.Use() to add custom middleware.

app.UseAuthentication();
app.UseAuthorization();
app.UseCustomErrorHandling();
app.MapControllers();

Fluent API for defining validation rules. Separate validators from models. Composable, reusable, testable. Integrates with Minimal APIs.

public class CreateOrderValidator : AbstractValidator {
  public CreateOrderValidator() {
    RuleFor(x => x.CustomerId).NotEmpty();
    RuleFor(x => x.Items).NotEmpty().WithMessage("Must have items");
  }
}

Convention-based object mapping. DTO ↔ Domain models. Reduce boilerplate. Mapster is faster than AutoMapper.

IHostedService for long-running tasks. Worker services run continuously. Scoped dependency injection for each iteration.

Organize by feature, not layer. Each feature has command, handler, validator, projections. Reduces cross-feature coupling.

Python Specific

Modern, fast web framework for building APIs. Automatic OpenAPI/Swagger docs. Built on Starlette and Pydantic. Type hints drive validation and docs.

from fastapi import FastAPI
from pydantic import BaseModel

app = FastAPI()

class Order(BaseModel):
    id: int
    total: float

@app.get("/orders/{order_id}")
async def get_order(order_id: int) -> Order:
    return Order(id=order_id, total=99.99)

Data validation and parsing using Python type hints. Automatic schema generation. Serialization/deserialization. Settings management.

from pydantic import BaseModel, Field, validator

class Order(BaseModel):
    id: int = Field(..., gt=0)
    total: float = Field(..., gt=0)
    
    @validator("total")
    def validate_total(cls, v):
        if v > 1000000:
            raise ValueError("Total too large")
        return v

SQL toolkit and Object-Relational Mapper. Modern API with type hints. SQLAlchemy 2.0+ emphasizes async and explicit SQL.

Use dataclasses/Pydantic for DI. Dependency() in FastAPI for request scope. Or use libraries like python-dependency-injector.

asyncio for concurrency. async/await syntax. Asyncio.gather() for concurrent tasks. Event loops and tasks. Understanding asyncio is critical.

dataclasses for lightweight data structures. Protocols (structural typing) for flexible interfaces. TypedDict for dict typing.

Rust Specific

Async runtime for Rust. Tokio::spawn for tasks, channels for communication, select! for multiplexing. Production-grade for building servers.

use tokio::task;

#[tokio::main]
async fn main() {
    let task1 = task::spawn(async { 1 + 1 });
    let result = task1.await.unwrap();
    println!("Result: {}", result);
}

Modern, ergonomic web framework built on Tokio. Type-safe extractors. Clean routing DSL. Router composition. Built-in middleware.

use axum::{routing::get, Router};

#[tokio::main]
async fn main() {
    let app = Router::new()
        .route("/orders/:id", get(get_order));
    
    axum::Server::bind(&"0.0.0.0:3000".parse()?)
        .serve(app.into_make_service())
        .await?
}

sqlx: compile-time checked SQL queries. SeaORM: async-first ORM. Both leverage Rust type system and async/await.

Result<T, E> type. Custom error enums. thiserror/anyhow crates for ergonomic error handling. Compile-time enforcement of error handling.

pub fn process_order(order: Order) -> Result<(), OrderError> {
    validate_order(&order)?;
    let payment = charge_payment(&order)?;
    Ok(())
}

Use traits for abstractions. Trait objects for dynamic dispatch. Blanket implementations for generics. Natural for DI and mocking.

Serialize/deserialize Rust data structures to/from JSON, TOML, YAML, etc. Derive macros make it easy. Type-safe and performant.