Tech debt

PdfAPI's most significant technical debt is the absence of any authorization construct combined with write-capable, unauthenticated-by-default endpoints and framework exception detail produced before the response envelope, whose final client-visible shape is unknown**. Secondary findings cover hard-coded environment-varying values, a legacy pre-release package dependency, dead configuration/code, and an unguarded configuration parse.

CRITICAL

Finding	Component	Impact	Recommended action
No authorization construct exists anywhere in application code ([Authorize], [SaifAuthorize], IsInRole, or any equivalent — zero matches across the solution closure)	All six controllers (13 endpoints)	Any caller that can reach the host can invoke every endpoint, including document conversion, merge, and extraction operations that write tracking records and consume compute resources; combined with IIS anonymous authentication (IISAnonymousAuth: true in Pipelines\build-vars.yml), the service is reachable without any authenticated identity	Introduce an authorization mechanism (e.g. [SaifAuthorize] or equivalent) on all controllers, or document and formally accept the network-perimeter-only trust model
config.IncludeErrorDetailPolicy = IncludeErrorDetailPolicy.Always; produces full framework exception detail (message, type, stack trace) before ApiResponseHandler runs, in every environment, not only locally; the final client-visible envelope is unknown** (see Endpoints: Error response shape)	PdfAPI\App_Start\WebApiConfig.cs	Internal implementation details, file paths, and potentially sensitive data are exposed to any caller who triggers an unhandled exception (e.g. any of the eight endpoints with no try/catch (InfoController's seven actions, ApiInfoController's one action))	Set IncludeErrorDetailPolicy to LocalOnly or a configuration-driven value scoped to non-production environments

HIGH

Finding	Component	Impact	Recommended action
Syncfusion license key is a hard-coded string literal, not retrieved via GetSecureConfigSetting	PdfApi.SyncFusionCore\LicenseHelper.cs	Vendor license key is committed to source control and visible to anyone with repository access	Move the license key to secure configuration and retrieve it via IEnvironmentService.GetSecureConfigSetting
SMTP host "mail.saif.com" is hard-coded	PdfAPI\Services\PdfService.cs:140	An environment-varying infrastructure endpoint cannot be changed without a code change and redeploy	Move the SMTP host to Environment API configuration alongside the sender/recipient addresses
Oracle schema "IMG" is a hard-coded literal at the composition-root call site	PdfAPI\App_Start\IocConfig.cs:19	Changing the target schema requires a code change and redeploy rather than a configuration change	Move the schema argument to Environment API configuration
ApplicationHost = entdev01 (a development host name) is committed to the deployable Web.config, with no active Web.Debug.config/Web.Release.config XDT transform overriding it	PdfAPI\Web.config:12	A misconfigured or bypassed deployment pipeline could leave a production deployment pointed at the development environment tier	Add live XDT transforms per environment, or otherwise verify the deployment pipeline reliably overrides this value in every target environment
compilation/@debug = true is committed to Web.config with no active transform to disable it in release deployments	PdfAPI\Web.config:24	Debug-mode compilation can degrade performance and expose additional diagnostic information in production	Add a release transform that sets debug="false", or verify the deployment pipeline overrides it
Legacy SAIF.Web.Mvc 1.0.16263.1-alpha (a 2016 pre-release package) is referenced in packages.config alongside a SAIF.Framework.Web.Mvc assembly reference and the current SAIF.Framework.* 2.0.22xxx package family	PdfAPI\packages.config, PdfAPI\PdfAPI.csproj	The MVC extension surface (including RegisterCommonDependencies) is sourced from an unsupported pre-release package while the rest of the stack is current, creating version-compatibility risk	Replace the SAIF.Web.Mvc alpha package reference with the current SAIF.Framework.Web.Mvc package
pdfApi.ErrorsToRetry is parsed unguarded: errorsToRetryConfig.Split(',').Select(x => long.Parse(x))	PdfAPI\Services\ActivePdf\ActivePdfService.cs:20	A null, empty, or non-numeric configuration value throws during ActivePdfService construction, failing every request routed to the ActivePDF processor	Add validation/guarding around the parse, with a clear configuration error rather than an unhandled FormatException
PdfSettings (PdfAPI.Core\Services\PdfSettings.cs) is declared but never constructed anywhere in PdfAPI\; the service layer duplicates its key literals by reading IEnvironmentService directly	PdfAPI.Core\Services\PdfSettings.cs	Dead code maintained in parallel with the equivalent inline reads; the declared-only keys pdfdatadirectory and pdfapi.url are red herrings for anyone auditing configuration	Remove PdfSettings if genuinely unused, or consolidate configuration reads through it if it is intended for future use
A dead IEnvironmentService constructor parameter is accepted by five controllers	PdfAPI\Controllers\v1\*.cs (five of six controllers)	Unused constructor dependencies increase composition-root coupling and obscure which controllers actually need IEnvironmentService	Remove the unused parameter from controllers that do not read IEnvironmentService directly
Stray Console.WriteLine(result.ToString()) at the end of SyncfusionPdfService.FinalizeResult	PdfAPI\Services\Syncfusion\SyncfusionPdfService.cs	Console output from an IIS-hosted service has no defined destination and provides no operational value; may also incur a minor performance cost under load	Remove the statement or replace it with a structured ILogService.TraceDebug call
Swagger UI is enabled with entirely default options (EnableSwaggerUi(c => { /* all comments */ })), with no BasicAuth/ApiKey/OAuth2 protection configured	PdfAPI\App_Start\SwaggerConfig.cs	The API's full documented surface (including the v1/info/* byte-array endpoints) is discoverable by anyone who can reach the host, compounding the no-authorization finding above	Decide whether Swagger UI should be exposed in production, and if so, add access controls consistent with the rest of the service

Related documentation

• API index
• Overview
• Architecture
• Endpoints
• Authentication and authorization
• Dependencies
• Configuration
• Operations and processes
• Business rules
• Data model
• Operational runbook

Note: Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• PdfAPI\App_Start\WebApiConfig.cs
• PdfAPI\App_Start\IocConfig.cs
• PdfAPI\App_Start\SwaggerConfig.cs
• PdfAPI\Web.config
• PdfAPI\packages.config
• PdfAPI\PdfAPI.csproj
• PdfAPI\Services\PdfService.cs
• PdfAPI\Services\ActivePdf\ActivePdfService.cs
• PdfAPI\Services\Syncfusion\SyncfusionPdfService.cs
• PdfAPI.Core\Services\PdfSettings.cs
• PdfApi.SyncFusionCore\LicenseHelper.cs
• Pipelines\build-vars.yml