Hosting and the REST API

ReportWright.AspNetCore turns an ASP.NET Core application into a report host. One call registers the services, one call maps the endpoints; the Blazor components, a JavaScript client or a scheduler all speak to the same API.

Registration

using ReportWright.AspNetCore;
using ReportWright.Data;
using ReportWright.Data.Csv;
using ReportWright.Data.SqlServer;

builder.Services.AddSingleton<ReportStore>(new FileSystemReportStore(reportsDirectory));
builder.Services.AddSingleton<DataSourceResolver>(new MyResolver());      // names -> provider kinds and secrets
builder.Services.AddSingleton<ReportPermissions>(new MyPermissions());    // optional; AllowAllReportPermissions by default
builder.Services.AddReportWright(options =>
{
    options.Providers.Add(new CsvDataSourceProvider());
    options.Providers.Add(new SqlServerDataSourceProvider());
    options.SessionLifetime = TimeSpan.FromMinutes(20);
    options.MaxSessions = 500;
    options.MaxPreviewRows = 100;
});

var app = builder.Build();
app.MapReportWright("/reporting");

In a Blazor Server application, call AddReportWrightComponents from ReportWright.Blazor.Server instead of AddReportWright: it registers the same services plus viewer and designer backends that run in process and ask the same permissions about the circuit's user (Embed the viewer).

ReportWrightOptions also takes Fonts (a FontEngine; by default the engine's bundled metric-compatible faces and nothing from the machine, which a browser reproduces exactly), Clock (for Globals!ExecutionTime, fixed in tests), DefaultCulture, Limits (the engine's resource limits), Router (your own DataSourceRouter), FallbackDataProvider (data for a data source the resolver does not know, or none) and Exports (the format registry).

Stores and permissions

ReportStore lists, reads and writes definitions by path: FileSystemReportStore over a folder (paths are file names inside it; traversal is refused), InMemoryReportStore for tests, ReadOnlyReportStore around either for a public demo or a published catalogue (it serves reports and refuses every save), or your own over a database. A store that refuses a write by throwing UnauthorizedAccessException gets a 403 with its message, not a 500. ReportPermissions is asked per request whether the caller may read, edit or export a report; AllowAllReportPermissions is the default and a host should replace it. Edit-only endpoints answer 403 when it says no.

The endpoints

All under the prefix given to MapReportWright. Bodies and answers are JSON unless noted; a RunRequest body carries parameters (name to value or list of values).

Method and path	What it does
GET /reports	The store's report paths.
GET /exports	The export formats the host registered.
GET /reports/definition/{path}	The RDL bytes (read permission).
PUT /reports/definition/{path}	Saves RDL bytes (edit permission).
POST /reports/parameters/{path}	The parameter prompts for the values given so far: states, valid values, dependencies.
POST /reports/run/{path}	Runs the report; answers a session with page count, document map, toggles, sortable items.
GET /sessions/{id} · DELETE /sessions/{id}	A session's summary; end it.
GET /sessions/{id}/pages/{page}	One page as an HTML fragment plus its region map.
GET /sessions/{id}/stylesheet · /fonts.css · /fonts/{file}	The projection's stylesheet and the fonts it names.
GET /sessions/{id}/regions	Every page's region map (hit testing, actions).
POST /sessions/{id}/toggle	Flips a toggle; answers the pages that changed.
POST /sessions/{id}/sort	Cycles a textbox's interactive sort and re-processes.
GET /sessions/{id}/search?q=	Matches by page.
GET /sessions/{id}/export/{format}?page=	Exports the session (export permission).
POST /reports/export/{format}/{path}	Runs and exports in one request, for schedulers.
POST /reports/datasets/{dataSet}/{path}	Dataset rows for a browser-side engine (WebAssembly viewer).
POST /reports/schema/{dataSet}/{path} · POST /design/schema/{dataSet}	Field discovery for a stored or an unsaved definition (the designer's data pane).
POST /reports/preview/{dataSet}/{path}?maxRows=	A capped sample of rows.
POST /reports/test/{dataSource}/{path}	Tests a data source connection through the resolver.

A malformed request answers 400 or 404 with a message and never a stack trace; the host's test suite sends path traversals, broken JSON, oversized bodies and garbage RDL at every endpoint.

Sessions

A run creates a session holding the page model; toggles and sorts update it in place; SessionLifetime and MaxSessions bound the memory. The Blazor viewer in WebAssembly mode keeps its own session in the browser and uses the host only for definitions and rows.