Thursday, December 21, 2023

ECS

 https://academy.pega.com/topic/enterprise-class-structure/v1

https://krishnapega.blogspot.com/2016/05/enterprise-class-structure.html

https://www.pegahelp.com/2020/05/pega-enterprise-class-structure-ecs.html

https://rulesware.com/pega-evolution-of-the-enterprise-class-structure-a-perspective-of-the-last-decade/



Thursday, December 14, 2023

Pega general code review checklist

  1.  Declaratives over procedural.
  2. Reusability and Components.
  3. Extension points
  4. Avoid loops
  5. Server side validation vs Client side validation

1) Reusability - While creating/refactoring rules, always evaluate the reusability aspect. Create/move the rules to WorkPool/Work- class for better reusability.

2) Prefer Declarative over procedural processing.

3) Avoid creating section rules with 1-2 fields.

4) Avoid creating the top level scalar properties on the Casetype class (or WorkPool class). Designing better data model always fetch the future maintenance of the application. 

5) For properties that hold 'Amount' (or other decimal values) create property with type Decimal (with the desired precision as qualifier)

6) Leverage Background requestor for better user experience - Delegate the processing to background requestor such as queue processor/Agent.

7) Do not use the OOTB top-level properties for handling the processing logic. (For example, pyErrorMessage property was being used in svcPerformFlowAction OOTB activity).

8) Keep in mind the DB column size of the below properties (Especially pyLabel, PyDescription..etc)

Performance checklist

  1.  Declare index vs. exposing columns
  2. Keyed data page
  3. Virtual list copy
  4. Parallel connectors/Load data page async
  5. Simple condition as first condition in AND or OR
  6. Appropriate scope for Data pages.
  7. Reload per interaction
  8. Refresh strategy for node level datapage
  9. Report definition over obj methods

1) DB Indexes :  Analyze the query plan. Create DB Indexes on the columns that used on the filter conditions of the RD.
2) Avoid reading from Blob : Lookups read the entire blob column, so avoid reading the BLOB. Prefer to use RD's.
3) Background processing : Leverage background processing, wherever the need of processing and the data need not be shown to the user immediately. ( Agents, QueueProcessor, Async activity, load-datapage, Queue method)
4) Keyed data page : Read the data 
5) Node level : Cache the frequently accessed data in-memory.
6) Deferred loading : Configure the deferred loading on the parts of the screen (sections) that they are not interested to see imemediately.

Pega Security check list

  1. Guardrails
  2. Security alerts log
  3. Service package should be authenticated (at least basic auth + TLS)
  4. Appropriate roles + RAROS + AccessWhens + Privileges 
    • Secure Activities, flow actions, visibility through privileges
  5. Always perform server side validation
    • Data validations 
    • Attachments at certain assignment
    • Etc.
  6. Encryption
  7. Lock application and rulesets
  8. Do not deploy checkout rules
  9. Do not include operator records in Production, Block unused operators in PROD. Disable PRServlet servlet in PROD
  10. CSRF
  11. CORS
  12. CSP
  13. Appropriate logging levels
  14. Password hashing: bcrypt algorithm
  15. Authentication timeout
  16. Field level auditing
  17. Security events
  18. Client based access control : what application data is subject to data privacy regulations like GDPR and how access to that data will be handled.
  19. Secure file uploads:
  20. XML/AllowDocTypes dynamic system setting is set to false.