/categories/development/ Recent content in Development on scarbrough.co.uk Hugo en-us Tue, 21 Jul 2026 00:00:00 +0000 /post/reworking-azure-function-apps/ Tue, 21 Jul 2026 00:00:00 +0000 /post/reworking-azure-function-apps/ It seemed like a strange request, when a colleague asked me to look into upgrading our Function Apps to use .NET 10, ‘isolated worker’. Since when was it possible to change their runtime version ourselves? And what on God’s Green Earth was an ‘isolated worker’? It was time to investigate. There are a couple of important things to remember about Function Apps, as a starting point. Firstly, my colleagues and I had developed Function Apps exclusively as custom Logic App components, to handle more cumbersome data transforms. /post/going-back-to-vim/ Sun, 10 May 2026 00:00:00 +0000 /post/going-back-to-vim/ Microsoft earned itself the rather descriptive name ‘Microslop’ in recent months, on account of having infested virtually all its products with ‘AI’/Co-Pilot stuff that nobody asked for and few want. It’s especially insidious and invasive enough in Windows 11 that one shouldn’t expect any privacy when using it. Visual Studio Code was a decent editor that I’d been using since Atom got deprecated. Now it’s primarily an ‘open source AI code editor’, its official Web site declares. /post/going-full-indyweb/ Wed, 17 Dec 2025 00:00:00 +0000 /post/going-full-indyweb/ Although Substack was never designed to be just a newsletter service for something else, it can be pretty useful for that. I’ve been increasingly less inclined to use it since it became more of a ‘social’ media platform, with certain authors being promoted by The Algorithm. What really did it for me, though, was an email sent to authors the other week, which stated: ‘Substack is introducing age verification steps for those in the UK. /post/development/generative-technical-debt/ Thu, 20 Nov 2025 00:00:00 +0000 /post/development/generative-technical-debt/ I’m somewhat in agreement with the first half of Jamie Lord’s post on Nearly Right (Engineering leaders demand systems design skills as AI coding assistants produce mounting technical debt), and Jason Gorman made a good point about unreadable code being a form of technical debt (he coined the term ‘codemanship’, which I’m going to borrow). In my opinion, ‘AI’ generated code absolutely should not find its way into the codebase of critical software, unchecked, regardless of what some bastardised implementation of Agile might demand. /post/development/sql-server-file-recovery/ Sat, 08 Nov 2025 00:00:00 +0000 /post/development/sql-server-file-recovery/ Someone wanted files retrieved from a legacy database export. In this case, they were Word documents and PDFs stored as hex strings in an IMAGE column. The hex strings, of course, are representations of the bytes that make up the files. Now, there is a way of recovering files from this, using a native stored procedure, but I didn’t have admin-level access to this particular database. I also couldn’t use the online conversion sites, as the data was too sensitive. /post/development/low-code-the-way-forward/ Wed, 08 Oct 2025 00:00:00 +0000 /post/development/low-code-the-way-forward/ I’ve worked with several ’low code’ platforms in recent years. Some are better than others, but I’m always asking one question: What problems are they supposed to solve? The biggest of them is ’technical debt’. Dependencies become outdated and unmaintained, updates sometimes have breaking changes that require code to be reworked, additional code gets tacked on over the years by various people, amateur code makes that harder, etc. Technical debt might be an inevitability for an organisation that’s been developing software in-house for long enough. /post/development/project-loading-anypoint-studio/ Wed, 16 Jul 2025 00:00:00 +0000 /post/development/project-loading-anypoint-studio/ Typically I find that some troubleshooting and configuration is required to get an imported project to a state where it builds and the unit tests run, and the reasons usually aren’t obvious. Importing a project Most Mulesoft developers would have made the mistake, at least once, of trying to import a project using one of the options under the ‘General’ section, as that’s the first displayed in the import options window. /post/development/mulesoft-api-paging/ Fri, 28 Feb 2025 00:00:00 +0000 /post/development/mulesoft-api-paging/ Recently I’d been developing a Mulesoft application that uses another as a source API. The response from the source API looks something like this: { "nextLink": "https://server:port/external-api/endpoint?page=1", "nextOffset": 1000, "morePages": true, "totalRows": 12345, "totalPages": 13, "results": [ {...} ] } There are a few things that could potentially be used for paging the response data. As a .NET engineer, I would have approached it by using a While or Until loop on ‘morePages: true’, used the nextLink URI and appended the response payload to a typed list. /post/first-post-of-2025/ Wed, 26 Feb 2025 00:00:00 +0000 /post/first-post-of-2025/ After a very busy and difficult couple of months, the system I’d been working on is about to go live to ~27,000 users, and I’m feeling slightly pleased with myself. What should have been a simple integration morphed into a complex Mulesoft project. What a learning curve that was! The following is my experience with Mulesoft so far. I think the one advantage Mulesoft has over other platforms - and maybe its selling point - is that the Anypoint portal provides us with a single place from which numerous integrations, API specifications and deployment environments can be managed. /post/security/mulesoft-oauth/ Tue, 05 Nov 2024 00:00:00 +0000 /post/security/mulesoft-oauth/ Getting software to work with OAuth is usually one of the easiest things a developer could be tasked with, if s/hehas done it a few times: Create an HTTP client method that sends four values to an OAuth provider, then pass the response to the next HTTP client method as a variable to be used in the Authorization header. Doing that in Anypoint Studio, for a Mulesoft application, was an uphill struggle of resolving one error message after another. /post/development/getting-used-to-anypoint-studio/ Tue, 15 Oct 2024 00:00:00 +0000 /post/development/getting-used-to-anypoint-studio/ Anypoint Studio, as a development tool, comes with a steep learning curve - it’s essentially a rebranded version of Eclipse, with a lot of custom Java packages (there are a lot for the Mulesoft server) and a package manager pointing at the Exchange repo. Putting together a Mulesoft application, using the ’low code’ designer and DataWeave is easy enough, though I haven’t done any advanced data transformations yet. Currently it relays data from another Mulesoft API to an external service in a different format. /post/development/azure-logic-app-thread-safety/ Wed, 18 Sep 2024 00:00:00 +0000 /post/development/azure-logic-app-thread-safety/ After resolving the previous issue with the Content-Type defect in the Azure Logic App’s storage connector, I ran into a second problem: The Web pages being generated were populated with the correct content type, but the incorrect content. I quickly discovered that was partly caused by a race condition and with how memory is managed by Azure. By default, a Logic App will run up to twenty instances of a ‘For Each’ loop in parallel, but this is multi-threading instead of true parallel processing. /post/development/azure-content-type-bug/ Tue, 17 Sep 2024 00:00:00 +0000 /post/development/azure-content-type-bug/ One of our Logic Apps, which we developed as a static site generator, began writing the Web pages to the storage account as octet stream files, and I narrowed down the problem to a defect in the storage account connector. I believe (but I’m not 100% certain yet) Microsoft’s developers hadn’t implemented the ‘"headers": {"Content-Type": "text/html"}’ code for the storage account connectors, and the file type, therefore, always defaults to octet stream. /post/development/agile-and-innovation/ Sat, 17 Aug 2024 00:00:00 +0000 /post/development/agile-and-innovation/ One of the central claims made by Moxie Marlinspike, during his discussion at the Black Hat conference appears nonsensical, because he referred to two entirely different meanings of ‘abstraction’, and was thus comparing two entirely different things: ‘We spent the past 20 years onboarding people into software by putting them into black box abstraction layers, and then putting them into organizations composed of black box abstraction layers, […] Marlinspike posited that security researchers, who routinely probe beneath surface-level abstractions, are better positioned to drive innovation in software development. /post/security/curl-oauth2/ Tue, 30 Apr 2024 00:00:00 +0000 /post/security/curl-oauth2/ Recently I was asked to look into changing the authentication method to OAuth 2.0 for an integration service. It’s something I’d done enough times in Azure to know what’s involved: The service would need an app registration, which should provide a client ID and secret, an OAuth token request stage, and modifications to include the token in the Authorization header field of whatever was originally being sent. After a little digging, it turned out the integration was a simple batch script, running on a Windows server, and it used curl to send data to a third-party service. /post/development/mulesoft-course-part-1/ Tue, 02 Apr 2024 00:00:00 +0000 /post/development/mulesoft-course-part-1/ It took a while to get everything set up for the Mulesoft Development course, with the following being required: Anypoint Studio Anypoint Platform account (separate to the training account) Salesforce account Advanced REST Client (Probably wasn’t needed, because I already had Postman installed) There are a few things to be aware of: A considerable amount of disk space is required for Anypoint Studio and the training files. I reckon it’s somewhere around 4GB. /post/senior-position/ Sat, 16 Mar 2024 00:00:00 +0000 /post/senior-position/ Something unexpected happened this week: I was offered my first senior engineer position. I’ll be focussed mainly on the project management and planning side of things, and I’m being encouraged to delegate the software development work. I’m still prepared to get my hands dirty with the coding and systems administration, if anyone gets stuck on a tricky problem, and I’ll likely be working on a couple of .NET applications as personal projects. /post/development/interfaces/ Sat, 02 Mar 2024 00:00:00 +0000 /post/development/interfaces/ One of the harder software engineering concepts to understand is that of interfaces. I once struggled to understand what interfaces are, how they work, and why a software engineer might use them. Most the explanations I could find on the Web didn’t make a lot of sense - some were more complicated than they needed to be, and others attempted to explain it in terms of other things I hadn’t grasped (i. /post/security/authenticating-requests-to-logic-app/ Thu, 22 Feb 2024 00:00:00 +0000 /post/security/authenticating-requests-to-logic-app/ One of my Logic Apps originally had just three steps: HTTP trigger Deserialise HTTP request JSON payload Send objects from the request payload to a Service Bus queue Another Logic App would read the objects from the Service Bus queue, use them to query another source for data, then send a email to whatever address was in the initial request. I used this approach because there could be more requests than a Logic App can handle concurrently, and it made sense, therefore, to queue the requests. /post/security/resource-group-security/ Wed, 31 Jan 2024 00:00:00 +0000 /post/security/resource-group-security/ The security configuration of Azure services is a fairly broad subject area, and this is more of an introduction to how it works for a Resource Group, in the context of a Logic App that needs to interact with multiple resources. If a DevOps team, instead of the developers, is managing the security, a considerable amount of time will be spent planning and designing services beforehand, and later trying to figure out which security configurations are preventing the services working. /post/development/low-code-development/ Sat, 20 Jan 2024 00:00:00 +0000 /post/development/low-code-development/ One of the most important lessons I’d learned from working with Azure, over the last year or so, is that careful thought should be given to whether it’s better to implement a service as a ’low code’ solution, or as conventionally-developed software. The former isn’t always the fastest, cheapest or more efficient way to get something deployed. I’m currently of the opinion that Azure’s Logic App system is quite good for integrations and basic scheduled tasks - and it has indeed made those kind of things easier to manage - and there aren’t any convoluted deployment pipelines to bother with. /post/security/authenticating-api-requests-azure/ Sat, 09 Dec 2023 00:00:00 +0000 /post/security/authenticating-api-requests-azure/ One way to help understand how Active Directory, App Registrations, managed identities and Key Vaults work in Microsoft Azure is to look at a typical Logic App that authenticates itself with an API that provides data only to services registered with the organisation’s Active Directory. The basic sequence for the authentication part of the Logic App here is this: Get a password from an Azure Key Vault. Get an OAuth token for the Logic App from Active Directory. /post/development/selectpdf-azure/ Mon, 20 Nov 2023 00:00:00 +0000 /post/development/selectpdf-azure/ Initially I thought it would be trivial to use SelectPdf to convert an HTML page into a PDF document as a service on Microsoft Azure, since I was easily able to do this as a .NET console app. Everything was going well to begin with. I’d set up everything in the Resource Group: The Logic Apps that write to and read from the Service Bus, the Storage Account for the template files and generated documents, the Function App that’s supposed to handle the document generation itself… The first problem I ran into was the following console message: /post/security/azure-key-vault-security/ Sun, 17 Sep 2023 00:00:00 +0000 /post/security/azure-key-vault-security/ Azure Key Vault is designed to store (and protect) secrets such as API keys, passwords, cryptographic keys, connection strings, etc. It can store the following categories of data: Keys Certificates Secrets The Secrets storage can store arbitrary plaintext values, so Key Vault could potentially be used as a means of centrally managing a collection of usernames and passwords that could be copied and pasted straight from the Azure Portal. Is this a safe method of password management, though? /post/development/power-bi-report-builder/ Tue, 12 Sep 2023 00:00:00 +0000 /post/development/power-bi-report-builder/ My brief encounter with Power BI began after one of the project managers had the idea of using Power BI Report Builder as a means for generating archived versions of what’s displayed on a site I developed not long ago, because he wanted a PDF export feature for that. ‘Why not just copy a couple of the API methods and add a PDF converter to them?’, I wondered, with the feeling I’d end up needing to do that anyway. /post/development/openquery/ Fri, 05 May 2023 00:00:00 +0000 /post/development/openquery/ It is possible to query a MySQL database as a linked server from Microsoft SQL Management Studio (SSMS), indirectly, using OPENQUERY. Querying a Linked Server To select all records from a database table in the linked server: SELECT * FROM OPENQUERY(LINKED_MYSQL_DB, 'SELECT * FROM databasename.databasetable') Or to find a record with a field matching some condition: SELECT * FROM OPENQUERY(LINKED_MYSQL_DB, 'SELECT * FROM databaseame.users') WHERE name LIKE '%PersonName%'; There’s one problem with the above queries: They will read the entire table through the linked servers before the rows are filtered. /post/development/microsoft-graph/ Wed, 03 May 2023 00:00:00 +0000 /post/development/microsoft-graph/ Recently I was tasked with implementing role-based security for a .NET API, based on the Active Directory groups the user is a member of. Easy, I thought initially, as there’s a well-documented way of doing this by adding [Authorize] annotations to controller methods. The first problem I ran into was the API was designed to be used by a Node.js/React application. In this case (and this is a simplified description), users obviously don’t authenticate themselves directly with the API, but instead with the React application, via Active Directory Single Sign-On. /post/development/coding-principles/ Sat, 29 Apr 2023 00:00:00 +0000 /post/development/coding-principles/ Notes initially published on my Bear Blog site. A decade of software development and engineering taught me there are two design principles that I’d argue are more important than any particular pattern or design approach: Code should be readable and self-explanatory. Each function or method (I use these terms interchangeably) should have a single, well-defined purpose. Code should be readable Programming languages are designed to provide human-readable abstractions of software, and, as such, code should be intelligible and relatively easy to work with. /post/development/dependency-scanning/ Thu, 09 Mar 2023 00:00:00 +0000 /post/development/dependency-scanning/ Since dependency vulnerability scanning has been suggested by colleagues as something that could help with security/standards compliance and addressing legacy software, I’ve been looking into a few services to see how useful the available options could be. NPM Audit Dependency scanning is performed by default with the install command for later versions of NPM, and by default, the output of npm audit will show a few lines of relevant information about each package with a reported vulnerability - its rating, a brief description of the vulnerability and whether an update is available. /post/development/azure-function-app-migration/ Thu, 27 Oct 2022 00:00:00 +0000 /post/development/azure-function-app-migration/ After clicking ‘Create’, select ‘Develop in portal’, and HTTP Trigger or Service Bus Trigger, depending on the type of Function App being added. Most the required information – function name, connection, queue name, etc. – can be copied from the original function’s JSON file. In Code + Test, copy the code from the old function or the Visual Studio Solution. In the Integration section, the values for Trigger, Inputs and Outputs also need to be copied over. /post/development/dotnet-7-release/ Thu, 20 Oct 2022 00:00:00 +0000 /post/development/dotnet-7-release/ The official release for .NET 7.0 is in November 2022, though there have been a number of preview versions this year. In order to upgrade services to this, it might be necessary to update Visual Studio and MSBuild first. Target Framework To upgrade, set the target framework as follows: <TargetFramework>net7.0</TargetFramework> And maybe do the following update all package references to 7.0.0 for Microsoft.AspNetCore and Microsoft.Extensions. Other target frameworks include: net7.0 net7. /post/development/hugo-and-mainroad/ Sat, 01 Oct 2022 00:00:00 +0000 /post/development/hugo-and-mainroad/ I think I’ve found the ideal theme for my Hugo site. Mainroad is relatively simple in design, the layout is roughly what I was looking for, and it’s easier to customise. It still has tags and categories features that are essential for a site hosting technical documentation. I spent around six hours learning how the template works, re-arranging the content and tweaking the CSS to make it as clean as my MkDocs site. /post/development/netlify-cms-hugo/ Tue, 20 Sep 2022 00:00:00 +0000 /post/development/netlify-cms-hugo/ Netlify CMS and Continuous Deployment for Hugo Having experimented with this, I think Netlify’s idea of tacking a CMS onto a static site generator is tailored for situations where multiple developers, through Continuous Deployment, are providing a corporate site for which the content is being edited by non-technical users. At least it appears that way, because it takes a lot of work to develop the site and configure the CMS for anything more generic than the template provided, and an individual developer working on this as a personal project would most likely dispense with the CMS entirely and modify the files in the /content directory themselves (I’ll explain why). /post/development/ssg-vs-cms/ Sun, 18 Sep 2022 00:00:00 +0000 /post/development/ssg-vs-cms/ Can a static site generator (SSG) be more accessible than a content management system (CMS) to someone without Web development experience? And should we use an SSG instead of setting up something like WordPress? For those who don’t know, a static site generator is essentially a program that compiles a directory of text/Markdown files into a Web site that can be hosted on any Web server. Its core function is to convert Markdown to HTML. /post/development/sql-server-database-vs-project/ Thu, 15 Sep 2022 00:00:00 +0000 /post/development/sql-server-database-vs-project/ Migrations Using Visual Studio SQL Server Database Project Setting Up the Migration Project Add a new project to the Visual Studio solution. This project will initially be empty, without assembly references or scaffold files - it appears everything is native to Visual Studio. To this we need to add the connection to the database the schema is to be imported from. There will be a menu option for ‘Import’ -> ‘Database’. /post/development/docker-basics/ Fri, 02 Sep 2022 00:00:00 +0000 /post/development/docker-basics/ A Docker container runs as a sandboxed process on a local system or a server, and consists of at least one image. An image is built from the source code of an application or service, and can be distributed, through a repository, to provide others the means of testing an existing software product with minimal setup. Containers and images can be managed through the Docker Dashboard application. As such, a Docker container will require its own configurations and script that enable it to run as intended. /post/development/entity-framework-migrations/ Thu, 01 Sep 2022 00:00:00 +0000 /post/development/entity-framework-migrations/ The purpose of generating Entity Framework migrations is to apply database schema changes consistently across Staging, UAT and Production environments. The proposed method would involve developers generating migration a migration script whenever changes are made to the Entity Framework model in their projects. The DevOps team would apply that migration script to update the Azure environments. The services and applications being developed themselves should not have permissions to modify the environment. /post/development/kestrel-errors/ Mon, 15 Aug 2022 00:00:00 +0000 /post/development/kestrel-errors/ The following is another commonly-posted question in Stack Overflow, which I’ve been looking at while debugging the same problem: System.InvalidOperationException: Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found or is out of date. The most obvious cause would be Kestrel trying to use invalid or expired HTTPS certificates. However, looking more closely, my error message was preceded by: [...] [15:25:25 FTL] Unable to start Kestrel. /post/security/dotnet-core-azure-ad-authentication/ Wed, 01 Jun 2022 00:00:00 +0000 /post/security/dotnet-core-azure-ad-authentication/ If upgrading an existing application, the following are required from NuGet: Microsoft.Identity.Web Microsoft.Identity.Web.UI Generating the Project The project in this repository was generated from the ASP.NET Core Web App template. When generating the project, select ‘Microsoft identity platform’ as the Authentication type in the Additional Information section. HTTPS and Docker were also enabled for this project. After installing dotnet msidentity tool, Visual Studio will display the Service Dependencies and Service References. /post/development/dotnet-core-xunit/ Tue, 03 May 2022 00:00:00 +0000 /post/development/dotnet-core-xunit/ After some hours of frustration and asking myself whether I should have used Unit of Work in the first place (there are already layers of abstraction in the standard .NET Core template project) I managed to get a functioning xUnit test method that mocks the repositories, populates them with data and verifies the model returned by a controller method. Setting Up a Unit Test Project Add a xUnit project to the solution, then add an assembly reference in that to the project being tested. /post/development/ef-core-cli-reference/ Tue, 03 May 2022 00:00:00 +0000 /post/development/ef-core-cli-reference/ Installing Entity command line The .NET Entity Framework command line tools can be installed globally in PowerShell, or just for a specific project. dotnet tool install --global dotnet-ef After installation, it might be a good idea to update the tools: dotnet tool update --global dotnet-ef Add the Entity Framework Packages to a Project In order to use the Entity Framework command line tools for a .NET Core project, it’s necessary to install the Design package. /post/development/repository-pattern-and-uow/ Mon, 25 Apr 2022 00:00:00 +0000 /post/development/repository-pattern-and-uow/ A repository pattern exists to add another layer of abstraction between the application logic and the data layer, using dependency injection to decouple the two. It’s not my preferred way of doing things, because of the effort and complexity involved, and I’m certainly not the only person who initially struggled to understand the concepts behind it. Plus, it’s apparent that Entity Framework makes heavy use of that dependency injection already. But a Repository Pattern is widely considered - by software engineers far more experienced than I am - best practice for engineering services that deal with critical data. /post/development/dotnet-core-ajax/ Wed, 20 Apr 2022 00:00:00 +0000 /post/development/dotnet-core-ajax/ One of the problems with implementing a search feature that returns a table in a partial view is the Entity Framework model declarations must be strongly-typed. This means we run into difficulties declarating a model in the containing view and an IEnumerable instance of it for the partial view. One way around this is to instead discard the model for the mainview, and use jQuery and AJAX to read values from specific input elements in the main view, and pass those values to the controller action that returns the partial view with the IEnumerable model. /post/development/docker-missing-dotnet-sdk/ Sat, 16 Apr 2022 00:00:00 +0000 /post/development/docker-missing-dotnet-sdk/ There have been many people asking about this on Stack Overflow, and none of the answers there brought me closer to resolving the problem, which, it later transpired, was caused by something really silly I’d overlooked. When running ‘docker-compose up’ in the Docker CLI, for a .NET Core service, the output reports that it cannot find an installed SDK: It was not possible to find any installed .NET Core SDKs Did you mean to run . /post/development/dotnet-core-6-ef-mvc/ Fri, 01 Apr 2022 00:00:00 +0000 /post/development/dotnet-core-6-ef-mvc/ The following mostly doesn’t refer to problems native to the .NET Core 6 Framework itself, but rather some difficulties I encountered while getting an Entity Framework Database-First model working in the MVC project template generated by Visual Studio 2022. Some of the problems centred around: Breaking changes and things that might be awkward for developers accustomed to working with legacy non-Core versions of .NET (espectially .NET MVC). Not much documentation out there, relative to what’s published for the older . /post/development/mkdocs-intro/ Fri, 10 Dec 2021 00:00:00 +0000 /post/development/mkdocs-intro/ As you can tell, this site is no longer based on Publii CMS (which is still a very good CMS). After spending a few hours with MkDocs, I’ve been tempted to use that instead, as I can do pretty much everything using Vim. I’m still migrating the content, so this site is a work in progress. Using a static site generator might initially seem like a long-assed way of getting a basic site up, but once MkDocs is installed and running, and the site’s customised, we only need to worry about a single configuration file and where to place the content. /post/development/jupyter-notebook/ Fri, 26 Nov 2021 00:00:00 +0000 /post/development/jupyter-notebook/ Although Jupyter Notebook is designed primarily for data analysts, I think there are other use cases in which it can be an effective method of distributing Python code and associated documentation in a single .ipynb file. There are other editors we can use to handle .ipynb files: JupyterLab, Deepnote and Visual Studio Code (with the right extensions) are just a few I’ve tried. Jupyter Notebook is essentially a markdown editor with an embedded Python interpreter that executes whatever code is included in a document. /post/development/research-code-standards/ Mon, 01 Mar 2021 00:00:00 +0000 /post/development/research-code-standards/ Writing at The Shape of Code blog, Derek Jones asserted that ‘Structural differences between academia and industry make it likely that research software will always be a tangled mess, only usable by the person who wrote it.’ Yes, there are structural (and insurmountable) differences between academia and industry in how programming languages are used to solve problems. Professional developers more often engineer code, because there are typically real-world consequences to releasing poor-quality software, from damage to a company’s reputation to injury or death. /post/development/opencart/ Tue, 25 Aug 2020 00:00:00 +0000 /post/development/opencart/ Overview The OpenCart system follows the MVC (Model, View, Controller) pattern. A simple description of how this works is that a View determines the layout and appearance of a Web site, whereas the content itself is generated and inserted into the View by a Controller. A Model contains data objects that represent database entities being processed by the Controller. With OpenCart, we have a more complicated implementation of the MVC pattern, mainly because a site’s appearance isn’t actually determined by a set of HTML/CSHTML files in the /views directory.