1b38c3511d
* fix: stop two silent serialization and test-isolation traps Two follow-ups from #7957. ExternalAuthentication tests: the same process-global EndpointSecurityOptions.SecurityIsEnabled race the shells API tests had, across the six classes in that assembly that build an endpoint host — five setting it to false and IdentityLinkAuthorizationTests to true. Unlike the shells case these all call UseAuthorization(), so it does not surface as a missing-middleware error: anonymous endpoints answer 401/403, and the authorization test's endpoints come back AllowAnonymous and stop enforcing what it asserts. A module initializer cannot fix it since the assembly genuinely needs both values, so the six now share one collection with DisableParallelization. They are also the only six that build a host, so nothing else can observe a leaked value. Unaliased payloads: a payload whose type has no registered serialization alias is written without a _type discriminator and read back as an ExpandoObject whose keys carry the state serializer's camel-case naming policy, so a consumer that published Status finds status. The degradation is deliberate — the alias registry is an allow-list that keeps arbitrary CLR type names out of deserialization — but it was silent. It is now reported once per type, naming the type and both lossless alternatives, and PublishEvent.Payload documents them. Measured across the integration suite, only genuine user payload types reach this path, so the warning does not fire for Elsa's own types. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: check the log level before claiming the once-per-type warning slot WarnAboutUnaliasedType claimed a type's single report via TryAdd before LogWarning applied its level filter, so a type first serialized while Warning was disabled spent its slot on a call that logged nothing and then stayed silent forever, including after the level was raised at runtime. Check IsEnabled first, so the slot is only consumed by a report that is actually emitted. The regression test needs the capture to be the only logging provider: IsEnabled on the composite logger is an OR across providers, so the test builder's own xunit provider would otherwise keep Warning enabled regardless of what the test asked for. Reported by Greptile on #7969. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
17 lines
1.2 KiB
C#
17 lines
1.2 KiB
C#
namespace Elsa.ExternalAuthentication.IntegrationTests.Fixtures;
|
|
|
|
/// <summary>
|
|
/// <see cref="EndpointSecurityOptions.SecurityIsEnabled"/> is a process-global mutable static that FastEndpoints
|
|
/// reads once per host, while <c>UseFastEndpoints()</c> configures the endpoints. Every test class in this assembly
|
|
/// that builds an endpoint host has to set it — five of them to <c>false</c> and
|
|
/// <c>IdentityLinkAuthorizationTests</c> to <c>true</c> — and restore it afterwards, so running any two of them
|
|
/// concurrently lets one class's value leak into another's endpoint configuration: endpoints meant to be anonymous
|
|
/// come back carrying <c>Permissions(...)</c> and answer 401/403, and the authorization test's endpoints come back
|
|
/// <c>AllowAnonymous</c> and stop enforcing the very thing it asserts.
|
|
///
|
|
/// Sharing one collection makes those classes run one at a time, and <c>DisableParallelization</c> keeps them from
|
|
/// overlapping any other collection. Any future class that builds an endpoint host belongs in this collection too.
|
|
/// </summary>
|
|
[CollectionDefinition(nameof(EndpointSecurityCollection), DisableParallelization = true)]
|
|
public class EndpointSecurityCollection;
|