fix: resolve CI test failures (CORS, HSTS, presence)

[Chris0Jeky]

Summary

Fixes test failures that surface when running the full API test suite in CI, particularly after the cloud-deployment-preparation branch introduces ValidateProductionSecrets:

• CORS tests (3 failures) and HSTS test (1 failure): Tests that override the environment to Production via WithWebHostBuilder failed because Production mode validates that the JWT secret is not a known placeholder. The test host could not start, throwing InvalidOperationException. Fixed by supplying a non-placeholder JWT secret in each affected test.
• Board presence concurrency test (1 failure): RapidJoinLeave_EventuallyConsistent timed out waiting for a presence snapshot with the expected member count. Fixed by increasing timeouts from 10s to 20s and checking all collected snapshots (not just the last one) for the expected count, tolerating out-of-order SignalR delivery on slow CI runners.

Root causes

Failure	Root cause	Fix
CorsApiTests.Cors_ShouldRejectDevelopmentFallbackOriginsOutsideDevelopment	Production environment requires non-placeholder JWT secret	Supply Jwt:SecretKey via UseSetting
CorsApiTests.Cors_ShouldIgnoreDevelopmentConfiguredAlternateOriginOutsideDevelopment	Same	Same
SecurityHeadersApiTests.SecurityHeaders_ShouldEmitHsts_ForHttpsRequestsOutsideDevelopment	Same	Same
BoardPresenceConcurrencyTests.RapidJoinLeave_EventuallyConsistent	10s timeout insufficient under CI load; only checked last snapshot	20s timeout + scan all snapshots

Test plan

• All 11 CORS tests pass
• All 4 SecurityHeaders tests pass
• Both BoardPresenceConcurrency tests pass
• Full backend suite (4,477 tests) passes with 0 failures

[Chris0Jeky]

Adversarial self-review

What could go wrong

1. JWT secret duplication across test classes: The ProductionTestJwtSecret constant is duplicated in CorsApiTests and SecurityHeadersApiTests. If more tests need Production-mode overrides in the future, this pattern will spread. A shared constant in a test utility class would be cleaner. However, the current scope is small (2 classes, 3 test methods) and the duplication is self-documenting at each use site -- acceptable for now.

2. The presence timeout increase (10s -> 20s) treats the symptom, not the cause: The underlying issue is that under heavy CI load, SignalR in-memory broadcast can be slow enough that the observer misses a snapshot within the original timeout. The "check all snapshots" improvement is the real fix -- it handles out-of-order delivery. The timeout increase is defense-in-depth. If this test still flakes at 20s, the right move would be to add a retry with active polling of board presence via the REST API rather than relying solely on push-based snapshot observation.

3. The >= expectedMemberCount fallback in WaitForPresenceCountAsync: The helper now also accepts snapshots with more members than expected (via the >= fallback). This could mask a real bug where too many members appear. However, the exact-match check (==) runs first, and the >= fallback only triggers if no exact match exists. The test body still uses .Should().HaveCount(expectedCount) to verify the returned snapshot, so over-counting would still fail the assertion.

4. No changes to production code: All fixes are test-only. The CORS policy, security headers middleware, and presence hub are unchanged. This is intentional -- the production behavior was correct; the tests needed better isolation when simulating Production environments.

Verdict

Low-risk test-infrastructure fix. No production code changes. All 4,477 backend tests pass.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7048790988

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Wait for exact presence count before returning

WaitForPresenceCountAsync now returns a snapshot when Members.Count >= expectedMemberCount, which breaks the leave-path semantics where the expected count decreases. In RapidJoinLeave_EventuallyConsistent, if only an intermediate snapshot (e.g. pre-leave count) has arrived, this branch returns immediately and the subsequent exact-count assertion fails even though the correct snapshot could arrive moments later; this reintroduces CI flakiness instead of reducing it.

Useful? React with 👍 / 👎.

[gemini-code-assist]

Code Review

This pull request improves test stability on slow CI runners by increasing timeouts and refining the logic for waiting on board presence snapshots. It also introduces a non-placeholder JWT secret for tests running in Production mode to satisfy security validation requirements. A logic error was identified in the snapshot matching logic where a greater-than-or-equal check could cause premature failures during leave operations, and it is recommended to centralize the duplicated JWT secret constant to improve maintainability.

[gemini-code-assist]

The addition of the fallback ?? all.LastOrDefault(s => s.Members.Count >= expectedMemberCount) introduces a logic error when waiting for a decrease in member count (e.g., after users leave a board). If the current count is already greater than the expected count, the method will return immediately with the current snapshot instead of waiting for the count to drop. Since the subsequent assertions (like on line 174) expect an exact match, this will cause tests to fail prematurely. It is safer to only check for the exact match across the collected snapshots to handle out-of-order delivery without breaking the decreasing case.

            var match = all.LastOrDefault(s => s.Members.Count == expectedMemberCount);

[gemini-code-assist]

The ProductionTestJwtSecret constant is duplicated in SecurityHeadersApiTests.cs. To improve maintainability and ensure consistency across the test suite, consider moving this constant to a shared location, such as TestWebApplicationFactory or a dedicated test constants class. Alternatively, you could set a default non-placeholder JWT secret in TestWebApplicationFactory.ConfigureAppConfiguration so that individual tests don't need to override it manually when switching to the Production environment.

[gemini-code-assist]

The ProductionTestJwtSecret constant is duplicated in CorsApiTests.cs. To improve maintainability and ensure consistency across the test suite, consider moving this constant to a shared location, such as TestWebApplicationFactory or a dedicated test constants class.

[Copilot]

Pull request overview

Fixes CI-only backend test failures caused by Production-mode JWT secret validation and flaky SignalR presence timing under load.

Changes:

• Injects a non-placeholder Jwt:SecretKey into tests that force Production environment so the in-memory host can start.
• Makes the board presence concurrency test more tolerant to slow/out-of-order SignalR delivery by increasing timeouts and scanning collected snapshots.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
backend/tests/Taskdeck.Api.Tests/SecurityHeadersApiTests.cs	Supplies a non-placeholder JWT secret when forcing Production to keep HSTS test host startup passing.
backend/tests/Taskdeck.Api.Tests/CorsApiTests.cs	Supplies a non-placeholder JWT secret when forcing Production so CORS tests can run.
backend/tests/Taskdeck.Api.Tests/Concurrency/BoardPresenceConcurrencyTests.cs	Adjusts presence polling logic and timeouts to reduce CI flakiness.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

WaitForPresenceCountAsync is documented/named as waiting for an exact expected member count, but the implementation can return a snapshot where Members.Count is greater than expected (the ">= expectedMemberCount" fallback). That breaks the method contract and can cause this test to fail early in cases where presence temporarily overshoots before settling. Consider either removing the ">= expected" fallback (keep waiting for an exact match), or updating the callers/assertions and the method name/docs to explicitly accept "at least" semantics.

Suggested change

	var match = all.LastOrDefault(s => s.Members.Count == expectedMemberCount)
	?? all.LastOrDefault(s => s.Members.Count >= expectedMemberCount);
	var match = all.LastOrDefault(s => s.Members.Count == expectedMemberCount);

[Copilot]

ProductionTestJwtSecret is duplicated across multiple test classes. To avoid drift and make future changes to FirstRunBootstrapper placeholder validation easier, consider moving this constant into a shared test helper (e.g., TestWebApplicationFactory or a Tests.Support constants class) and referencing it from here.

[Copilot]

ProductionTestJwtSecret is duplicated across multiple test classes. To avoid drift and keep test configuration consistent, consider extracting this into a shared constant/helper used by all tests that set the environment to Production.