Release v22.110.0

A command whose body cannot be read is now answered after authorization, so an unauthorized caller always gets Unauthorized whatever the body contains, and an authorized caller gets a validation error on the property that failed.

Added

• [property: ExplicitOffset] on a DateTimeOffset or DateTime command property (nullable too) refuses date-time input that has no offset or Z, with the validation message DateTime command property '<member>' requires an explicit offset or Z. A DateTimeOffset keeps its offset and a DateTime is converted to UTC. The accepted spellings match Screenplay's date comparison contract (ESM v26). See Command input binding. (part of #3339)
• IResourceFreeRequirement marks an ASP.NET authorization requirement that never reads the command, so its policy also runs when the body cannot be bound. Built-in role, claim, name and authenticated-user requirements count as resource-free already. (#3341)

Changed

• A command body that cannot be read is reported only after the command's authorization has run, on both the execute and the /validate endpoint. An unauthorized caller now gets 403 instead of 400. Policies with a requirement that reads the command cannot run without it, so for those commands an unbindable body still gives a validation error. (#3341)
• A body that cannot be read now gives a malformedRequest validation result naming the failing member (for example from or items[2].when). The message stays generic, so no parser or type details are exposed. (#3341)
• Controller-based commands report model binding errors with plain member names (from) instead of JSON paths ($.from). (#3341)