Reduce AutoApiLogonOperators to a read-only public surface

[Copilot]

Startup.AutoApiLogonOperators was exposed as a mutable public static List<string>, which allowed arbitrary external mutation of shared bootstrap state. This change keeps operator registration writable where needed while exposing only a read-only view to consumers.

• Public surface

  • Replace the mutable public static field with a read-only property:
    • public static IReadOnlyCollection<string> AutoApiLogonOperators
  • Keep the backing collection private to Startup

• Controlled mutation

  • Introduce an internal Startup.AddAutoApiLogonOperator(string operatorId) entry point
  • Update OperatorRegistry to register API-logon operators through that method instead of mutating shared state directly

• Deterministic bootstrap state

  • Clear the backing collection during ConfigureContainer so repeated container initialization does not accumulate duplicate operator IDs

• Coverage

  • Add a focused bootstrapper test that verifies:
    • only operators with ApiLogonRequired = true are exposed
    • repeated container configuration does not duplicate entries

private static readonly List<String> AutoApiLogonOperatorsInternal = new List<String>();

public static IReadOnlyCollection<String> AutoApiLogonOperators =>
    AutoApiLogonOperatorsInternal.AsReadOnly();

internal static void AddAutoApiLogonOperator(String operatorId) {
    if (Startup.AutoApiLogonOperatorsInternal.Contains(operatorId) == false) {
        Startup.AutoApiLogonOperatorsInternal.Add(operatorId);
    }
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• f.feedz.io
  • Triggering command: /usr/bin/dotnet dotnet test /home/REDACTED/work/TransactionProcessor/TransactionProcessor/TransactionProcessor.Tests/TransactionProcessor.Tests.csproj --filter VerifyBootstrapperIsValid --no-restore -nologo (dns block)
  • Triggering command: /usr/bin/dotnet dotnet test /home/REDACTED/work/TransactionProcessor/TransactionProcessor/TransactionProcessor.Tests/TransactionProcessor.Tests.csproj --filter BootstrapperTests --no-restore -nologo (dns block)
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/csharp/tools/linux64/Semmle.Autobuild.CSharp /opt/hostedtoolcache/CodeQL/2.24.3/x64/codeql/csharp/tools/linux64/Semmle.Autobuild.CSharp (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[BestPractice] Use an immutable collection or reduce the accessibility of the public static field 'AutoApiLogonOperators'.</issue_title>
<issue_description>Codacy ID: e9466dbecb2f04879dba350a0055a321

File: TransactionProcessor/Startup.cs
Line: 43
Rule: BestPractice (Warning)
Commit: 96becaab6a676b93555af647b469bfcb290a1395

Message: Use an immutable collection or reduce the accessibility of the public static field 'AutoApiLogonOperators'.

**Code Snippet:**
```csharp
        public static List<String> AutoApiLogonOperators = new List<String>(); 
```

</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [BestPractice] Use an immutable collection or reduce the accessibility of the public static field 'AutoApiLogonOperators'. #1411

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.