v1.1.0

SonarQube Cloud static analysis and CI/tooling improvements — no API changes.

Added

• SonarQube Cloud static analysis wired into CI's build-and-test job via dotnet-sonarscanner,
  gated on the quality gate result — a failing gate now fails the build. Results are posted
  directly to the PR (status checks and a summary comment), and a quality gate badge was added
  to the README.
• Test coverage reporting to SonarQube Cloud via dotnet test --collect:"XPlat Code Coverage"
  (coverlet.collector).

Fixed

• workflow_dispatch runs weren't picking up the branch name (a SonarScanner limitation) — now
  passed explicitly for any non-PR trigger.
• Register_WithWellFormedRequest_IsNotRejectedByValidation gets an explicit assertion (it
  always failed correctly via EnsureSuccessStatusCode(), Sonar just didn't recognize that as
  a formal assertion).
• TwoFactorService.SendTwoFaCodeAsync's per-provider send logic extracted into
  TrySendTwoFaCodeAsync, bringing cyclomatic complexity under the SonarQube threshold —
  behavior-preserving, no logic change.
• Cleared 25 of the 32 backlog SonarQube Cloud findings from issue #37: constant array literals
  in tests hoisted to shared static fields, magic numbers named as constants, duplicated string
  literals extracted to constants, a long doc-comment line wrapped, a test regex converted to
  [GeneratedRegex], authorization policy registration switched to AddAuthorizationBuilder,
  and a clearer xUnit assertion form adopted.
• AuthCoreService's three near-identical email-sending call sites extracted into a shared
  SendTemplatedEmailAsync helper, clearing a duplication finding the constant-extraction above
  surfaced. Behavior-preserving only.

TUser on IAuthCoreService<TUser>/ITwoFactorService<TUser>/IUserActivationService<TUser>
was flagged as an unused type parameter by static analysis and reviewed — it's this package's
generic-user extension point, so it stays. 2 findings (constructor parameter count) remain open,
tracked in issue #37.

RC-verified before this release: tagged as a prerelease, pulled into
angular-dotnet-auth-template, full unit and Playwright e2e suites passed (including the three
flows touching the email-sending refactor).

Install

dotnet add package DGates.Identity.Jwt2Fa --version 1.1.0