Analyzers API1000 and API1001 do not trigger on expression-bodied members

[eatdrinksleepcode]

Describe the bug

Analyzers API1000 and API1001 do not trigger on expression-bodied members, while they do trigger on the equivalent block-bodied members.

To Reproduce

[ProducesResponseType(statusCode: Status400BadRequest)]
public ActionResult<string> OopsUndocumented()
{
    return Unauthorized(); // API1000
}

[ProducesResponseType(statusCode: Status400BadRequest)]
public ActionResult<string> OopsUndocumentedExpression() => Unauthorized(); // No API1000

[ProducesResponseType(statusCode: Status400BadRequest)]
public ActionResult<string> OopsUndocumentedSuccess()
{
    return ""; // API1001
}

[ProducesResponseType(statusCode: Status400BadRequest)]
public ActionResult<string> OopsUndocumentedSuccessExpression() => ""; // No API1001

Cause

This is due to ActualApiResponseMetadataFactory.TryGetActualResponseMetadata only looking for ReturnStatementSyntax nodes (code). In an expression-bodied member, there is no return; you have to examine the ExpressionBody property of the MethodDeclarationSyntax.

Further technical details

• ASP.NET Core version: 5.0.202

[eatdrinksleepcode]

I am working on a fix for this, by looking at the ExpressionBody property of the method in addition to the ReturnStatementSyntax nodes.

This will require a change to the ActualApiResponseMetadata internal type, which currently assumes that it is operating on a ReturnStatementSyntax instance; it needs to operate on the underlying expression instead.

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.