Phase A.1: Security, authorization, and foundation hardening - #2
Conversation
Close critical production-security gaps before Phase B: remove credential fallbacks, fail-fast TestAuth/Demo Seed, privilege and scope guards, immutable audit, attachment isolation, Entra/frontend production gates, migrations, and mandatory CI. Co-authored-by: Cursor <cursoragent@cursor.com>
Harden attachment entity resolution and path containment, require Grant* permissions for Global/HQ assignment, restrict national audit to Global/HQ, fail-closed NuGet scanning, Entra startup validation, and expand unit/integration/frontend coverage. Co-authored-by: Cursor <cursoragent@cursor.com>
Replace gitleaks-action push range scan with full-history detect, surface integration test failures instead of swallowing output, and wait for authenticated SQL readiness before tests. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
… tests. Use WebHost UseSetting alongside in-memory configuration so ConnectionStrings:Baseera is available under minimal hosting during CI. Co-authored-by: Cursor <cursoragent@cursor.com>
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @henter36, your pull request is larger than the review limit of 150000 diff characters
|
Warning Review limit reached
Next review available in: 13 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (18)
📝 WalkthroughWalkthroughThis PR adds Phase A.1 security hardening across CI, backend authorization, environment and provisioning controls, attachment handling, persistence constraints, audit protection, integration tests, and frontend Entra authentication validation. ChangesPhase A.1 hardening
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant LoginPage
participant AuthProvider
participant MSAL
participant API
LoginPage->>AuthProvider: loginEntra()
AuthProvider->>MSAL: ensureMsalInitialized()
AuthProvider->>MSAL: loginPopup() and acquireToken()
AuthProvider->>API: request with access token
API-->>AuthProvider: authenticated user or 401
AuthProvider-->>LoginPage: refreshed auth state
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements Phase A.1 security hardening and authorization improvements for the Baseera platform, including Entra ID integration, environment fail-fast guards, soft-delete filters, audit log immutability, attachment security (magic bytes and path guards), and privilege escalation checks. The review feedback highlights a bug in magic bytes validation that rejects small text files, a potential crash in React development mode due to duplicate MSAL initialization, and opportunities to improve performance by adopting asynchronous file I/O and SHA256 hashing.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Co-authored-by: Cursor <cursoragent@cursor.com>
Harden CI supply chain (least privilege, pinned gitleaks checksum, npm --ignore-scripts), refactor PrivilegeGuard/AttachmentService for complexity, and fix async SHA/health plus MSAL single-flight without weakening A.1 controls. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Unquoted gitleaks run args were parsed as multiple YAML scalars; use a block scalar so secret-scan can start. Co-authored-by: Cursor <cursoragent@cursor.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/backend/Baseera.Infrastructure/Attachments/AttachmentService.cs (1)
139-173: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winSensitive-permission check happens too late — audit log records a "successful" download for requests later denied, and a file stream can leak on audit failure.
Two related ordering problems in this method:
EnsureEntityInScopeAsync/scan-status checks don't include the classification/sensitive-permission check. That check only happens afterward inAttachmentAppService.DownloadAsync(that file, Lines 47-52), by which point this method has already opened the file stream, written an audit"Download"entry, and calledSaveChangesAsync. A caller withoutAttachmentsDownloadSensitivewho requests aConfidentialattachment gets a logged "successful" download in the audit trail even though the request is ultimately rejected and the stream is disposed unread.stream = await storage.OpenReadAsync(...)has no enclosingtry/finally; if the subsequentaudit.WriteAsyncordb.SaveChangesAsyncthrows, the openedStreamis never disposed.Moving the classification check up (this service already has
currentUserinjected) and writing the audit before opening the stream resolves both issues.🔧 Suggested fix
if (entity.ScanStatus is AttachmentScanStatus.PendingScan or AttachmentScanStatus.Quarantined or AttachmentScanStatus.Rejected) { throw new UnauthorizedAccessException("لا يمكن تنزيل المرفق قبل اكتمال الفحص الأمني بنجاح."); } + if (entity.Classification >= ClassificationLevel.Confidential && + !currentUser.HasPermission(PermissionCodes.AttachmentsDownloadSensitive)) + { + throw new UnauthorizedAccessException("يتطلب تنزيل هذا المرفق صلاحية حساسة."); + } + + await audit.WriteAsync(new AuditEntry + { + Action = "Download", + Module = "Attachments", + EntityType = nameof(Attachment), + EntityId = entity.Id.ToString(), + IsSensitiveView = entity.Classification >= ClassificationLevel.Confidential, + NewValues = new { entity.OriginalFileName, entity.Classification, entity.ScanStatus } + }, cancellationToken); + await db.SaveChangesAsync(cancellationToken); + Stream stream; try { stream = await storage.OpenReadAsync(entity.StoragePath, cancellationToken); } catch (FileNotFoundException) { throw new InvalidOperationException("تعذر استرجاع محتوى المرفق."); } - await audit.WriteAsync(new AuditEntry - { - Action = "Download", - Module = "Attachments", - EntityType = nameof(Attachment), - EntityId = entity.Id.ToString(), - IsSensitiveView = entity.Classification >= ClassificationLevel.Confidential, - NewValues = new { entity.OriginalFileName, entity.Classification, entity.ScanStatus } - }, cancellationToken); - await db.SaveChangesAsync(cancellationToken); - return (entity, stream);With this in place,
AttachmentAppService.DownloadAsync's classification recheck becomes redundant defense-in-depth and could be simplified/removed there.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/backend/Baseera.Infrastructure/Attachments/AttachmentService.cs` around lines 139 - 173, Update AttachmentService.DownloadAsync to enforce the classification-sensitive permission using the injected currentUser before any audit or storage access, alongside EnsureEntityInScopeAsync and the scan-status validation. Write and save the Download audit entry before calling storage.OpenReadAsync, so denied requests are not audited as successful and audit failures cannot leak a stream; retain the existing file-not-found handling. Simplify or remove the redundant classification check in AttachmentAppService.DownloadAsync.
🧹 Nitpick comments (4)
.github/workflows/ci.yml (1)
112-125: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winAvoid running integration tests twice.
Currently, the integration tests are executed twice—once for generating the result and once to parse the output for skipped tests. Integration tests are often slow and stateful. Instead, capture the output of the first run using
teeand parse that file to fail the build if there are skipped tests.♻️ Proposed refactoring
- name: Integration tests run: | set -euo pipefail set +e - dotnet test src/backend/tests/Baseera.IntegrationTests -c Release --logger "console;verbosity=detailed" - status=$? + dotnet test src/backend/tests/Baseera.IntegrationTests -c Release --logger "console;verbosity=detailed" | tee test_output.log + status=$? set -e if [[ "$status" -ne 0 ]]; then exit "$status" fi - summary=$(dotnet test src/backend/tests/Baseera.IntegrationTests -c Release --no-build --verbosity quiet) - if echo "$summary" | grep -E 'Skipped:\s*[1-9]' >/dev/null; then + if grep -E 'Skipped:\s*[1-9]' test_output.log >/dev/null; then echo "Integration tests reported skips; failing CI" >&2 exit 1 fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 112 - 125, Update the integration-test shell block to run dotnet test only once, capturing its output with tee into a temporary or workspace file while preserving the exit status. Parse that captured output for skipped tests after the run, retain the existing failure messages, and ensure either test failures or detected skips cause the job to exit nonzero.src/frontend/src/pages/LoginPage.tsx (1)
18-47: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low valueBlank login page if
modeis neither'entra'nor test-allowed.If
getAuthMode()ever returns something other than'entra'whileisTestAuthAllowed()isfalse(e.g., a misconfigured non-production build withmode === 'test'butimport.meta.env.DEVfalse), the user sees no login action and no explanatory message — none of the three conditional blocks render. This is presumably guarded by the production config-validation script, but there's no client-side fallback message for this state.♻️ Optional fallback message
{mode === 'entra' && !isTestAuthAllowed() && !configError && ( <p className="muted">استخدم زر Entra لتسجيل الدخول. لا يتوفر وضع الاختبار في هذا البناء.</p> )} + {mode !== 'entra' && !isTestAuthAllowed() && !configError && ( + <p className="error" role="alert">تعذر تحديد وضع تسجيل الدخول. تحقق من إعدادات البيئة.</p> + )}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/frontend/src/pages/LoginPage.tsx` around lines 18 - 47, Add a client-side fallback message in the LoginPage rendering for any authentication state where mode is not 'entra' and isTestAuthAllowed() is false, ensuring the page never renders blank. Keep the existing Entra and TestAuth controls unchanged, and make the fallback explain that no supported login method is available.src/backend/Baseera.Infrastructure/Attachments/AttachmentService.cs (1)
273-284: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider reusing the new
UsersIncludingDeletedabstraction instead of manualIgnoreQueryFilters().This bypasses all global query filters via
IgnoreQueryFilters()and manually re-applies only!u.IsDeleted, duplicating what the newly-introducedIBaseeraDbContext.UsersIncludingDeleted(Abstractions.cs) appears intended for. Using that property here (ifBaseeraDbContextimplements the interface) would centralize the "bypass filters, re-check IsDeleted" logic in one place.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/backend/Baseera.Infrastructure/Attachments/AttachmentService.cs` around lines 273 - 284, The ResolveUserAccessAsync method manually bypasses all query filters and rechecks IsDeleted; replace that query with the existing UsersIncludingDeleted abstraction, preserving the entityId match, cancellation token, and not-found behavior.src/backend/tests/Baseera.IntegrationTests/BaseeraApiFactory.cs (1)
144-166: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
SeedUserWithPermissionsAsyncmutates a sharedRole's permissions, not a per-test grant.Permissions are added directly to the
Rolerow (roleCodes[0]), which is shared by every user assigned that role within the same test database/fixture instance. If multiple tests in the same class seed different users with the same role code but differentextraPermissions, later grants leak into earlier-seeded users' effective permissions since they share the sameRole. This is risky for exactly the kind of scope/permission isolation assertions this PR is adding (ScopeIsolationTests.cs,OrganizationalScopeServiceTests.cs).Consider creating a dedicated role per invocation (e.g., a synthetic role code derived from
subject) instead of mutating a shared, potentially-reused role.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/backend/tests/Baseera.IntegrationTests/BaseeraApiFactory.cs` around lines 144 - 166, Update SeedUserWithPermissionsAsync to create or reuse a dedicated synthetic role for each subject before applying extraPermissions, rather than adding permissions to the shared roleCodes[0] role. Assign that per-invocation role to the seeded user and add RolePermissions to it, ensuring users seeded with different permissions cannot inherit grants from one another.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 44-45: Fix the YAML syntax in the “Gitleaks full history” workflow
step by removing the unmatched quotes around the command or converting the run
value to a block scalar. Preserve the existing Gitleaks arguments and behavior.
In `@src/backend/Baseera.Api/Middleware/Middleware.cs`:
- Around line 96-98: Update the 403 response detail in the middleware’s
problem-details construction to replace the English “Provisioning” term with its
Arabic equivalent, keeping the rest of the Arabic user-facing message and status
unchanged.
In `@src/backend/Baseera.Application/Attachments/AttachmentRules.cs`:
- Around line 98-108: Update the header-reading logic in the attachment
validation method to fill the entire 8-byte buffer using ReadExactly or a loop,
rather than relying on one Stream.Read call. Perform the required-length check
only after reading until the buffer is full or the stream reaches EOF, while
preserving the existing short/corrupt file exception behavior.
In `@src/backend/Baseera.Application/Identity/UserAdminService.cs`:
- Around line 17-36: Update AssignScopeRequestValidator to require Reason to be
non-empty or non-whitespace in addition to its existing maximum-length rule, so
blank values fail through FluentValidation before AssignScopeAsync’s manual
check. Preserve the existing scope-shape validation and length limit.
In `@src/backend/Baseera.Infrastructure/Identity/CurrentUser.cs`:
- Around line 105-114: Update UserProvisioningService.ResolveAsync to avoid
saving bookkeeping fields on every authenticated request: throttle updates to
LastLoginAtUtc, DisplayNameAr, and Email, and handle
DbUpdateConcurrencyException from this non-critical SaveChangesAsync by ignoring
or logging it so the request still succeeds.
In `@src/frontend/.env.production`:
- Line 7: Update VITE_ENTRA_REDIRECT_URI in the production environment
configuration to use the deployed HTTPS origin, or leave it empty to fall back
to window.location.origin; do not retain the localhost HTTP value.
- Around line 4-6: Replace the all-zero Entra GUID values in
src/frontend/.env.production lines 4-6 with placeholders containing YOUR_ so
existing gates reject unreplaced configuration; update
src/frontend/scripts/check-production-auth.mjs lines 24-30 and
validateEntraEnv() in src/frontend/src/auth/msalConfig.ts lines 1-14 to also
reject all-zero GUID and 00000000-0000-... placeholder patterns, keeping
build-time and runtime validation consistent.
In `@src/frontend/src/auth/msalInit.ts`:
- Around line 15-25: Update ensureMsalInitialized so a rejected
instance.initialize() clears msalInitializationPromise before propagating the
failure, allowing subsequent callers to retry initialization. Preserve the
existing shared-promise behavior for concurrent callers and successful
initialization.
---
Outside diff comments:
In `@src/backend/Baseera.Infrastructure/Attachments/AttachmentService.cs`:
- Around line 139-173: Update AttachmentService.DownloadAsync to enforce the
classification-sensitive permission using the injected currentUser before any
audit or storage access, alongside EnsureEntityInScopeAsync and the scan-status
validation. Write and save the Download audit entry before calling
storage.OpenReadAsync, so denied requests are not audited as successful and
audit failures cannot leak a stream; retain the existing file-not-found
handling. Simplify or remove the redundant classification check in
AttachmentAppService.DownloadAsync.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 112-125: Update the integration-test shell block to run dotnet
test only once, capturing its output with tee into a temporary or workspace file
while preserving the exit status. Parse that captured output for skipped tests
after the run, retain the existing failure messages, and ensure either test
failures or detected skips cause the job to exit nonzero.
In `@src/backend/Baseera.Infrastructure/Attachments/AttachmentService.cs`:
- Around line 273-284: The ResolveUserAccessAsync method manually bypasses all
query filters and rechecks IsDeleted; replace that query with the existing
UsersIncludingDeleted abstraction, preserving the entityId match, cancellation
token, and not-found behavior.
In `@src/backend/tests/Baseera.IntegrationTests/BaseeraApiFactory.cs`:
- Around line 144-166: Update SeedUserWithPermissionsAsync to create or reuse a
dedicated synthetic role for each subject before applying extraPermissions,
rather than adding permissions to the shared roleCodes[0] role. Assign that
per-invocation role to the seeded user and add RolePermissions to it, ensuring
users seeded with different permissions cannot inherit grants from one another.
In `@src/frontend/src/pages/LoginPage.tsx`:
- Around line 18-47: Add a client-side fallback message in the LoginPage
rendering for any authentication state where mode is not 'entra' and
isTestAuthAllowed() is false, ensuring the page never renders blank. Keep the
existing Entra and TestAuth controls unchanged, and make the fallback explain
that no supported login method is available.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 8143b3f8-b42b-4e44-a1ed-b2a1cff3b86e
📒 Files selected for processing (68)
.github/workflows/ci.yml.gitleaks.tomlREADME.mddocs/entra-id-configuration.mddocs/phase-a1-completion-report.mddocs/phase-a1-current-findings.mdscripts/check-nuget-vulnerabilities.shscripts/deploy-db.sqlscripts/test-nuget-vuln-gate-fail-closed.shsrc/backend/Baseera.Api/Auth/TestAuthHandler.cssrc/backend/Baseera.Api/Authorization/AuthorizationExtensions.cssrc/backend/Baseera.Api/Baseera.Api.csprojsrc/backend/Baseera.Api/Endpoints/ApiEndpoints.cssrc/backend/Baseera.Api/Health/HealthExtensions.cssrc/backend/Baseera.Api/Middleware/Middleware.cssrc/backend/Baseera.Api/Program.cssrc/backend/Baseera.Api/appsettings.example.jsonsrc/backend/Baseera.Api/appsettings.jsonsrc/backend/Baseera.Application/Abstractions/Abstractions.cssrc/backend/Baseera.Application/Attachments/AttachmentAppService.cssrc/backend/Baseera.Application/Attachments/AttachmentRules.cssrc/backend/Baseera.Application/Attachments/StoragePathGuard.cssrc/backend/Baseera.Application/Audit/AuditQueryService.cssrc/backend/Baseera.Application/DependencyInjection/ApplicationServiceCollectionExtensions.cssrc/backend/Baseera.Application/Identity/UserAdminService.cssrc/backend/Baseera.Application/Organization/OrganizationService.cssrc/backend/Baseera.Application/Security/EnvironmentSecurityGuard.cssrc/backend/Baseera.Application/Security/OrganizationalScopeService.cssrc/backend/Baseera.Application/Security/PrivilegeGuard.cssrc/backend/Baseera.Domain/Identity/IdentityEntities.cssrc/backend/Baseera.Domain/Identity/UserProvisioningStatus.cssrc/backend/Baseera.Infrastructure/Attachments/AttachmentService.cssrc/backend/Baseera.Infrastructure/Audit/AuditService.cssrc/backend/Baseera.Infrastructure/DependencyInjection/InfrastructureServiceCollectionExtensions.cssrc/backend/Baseera.Infrastructure/Identity/CurrentUser.cssrc/backend/Baseera.Infrastructure/Persistence/BaseeraDbContext.cssrc/backend/Baseera.Infrastructure/Persistence/BaseeraDbContextFactory.cssrc/backend/Baseera.Infrastructure/Persistence/Configurations/EntityConfigurations.cssrc/backend/Baseera.Infrastructure/Persistence/DatabaseInitializer.cssrc/backend/Baseera.Infrastructure/Persistence/Migrations/20260719071930_PhaseA1Hardening.Designer.cssrc/backend/Baseera.Infrastructure/Persistence/Migrations/20260719071930_PhaseA1Hardening.cssrc/backend/Baseera.Infrastructure/Persistence/Migrations/20260719073347_PhaseA1FilteredIndexesAndRestrict.Designer.cssrc/backend/Baseera.Infrastructure/Persistence/Migrations/20260719073347_PhaseA1FilteredIndexesAndRestrict.cssrc/backend/Baseera.Infrastructure/Persistence/Migrations/BaseeraDbContextModelSnapshot.cssrc/backend/tests/Baseera.IntegrationTests/Baseera.IntegrationTests.csprojsrc/backend/tests/Baseera.IntegrationTests/BaseeraApiFactory.cssrc/backend/tests/Baseera.IntegrationTests/PhaseA1HardeningIntegrationTests.cssrc/backend/tests/Baseera.IntegrationTests/ScopeIsolationTests.cssrc/backend/tests/Baseera.UnitTests/AttachmentPathAuditTests.cssrc/backend/tests/Baseera.UnitTests/AttachmentRulesTests.cssrc/backend/tests/Baseera.UnitTests/AttachmentStorageHealthCheckTests.cssrc/backend/tests/Baseera.UnitTests/AuditImmutabilityTests.cssrc/backend/tests/Baseera.UnitTests/AuditSecretRedactorTests.cssrc/backend/tests/Baseera.UnitTests/Baseera.UnitTests.csprojsrc/backend/tests/Baseera.UnitTests/OrganizationalScopeServiceTests.cssrc/backend/tests/Baseera.UnitTests/PrivilegeProvisioningSoftDeleteTests.cssrc/backend/tests/Baseera.UnitTests/StartupGuardHostTests.cssrc/frontend/.env.productionsrc/frontend/package.jsonsrc/frontend/scripts/check-production-auth.mjssrc/frontend/src/api/client.tssrc/frontend/src/auth/AuthProvider.tsxsrc/frontend/src/auth/authGuards.test.tssrc/frontend/src/auth/msalConfig.tssrc/frontend/src/auth/msalInit.test.tssrc/frontend/src/auth/msalInit.tssrc/frontend/src/pages/LoginPage.test.tsxsrc/frontend/src/pages/LoginPage.tsx
Exclude Persistence/Migrations from copy-paste detection, make EnsureRoleRankAllowsGrant static, and clarify the NuGet fail-closed self-test success message. Co-authored-by: Cursor <cursoragent@cursor.com>
…sed gates. Exclude EF Persistence/Migrations from Sonar analysis, reject zero-GUID and non-HTTPS redirect placeholders, clear MSAL init cache on failure, and verify gitleaks against the official checksums file. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Extract shared foreign-key drop/add helpers and fix msalConfig placeholder typing so Sonar no longer fails on mirrored migration blocks. Co-authored-by: Cursor <cursoragent@cursor.com>
Use ReadExactly for magic-byte headers, require non-empty scope Reason in FluentValidation, throttle login bookkeeping writes, and update the completion report after Sonar QG green. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Split ValidateMagicBytes and PersistLoginBookkeepingAsync so Sonar Critical S3776 smells on new code stay at or below 15. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
|
1 participant
Summary
Test plan
Made with Cursor
Summary by CodeRabbit