Public Access
jaap-jan
9bc28f1c0f
Eight endpoints today, around sixty planned. The minimal-API shape — a static
class per area holding static local functions, route and policy and name
asserted in one fluent chain with the handler somewhere below it — has not hurt
yet, and would. A handler's dependencies are parameters rather than injected, a
group's RequireAuthorization sits far from the handler it governs, and there is
no type to hang an endpoint's own documentation on. FastEndpoints is one class
per endpoint, its route and authorization in Configure(), its handler a method
on the same type.
Nothing about the wire moves, and the evidence is that the 94 existing HTTP
tests pass with zero edits to any of them. Same routes, verbs, route
constraints, status codes, operation ids, and the same RFC 9457 bodies with the
same code values. Every place the idiomatic FastEndpoints answer would have
changed one of those, it was refused:
Endpoints are registered from an explicit List<Type>, not found by scanning.
ADR 0002 rejected reflection discovery by name, and the reason it gave is
sharper here than in general — under WebApplicationFactory the scan reaches the
test assembly, so an endpoint written in a test would be registered into the
host under test. The cost is a line per endpoint that can be forgotten, which is
what the endpoint-inventory test is for. That test is the one ADR 0002 promised
and never got.
Handlers still return Results<Ok<T>, NotFound, ProblemHttpResult> from
ExecuteAsync. The union executes as an ordinary IResult, which is what keeps
problem bodies going through the host's serialiser and IProblemDetailsService,
and what keeps the compile-time record of which statuses an endpoint can
produce. No Send.* call appears anywhere; the moment one does, a response has
left the host's serialiser.
Validation stays in the feature services. A Validator<T> short-circuits before
the handler and answers with FastEndpoints' own envelope, which carries no code
— and the code is the only part of an error the client branches on. Twenty-odd
tests assert a specific code on a 400. It is banned in BannedSymbols.txt rather
than merely avoided, because the framework's documentation leads straight to it
and it looks like an improvement.
Three defects arrived with the framework and were caught in review. All three
were green at the time, which is the part worth remembering. FastEndpoints maps
GET /_test_url_cache_ unconditionally, in every environment, with no policy and
no way to opt out; it answers with the whole endpoint-name-to-route table. It is
short-circuited to 404 — by asking routing which endpoint it selected, after the
first attempt compared the request path with Ordinal and was therefore bypassable
at /_TEST_URL_CACHE_, certified by a test that only ever tried one spelling. The
default request binder writes query-string values over the deserialised body,
which would have let ?identityProviderToken=... put an ID token in a URL and from
there into every proxy log on the path; every endpoint now binds from the body
alone. And a route value read with Route<T>() is invisible to ApiExplorer, so the
generated document named {vaultId} in a path template with nothing declaring it —
invalid OpenAPI, and unusable by the client generators the document exists for.
Two changes to the surface, both deliberate. A body that cannot be deserialised
now answers with a problem document carrying malformed-request, rather than an
empty 400: FastEndpoints' default announces application/problem+json while
sending something else, and names the failing .NET type on the wire, in a
codebase that sets IncludeErrorDetails = false to prevent exactly that. And the
route table above returns 404 where it would otherwise have answered any
authenticated caller.
Each of the three fixes has a regression test that was checked by reverting the
fix and watching it fail — four failures for the route table and the binder, four
for the document. That check is the whole reason to trust them, since all three
defects passed a full green suite on the way in.
950 tests green across 16 projects, 14 of them new and no existing test edited.
Zero warnings, format clean, locked restore clean. FluentValidation, JobQueues
and Messaging are in the graph now and none is used.
Not verified: the generated document's response schemas, which differ from
before — FastEndpoints contributes its own Produces metadata. Nothing consumes
the document yet, and MapOpenApi runs only in Development behind the fallback
policy. It needs pinning if ADR 0002's build-time artifacts/openapi/v1.json is
ever built.
51 lines
3.5 KiB
Plaintext
51 lines
3.5 KiB
Plaintext
# Banned APIs, enforced by Microsoft.CodeAnalysis.BannedApiAnalyzers (RS0030).
|
|
# Format: <documentation-comment-id>;<message>
|
|
# See docs/adr/ for the reasoning behind each group.
|
|
|
|
## Time — everything in DodoSSH is UTC and must be fakeable in tests.
|
|
P:System.DateTime.Now;Use TimeProvider.GetUtcNow(). All DodoSSH timestamps are UTC (timestamptz) and must be injectable for tests.
|
|
P:System.DateTime.UtcNow;Use TimeProvider.GetUtcNow() so time can be faked in tests.
|
|
P:System.DateTime.Today;Use TimeProvider.GetUtcNow().Date.
|
|
P:System.DateTimeOffset.Now;Use TimeProvider.GetUtcNow().
|
|
P:System.DateTimeOffset.UtcNow;Use TimeProvider.GetUtcNow() so time can be faked in tests.
|
|
|
|
## Identifiers — UUIDv7 gives sortable PKs with good index locality, and clients
|
|
## must be able to mint ids offline.
|
|
M:System.Guid.NewGuid;Use Guid.CreateVersion7() for sortable primary keys.
|
|
|
|
## Randomness — anything key-, token- or nonce-adjacent must be cryptographic.
|
|
T:System.Random;Use RandomNumberGenerator for anything security-relevant, or inject a seeded generator for tests.
|
|
|
|
## Sync-over-async — deadlocks under ASP.NET and stalls the Avalonia UI thread.
|
|
P:System.Threading.Tasks.Task`1.Result;Await the task instead; .Result deadlocks and hides exceptions in an AggregateException.
|
|
M:System.Threading.Tasks.Task.Wait;Await the task instead.
|
|
M:System.Threading.Tasks.Task.WaitAll;Use Task.WhenAll with await.
|
|
M:System.Threading.Tasks.Task.WaitAny;Use Task.WhenAny with await.
|
|
M:System.Threading.Tasks.Task.GetAwaiter;Await the task directly rather than blocking on the awaiter.
|
|
|
|
## Request validation — FluentValidation arrives transitively with FastEndpoints and is
|
|
## deliberately unused. A validator short-circuits before the handler and answers with
|
|
## FastEndpoints' own envelope, which carries no ProblemDetails `code` — and the code is the only
|
|
## part of an error the client branches on. Validation lives in the feature services, where it can
|
|
## throw an exception the endpoint maps to a coded problem. See docs/adr/0008-fastendpoints.md.
|
|
T:FastEndpoints.Validator`1;Validate in the feature service and map its exception to a coded problem; a Validator<T> answers with FastEndpoints' envelope, which has no `code`.
|
|
T:FluentValidation.AbstractValidator`1;As above. FluentValidation is a transitive dependency of FastEndpoints, not a chosen one.
|
|
|
|
## Encoding — must be explicit, never the ambient codepage.
|
|
P:System.Text.Encoding.Default;Specify the encoding explicitly; Encoding.Default varies by platform.
|
|
|
|
## Culture-sensitive string handling is already covered by CA1304/CA1307/CA1311,
|
|
## which AnalysisLevel=latest-All turns on. Not duplicated here.
|
|
|
|
## Cryptography — the client holds key material in libsodium guarded memory, and
|
|
## MD5/SHA1 have no place in this product. Fingerprints are SHA-256.
|
|
T:System.Security.Cryptography.MD5;Banned. SSH fingerprints are SHA-256; see docs/crypto.md.
|
|
T:System.Security.Cryptography.SHA1;Banned. Use SHA-256 or better.
|
|
T:System.Security.Cryptography.Rfc2898DeriveBytes;PBKDF2 is not our KDF. Use Argon2id via DodoSSH.Crypto; see docs/crypto.md.
|
|
T:System.Security.SecureString;Deprecated and not cross-platform. Use a pooled byte[] zeroed with CryptographicOperations.ZeroMemory.
|
|
|
|
# Note: constant-time comparison of secrets (CryptographicOperations.FixedTimeEquals
|
|
# over Enumerable.SequenceEqual) is enforced by a BannedSymbols.txt scoped to
|
|
# DodoSSH.Crypto, not globally — banning SequenceEqual everywhere is pure noise in
|
|
# business logic and tests, and noisy bans just train people to suppress them.
|