Public Access
jaap-jan
06d04b490b
The second M1 gate. This assembly, not the OpenAPI document, is the client's contract, so PublicApiAnalyzers now tracks all 540 public members: a renamed DTO property becomes a build error rather than a runtime deserialisation failure on someone's laptop. Contract surface: - EncryptedPayload carries the envelope plus the KeyGeneration and AadVersion columns needed to recompute AAD, since AAD is derived from the row rather than transmitted. - Sync: push with per-operation status (Applied/Conflict/Forbidden/Invalid/Duplicate) so one stale item cannot block a whole offline queue; a Conflict returns the server's row for client-side three-way merge, because the server cannot merge ciphertext. - Enrollment: KeyStatement whose hash becomes the OIDC nonce, so the identity provider signs over the public keys and this server cannot fabricate a key for a user who never enrolled. - Meta and .well-known configuration: capability negotiation instead of URL versioning, which is what a self-hosted product needs when client and server upgrade independently. - SyncPlaintextFields deliberately has no label or name field. ACL admin runs client-side where names can be decrypted, so the server never needs a searchable title. Two design problems found by writing the tests rather than assuming: - Hand-constructing JsonSerializerOptions and merely pointing its resolver at the context silently discards every source-generated setting. JsonSerializerDefaults.Web replaces NumberHandling.Strict with AllowReadingFromString, so "1" would be accepted where 1 is meant — invisible until two implementations disagree. Callers now use ResponseOptions or StrictRequestOptions; StrictRequestOptions is derived by copying so it cannot drift. - StrictRequestOptions had a static-initialisation cycle: it read the generated Default property from the same type's initialiser and got null. Now lazy. Requests reject unmapped members so a client typo is a 400; responses tolerate them so an older client can read a newer server. Enums cross the wire as strings, so reordering one cannot silently reinterpret stored data. Also: excluded source-generator output from PublicApiAnalyzers. The JSON generator emits a public member per serialisable type, which would have added hundreds of mechanical entries and drowned the ones describing the actual wire contract. And disabled MA0048's one-type-per-file rule: splitting SyncPullRequest from SyncPullResponse makes a reviewer open two files to understand one endpoint. Verified: 0 warnings, 95 tests pass, format clean.
152 lines
7.0 KiB
INI
152 lines
7.0 KiB
INI
# EditorConfig for DodoSSH — https://editorconfig.org
|
|
root = true
|
|
|
|
[*]
|
|
charset = utf-8
|
|
end_of_line = lf
|
|
indent_style = space
|
|
indent_size = 4
|
|
insert_final_newline = true
|
|
trim_trailing_whitespace = true
|
|
|
|
[*.{json,yml,yaml,js,ts,css,html,axaml,xaml,csproj,props,targets,slnx}]
|
|
indent_size = 2
|
|
|
|
[*.md]
|
|
# Two trailing spaces are a hard line break in Markdown.
|
|
trim_trailing_whitespace = false
|
|
|
|
[*.{cmd,bat,ps1}]
|
|
end_of_line = crlf
|
|
|
|
[*.cs]
|
|
indent_size = 4
|
|
|
|
#### Language conventions ####
|
|
|
|
csharp_style_namespace_declarations = file_scoped:error
|
|
csharp_using_directive_placement = outside_namespace:error
|
|
csharp_style_var_for_built_in_types = false:suggestion
|
|
csharp_style_var_when_type_is_apparent = true:suggestion
|
|
csharp_style_var_elsewhere = false:suggestion
|
|
csharp_prefer_braces = true:suggestion
|
|
csharp_style_prefer_primary_constructors = true:suggestion
|
|
csharp_style_expression_bodied_methods = when_on_single_line:suggestion
|
|
csharp_style_expression_bodied_properties = true:suggestion
|
|
|
|
dotnet_sort_system_directives_first = true
|
|
dotnet_separate_import_directive_groups = false
|
|
|
|
dotnet_style_qualification_for_field = false:suggestion
|
|
dotnet_style_qualification_for_property = false:suggestion
|
|
dotnet_style_qualification_for_method = false:suggestion
|
|
dotnet_style_readonly_field = true:warning
|
|
dotnet_style_require_accessibility_modifiers = for_non_interface_members:warning
|
|
dotnet_style_coalesce_expression = true:suggestion
|
|
dotnet_style_null_propagation = true:suggestion
|
|
dotnet_style_prefer_is_null_check_over_reference_equality_method = true:suggestion
|
|
|
|
# Async methods must be suffixed Async (VSTHRD200 equivalent via naming rules below).
|
|
dotnet_naming_rule.async_methods_end_in_async.severity = warning
|
|
dotnet_naming_rule.async_methods_end_in_async.symbols = any_async_method
|
|
dotnet_naming_rule.async_methods_end_in_async.style = ends_with_async
|
|
dotnet_naming_symbols.any_async_method.applicable_kinds = method
|
|
dotnet_naming_symbols.any_async_method.required_modifiers = async
|
|
dotnet_naming_style.ends_with_async.required_suffix = Async
|
|
dotnet_naming_style.ends_with_async.capitalization = pascal_case
|
|
|
|
dotnet_naming_rule.interfaces_start_with_i.severity = warning
|
|
dotnet_naming_rule.interfaces_start_with_i.symbols = any_interface
|
|
dotnet_naming_rule.interfaces_start_with_i.style = starts_with_i
|
|
dotnet_naming_symbols.any_interface.applicable_kinds = interface
|
|
dotnet_naming_style.starts_with_i.required_prefix = I
|
|
dotnet_naming_style.starts_with_i.capitalization = pascal_case
|
|
|
|
# Constants and static readonly fields are PascalCase, per .NET convention. These rules must
|
|
# come before the camelCase rule below: the first matching rule wins, and a rule matching all
|
|
# private fields would otherwise force `const int Foo` to be named `foo`.
|
|
dotnet_naming_rule.constants_are_pascal_case.severity = warning
|
|
dotnet_naming_rule.constants_are_pascal_case.symbols = any_const_field
|
|
dotnet_naming_rule.constants_are_pascal_case.style = pascal_case_style
|
|
dotnet_naming_symbols.any_const_field.applicable_kinds = field
|
|
dotnet_naming_symbols.any_const_field.applicable_accessibilities = *
|
|
dotnet_naming_symbols.any_const_field.required_modifiers = const
|
|
|
|
dotnet_naming_rule.static_readonly_fields_are_pascal_case.severity = warning
|
|
dotnet_naming_rule.static_readonly_fields_are_pascal_case.symbols = static_readonly_field
|
|
dotnet_naming_rule.static_readonly_fields_are_pascal_case.style = pascal_case_style
|
|
dotnet_naming_symbols.static_readonly_field.applicable_kinds = field
|
|
dotnet_naming_symbols.static_readonly_field.applicable_accessibilities = *
|
|
dotnet_naming_symbols.static_readonly_field.required_modifiers = static, readonly
|
|
|
|
dotnet_naming_style.pascal_case_style.capitalization = pascal_case
|
|
|
|
# Private instance fields are camelCase.
|
|
dotnet_naming_rule.private_fields_are_camel_case.severity = warning
|
|
dotnet_naming_rule.private_fields_are_camel_case.symbols = private_field
|
|
dotnet_naming_rule.private_fields_are_camel_case.style = camel_case_style
|
|
dotnet_naming_symbols.private_field.applicable_kinds = field
|
|
dotnet_naming_symbols.private_field.applicable_accessibilities = private
|
|
dotnet_naming_style.camel_case_style.capitalization = camel_case
|
|
|
|
#### Diagnostics ####
|
|
|
|
# Formatting violations fail the build; `dotnet format --verify-no-changes` gates CI.
|
|
dotnet_diagnostic.IDE0055.severity = error
|
|
|
|
# ConfigureAwait is not meaningful in ASP.NET Core (no SynchronizationContext). It IS
|
|
# meaningful in the Avalonia client, which re-enables CA2007 in its own .editorconfig.
|
|
dotnet_diagnostic.CA2007.severity = none
|
|
|
|
# Prefer LoggerMessage source generation over ILogger extension calls — allocation-free
|
|
# and gives structured events by construction. Warning, so it is visible but not a wall
|
|
# during early development; raised to error once the logging pass lands in M4.
|
|
dotnet_diagnostic.CA1848.severity = warning
|
|
|
|
# Exceptions carry ProblemDetails codes, not localised text.
|
|
dotnet_diagnostic.CA1303.severity = none
|
|
|
|
# CA1711 reserves the suffixes Flags, Permission, Collection, Stream and friends for
|
|
# .NET Framework CAS and BCL base types that have no bearing on this codebase. The BCL
|
|
# itself ships BindingFlags. PermissionFlags is the clearest name for a [Flags] enum of
|
|
# permissions, and contorting domain vocabulary to satisfy a legacy rule costs more than
|
|
# it returns.
|
|
dotnet_diagnostic.CA1711.severity = none
|
|
|
|
# CA1724 flags any type whose name collides with a BCL *namespace* (e.g. a type named
|
|
# Permissions vs System.Security.Permissions). Namespace-qualified resolution makes this
|
|
# a non-issue in practice and it heavily constrains domain naming.
|
|
dotnet_diagnostic.CA1724.severity = none
|
|
|
|
# MA0048 requires one type per file. Good for large types, actively worse for small DTO
|
|
# clusters: splitting SyncPullRequest from SyncPullResponse means a reviewer opens two files
|
|
# to understand one endpoint's contract. The BCL groups related types the same way.
|
|
dotnet_diagnostic.MA0048.severity = none
|
|
|
|
# We use file-scoped namespaces and modern C#; these fire on deliberate style choices.
|
|
dotnet_diagnostic.CA1812.severity = none # internal types instantiated by DI
|
|
dotnet_diagnostic.CA1849.severity = warning # sync call in async method
|
|
|
|
[tests/**/*.cs]
|
|
# Test classes are instantiated by xunit, and test data is often public static.
|
|
dotnet_diagnostic.CA1812.severity = none
|
|
dotnet_diagnostic.CA1034.severity = none
|
|
|
|
[src/DodoSSH.Infrastructure/Migrations/*.cs]
|
|
# EF Core generates these; do not lint or format them.
|
|
generated_code = true
|
|
dotnet_analyzer_diagnostic.severity = none
|
|
dotnet_diagnostic.IDE0055.severity = none
|
|
|
|
[*.{g,g.i,generated,designer}.cs]
|
|
# Source-generator output. In particular the System.Text.Json generator emits a public
|
|
# JsonTypeInfo member per serialisable type, which PublicApiAnalyzers would otherwise demand
|
|
# be tracked in PublicAPI.txt — hundreds of entries derived mechanically from the
|
|
# [JsonSerializable] list, drowning the entries that describe the actual wire contract.
|
|
generated_code = true
|
|
dotnet_analyzer_diagnostic.severity = none
|
|
dotnet_diagnostic.RS0016.severity = none
|
|
dotnet_diagnostic.RS0017.severity = none
|
|
dotnet_diagnostic.RS0041.severity = none
|
|
dotnet_diagnostic.IDE0055.severity = none
|