Updates dependencies and refines API endpoint documentation#89
Conversation
Updates .NET SDK to 10.0.202 and bumps several NuGet packages, including Microsoft.Extensions and EFCore.BulkExtensions. This change also: - Configures central package management updates in Directory.Packages.props. - Enhances API documentation by adding explicit return types to endpoint `Produces` metadata. - Refactors health check registration into the IoC layer for better separation of concerns. - Updates the .editorconfig to silence async naming warnings in test projects. - Removes the Callstack.ai PR review workflow.
jldsilva
added
.NET
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 22 minutes and 48 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (10)
WalkthroughAtualização de dependências, configuração de regras de edição e infraestrutura. Inclui bump de versões de pacotes NuGet (MSTest 4.2.1, Microsoft.AspNetCore 10.0.6, Mapster 10.0.7 e outros), refatoração de verificações de saúde para o contenedor IoC, metadados de resposta OpenAPI mais específicos em endpoints, e remoção de fluxo de trabalho do GitHub Actions. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
InvoiceReminder.API/Endpoints/UserEndpoints.cs (1)
27-37:⚠️ Potential issue | 🟠 MajorEvite publicar
UserViewModelcomo contrato de resposta dos GETs.Esses
.Produces<UserViewModel>documentam tambémUserPassword.PasswordHasheUserPassword.PasswordSalt, conformeInvoiceReminder.Application/ViewModels/UserViewModel.cseUserPasswordViewModel.cs. Use um DTO de resposta sanitizado, sem dados de credencial, para estes endpoints.Also applies to: 45-55, 64-75
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@InvoiceReminder.API/Endpoints/UserEndpoints.cs` around lines 27 - 37, The endpoints currently publish UserViewModel (see endpoint.MapGet("/") and other MapGet/MapGetById handlers that call IUserAppService.GetAll()/GetById()/GetCurrent()) which exposes sensitive fields UserPassword.PasswordHash and UserPassword.PasswordSalt; create a sanitized response DTO (e.g., UserResponseDto without any credential fields), map the returned UserViewModel(s) to this DTO before returning (or update the app service to return the DTO), and change the .Produces<> on the MapGet handlers to use the new sanitized DTO type so credentials are not documented or returned.
🧹 Nitpick comments (5)
InvoiceReminder.API/Program.cs (1)
13-14: Considere usarIConfigureOptions<JwtBearerOptions>em vez deIConfigureNamedOptions.
JwtBearerOptionsSetupimplementaIConfigureNamedOptions<JwtBearerOptions>, mas o métodoConfigure(string name, JwtBearerOptions options)ignora o parâmetronamee aplica a mesma configuração independentemente do esquema. Embora funcione corretamente no contexto atual (um único esquema JWT registrado porAddJwtBearer()sem parâmetros), esse padrão é problemático: se múltiplos esquemas JWT forem adicionados no futuro, a mesma configuração seria aplicada a todos eles, possivelmente de forma não intencional. Recomenda-se implementarIConfigureOptions<JwtBearerOptions>diretamente, ou tratar o parâmetronameadequadamente se a intenção for suportar múltiplos esquemas com configurações distintas.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@InvoiceReminder.API/Program.cs` around lines 13 - 14, JwtBearerOptionsSetup currently implements IConfigureNamedOptions<JwtBearerOptions> but its Configure(string name, JwtBearerOptions options) ignores the name and applies the same settings to every scheme; update JwtBearerOptionsSetup to either implement IConfigureOptions<JwtBearerOptions> (so configuration is applied globally) or modify Configure(string name, JwtBearerOptions options) to check the provided name and only apply settings for the intended scheme (e.g., compare against the scheme name used in AddJwtBearer), ensuring future multiple JWT schemes aren’t inadvertently configured the same way.InvoiceReminder.CrossCutting.IoC/InvoiceReminder.CrossCutting.IoC.csproj (1)
12-12: Considere atualizar a versão doAspNetCore.HealthChecks.NpgSql.O pacote foi corretamente adicionado ao
Directory.Packages.propscom versão9.0.0. No entanto, essa versão foi construída para .NET 8.0 e .NET Standard 2.0, não tendo suporte explícito para .NET 10. Embora funcione por retrocompatibilidade, considere verificar se existe uma versão mais recente que tenha suporte nativo para .NET 10 para garantir otimizações e compatibilidade total com o target framework do projeto.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@InvoiceReminder.CrossCutting.IoC/InvoiceReminder.CrossCutting.IoC.csproj` at line 12, O PackageReference "AspNetCore.HealthChecks.NpgSql" foi adicionado sem especificar uma versão adequada para .NET 10; verifique e atualize a versão definida em Directory.Packages.props (atualmente 9.0.0) para uma release que declare suporte nativo a .NET 10 (ou a versão mais recente disponível), atualizar o valor correspondente para o PackageReference Include="AspNetCore.HealthChecks.NpgSql", executar dotnet restore e dotnet build para validar compatibilidade e executar testes de integração que usem HealthChecks para garantir que não haja regressões.InvoiceReminder.CrossCutting.IoC/DependencyInjectionConfig.cs (1)
105-106: RefatoreAddHealthCheckpara usar o factory pattern em vez deBuildServiceProvider().Construir um
ServiceProvidertemporário durante o registro de serviços cria um container paralelo, duplica singletons e dispara o aviso ASP0000. ComoAddNpgSqlaceita umconnectionStringFactoryque resolve a string de conexão peloIServiceProviderreal no momento da execução, use esse padrão em vez de resolver imediatamente durante o registro.♻️ Exemplo de refactor
private static IServiceCollection AddHealthCheck(this IServiceCollection services) { - using var scope = services.BuildServiceProvider().CreateScope(); - var configuration = scope.ServiceProvider.GetRequiredService<IConfigurationService>(); - - _ = services.AddHealthChecks().AddNpgSql - ( - connectionString: configuration.GetConnectionString("DataBaseConnection"), + _ = services.AddHealthChecks().AddNpgSql( + connectionStringFactory: sp => sp.GetRequiredService<IConfigurationService>() + .GetConnectionString("DatabaseConnection"), name: "postgres", healthQuery: "SELECT 1;", tags: ["db", "sql", "critical"], - failureStatus: HealthStatus.Unhealthy - ); + failureStatus: HealthStatus.Unhealthy); return services; }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@InvoiceReminder.CrossCutting.IoC/DependencyInjectionConfig.cs` around lines 105 - 106, O trecho que cria um ServiceProvider temporário (services.BuildServiceProvider()) e resolve IConfigurationService deve ser removido; em vez disso refatore a chamada que adiciona o health check (onde AddNpgSql é usado) para passar um connectionStringFactory delegate que recebe o IServiceProvider e resolve IConfigurationService no momento da execução (por exemplo, use connectionStringFactory: sp => sp.GetRequiredService<IConfigurationService>().GetConnectionString(...)); assim evite duplicar singletons e o aviso ASP0000 e mantenha a resolução de configuração no container real sem criar um provedor temporário.global.json (1)
2-7: Considere centralizar a versão doMSTest.Sdknoglobal.json.A versão
MSTest.Sdk/4.2.1está repetida em 8 projetos de teste. Oglobal.jsonpode centralizar SDKs MSBuild via NuGet usandomsbuild-sdks, evitando duplicação e próximos bumps em múltiplos.csproj. A documentação do .NET descreve essa prática: https://learn.microsoft.com/en-us/dotnet/core/project-sdk/overview♻️ Possível ajuste
{ "sdk": { "version": "10.0.202" }, + "msbuild-sdks": { + "MSTest.Sdk": "4.2.1" + }, "test": { "runner": "Microsoft.Testing.Platform" } }Depois, remova a versão dos projetos de teste:
-<Project Sdk="MSTest.Sdk/4.2.1"> +<Project Sdk="MSTest.Sdk">Aplicar em:
InvoiceReminder.UnitTests.Infrastructure,InvoiceReminder.UnitTests.Domain,InvoiceReminder.UnitTests.JobScheduler,InvoiceReminder.UnitTests.ExternalServices,InvoiceReminder.UnitTests.Application,InvoiceReminder.IntegrationTests,InvoiceReminder.UnitTests.API,InvoiceReminder.ArchitectureTests.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@global.json` around lines 2 - 7, Resumo: centralizar a versão do MSTest.Sdk no global.json para evitar duplicação. Edite global.json adicionando a seção "msbuild-sdks" com a entrada "MSTest.Sdk": "4.2.1" (ou a versão desejada) e remova a declaração explícita de Version/MSTest.Sdk dos arquivos .csproj dos projetos de teste listados (InvoiceReminder.UnitTests.Infrastructure, InvoiceReminder.UnitTests.Domain, InvoiceReminder.UnitTests.JobScheduler, InvoiceReminder.UnitTests.ExternalServices, InvoiceReminder.UnitTests.Application, InvoiceReminder.IntegrationTests, InvoiceReminder.UnitTests.API, InvoiceReminder.ArchitectureTests) para que eles herdem a versão centralizada; verifique que o arquivo global.json mantenha a chave "sdk" existente e valide a solução com dotnet restore/build após a mudança.InvoiceReminder.Application/AppServices/UserAppService.cs (1)
92-92: Padronize a mensagem de erro para maior clareza.Em Line 92, vale considerar um texto mais natural e consistente (ex.:
Failure while updating user.), já que essa mensagem pode chegar direto ao cliente da API.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@InvoiceReminder.Application/AppServices/UserAppService.cs` at line 92, Update the failure message in the Result<UserViewModel>.Failure call inside UserAppService (the update user flow) to a more natural, consistent text such as "Failure while updating user." — locate the Result<UserViewModel>.Failure(...) expression (currently "Failure on updating User") and replace the string with the standardized message so API clients receive a clearer, consistent error text.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@InvoiceReminder.API/appsettings.json`:
- Around line 5-6: Revert the log level for the "Microsoft" and
"Microsoft.AspNetCore" categories back to "Warning" in appsettings.json to avoid
noisy or sensitive production logs, and move or add the more verbose
"Information" settings into appsettings.Development.json (or define more
specific sub-categories instead of broad "Microsoft") so that Information-level
logs only appear in development; update the JSON keys "Microsoft" and
"Microsoft.AspNetCore" accordingly and ensure your environment-specific
configuration is loaded for development.
In `@InvoiceReminder.API/InvoiceReminder.http`:
- Around line 49-51: O exemplo de payload usa um passwordHash inválido e omite
passwordSalt; atualize todos os exemplos que preenchem UserPasswordViewModel
(incluindo as ocorrências mencionadas) para incluir a propriedade passwordSalt e
fornecer um passwordHash com pelo menos 8 caracteres válidos; localize a
estrutura que instancia UserPasswordViewModel / campos "userPassword",
"passwordHash" e adicione "passwordSalt" junto ao hash (por exemplo um hash de
exemplo de comprimento >=8) para que os exemplos funcionem ao serem copiados
para testes.
In `@InvoiceReminder.CrossCutting.IoC/DependencyInjectionConfig.cs`:
- Around line 103-118: Fix the mismatched connection-string key in
AddHealthCheck: inside the AddHealthCheck extension method update the
GetConnectionString call used in AddNpgSql so it uses "DatabaseConnection" (same
spelling as used by AddDbContext and appsettings) instead of
"DataBaseConnection", ensuring
configuration.GetConnectionString("DatabaseConnection") returns the real
connection string and prevents a null connectionString at runtime.
---
Outside diff comments:
In `@InvoiceReminder.API/Endpoints/UserEndpoints.cs`:
- Around line 27-37: The endpoints currently publish UserViewModel (see
endpoint.MapGet("/") and other MapGet/MapGetById handlers that call
IUserAppService.GetAll()/GetById()/GetCurrent()) which exposes sensitive fields
UserPassword.PasswordHash and UserPassword.PasswordSalt; create a sanitized
response DTO (e.g., UserResponseDto without any credential fields), map the
returned UserViewModel(s) to this DTO before returning (or update the app
service to return the DTO), and change the .Produces<> on the MapGet handlers to
use the new sanitized DTO type so credentials are not documented or returned.
---
Nitpick comments:
In `@global.json`:
- Around line 2-7: Resumo: centralizar a versão do MSTest.Sdk no global.json
para evitar duplicação. Edite global.json adicionando a seção "msbuild-sdks" com
a entrada "MSTest.Sdk": "4.2.1" (ou a versão desejada) e remova a declaração
explícita de Version/MSTest.Sdk dos arquivos .csproj dos projetos de teste
listados (InvoiceReminder.UnitTests.Infrastructure,
InvoiceReminder.UnitTests.Domain, InvoiceReminder.UnitTests.JobScheduler,
InvoiceReminder.UnitTests.ExternalServices,
InvoiceReminder.UnitTests.Application, InvoiceReminder.IntegrationTests,
InvoiceReminder.UnitTests.API, InvoiceReminder.ArchitectureTests) para que eles
herdem a versão centralizada; verifique que o arquivo global.json mantenha a
chave "sdk" existente e valide a solução com dotnet restore/build após a
mudança.
In `@InvoiceReminder.API/Program.cs`:
- Around line 13-14: JwtBearerOptionsSetup currently implements
IConfigureNamedOptions<JwtBearerOptions> but its Configure(string name,
JwtBearerOptions options) ignores the name and applies the same settings to
every scheme; update JwtBearerOptionsSetup to either implement
IConfigureOptions<JwtBearerOptions> (so configuration is applied globally) or
modify Configure(string name, JwtBearerOptions options) to check the provided
name and only apply settings for the intended scheme (e.g., compare against the
scheme name used in AddJwtBearer), ensuring future multiple JWT schemes aren’t
inadvertently configured the same way.
In `@InvoiceReminder.Application/AppServices/UserAppService.cs`:
- Line 92: Update the failure message in the Result<UserViewModel>.Failure call
inside UserAppService (the update user flow) to a more natural, consistent text
such as "Failure while updating user." — locate the
Result<UserViewModel>.Failure(...) expression (currently "Failure on updating
User") and replace the string with the standardized message so API clients
receive a clearer, consistent error text.
In `@InvoiceReminder.CrossCutting.IoC/DependencyInjectionConfig.cs`:
- Around line 105-106: O trecho que cria um ServiceProvider temporário
(services.BuildServiceProvider()) e resolve IConfigurationService deve ser
removido; em vez disso refatore a chamada que adiciona o health check (onde
AddNpgSql é usado) para passar um connectionStringFactory delegate que recebe o
IServiceProvider e resolve IConfigurationService no momento da execução (por
exemplo, use connectionStringFactory: sp =>
sp.GetRequiredService<IConfigurationService>().GetConnectionString(...)); assim
evite duplicar singletons e o aviso ASP0000 e mantenha a resolução de
configuração no container real sem criar um provedor temporário.
In `@InvoiceReminder.CrossCutting.IoC/InvoiceReminder.CrossCutting.IoC.csproj`:
- Line 12: O PackageReference "AspNetCore.HealthChecks.NpgSql" foi adicionado
sem especificar uma versão adequada para .NET 10; verifique e atualize a versão
definida em Directory.Packages.props (atualmente 9.0.0) para uma release que
declare suporte nativo a .NET 10 (ou a versão mais recente disponível),
atualizar o valor correspondente para o PackageReference
Include="AspNetCore.HealthChecks.NpgSql", executar dotnet restore e dotnet build
para validar compatibilidade e executar testes de integração que usem
HealthChecks para garantir que não haja regressões.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2219486c-dd01-4a1e-a51b-89ed7dafe8f3
📒 Files selected for processing (25)
.editorconfig.github/workflows/callstack-reviewer.ymlDirectory.Packages.propsInvoiceReminder.API/Endpoints/InvoiceEndpoints.csInvoiceReminder.API/Endpoints/JobScheduleEndpoints.csInvoiceReminder.API/Endpoints/ScanEmailDefinitionEndpoints.csInvoiceReminder.API/Endpoints/UserEndpoints.csInvoiceReminder.API/InvoiceReminder.API.csprojInvoiceReminder.API/InvoiceReminder.httpInvoiceReminder.API/Program.csInvoiceReminder.API/appsettings.jsonInvoiceReminder.Application/AppServices/UserAppService.csInvoiceReminder.ArchitectureTests/InvoiceReminder.ArchitectureTests.csprojInvoiceReminder.CrossCutting.IoC/DependencyInjectionConfig.csInvoiceReminder.CrossCutting.IoC/InvoiceReminder.CrossCutting.IoC.csprojInvoiceReminder.Data/InvoiceReminder.Data.csprojInvoiceReminder.IntegrationTests/InvoiceReminder.IntegrationTests.csprojInvoiceReminder.UnitTests.API/InvoiceReminder.UnitTests.API.csprojInvoiceReminder.UnitTests.Application/AppServices/UserAppServiceTests.csInvoiceReminder.UnitTests.Application/InvoiceReminder.UnitTests.Application.csprojInvoiceReminder.UnitTests.Domain/InvoiceReminder.UnitTests.Domain.csprojInvoiceReminder.UnitTests.ExternalServices/InvoiceReminder.UnitTests.ExternalServices.csprojInvoiceReminder.UnitTests.Infrastructure/InvoiceReminder.UnitTests.Infrastructure.csprojInvoiceReminder.UnitTests.JobScheduler/InvoiceReminder.UnitTests.JobScheduler.csprojglobal.json
💤 Files with no reviewable changes (2)
- InvoiceReminder.API/InvoiceReminder.API.csproj
- .github/workflows/callstack-reviewer.yml
Moves the MSTest.Sdk version to global.json to manage it centrally across all test projects. Additionally, refactors the health check registration in DependencyInjectionConfig to use a connection string factory. This avoids building the service provider during the service registration phase, preventing potential side effects and performance issues.
1 participant
Updates .NET SDK to 10.0.202 and bumps several NuGet packages, including Microsoft.Extensions and EFCore.BulkExtensions.
This change also:
Producesmetadata.Summary by CodeRabbit
Notas de Lançamento
Novos Recursos
Melhorias
Chores