Repository navigation
Conversation
added 7 commits
November 3, 2026 18:09
English - Target net10.0 exclusively in the client and test projects; remove net8.0/net9.0 dependency branches and legacy authentication package references. - Upgrade runtime and test dependencies, and adapt MSTest 4 assertions and PasswordGenerator 3 test fixtures. - Scope RPT bearer tokens to individual HTTP requests so shared HttpClient defaults cannot contaminate subsequent callers. - Preserve organization JSON field names with Newtonsoft.Json and System.Text.Json mappings; correct the initial-access token creation assertion to HTTP 201. - Add regression coverage for request isolation, organization serialization, password generation, and JWT session parsing; update CI and documentation for .NET 10. Validation - Debug and Release solution builds passed. - Full .NET 10 suite against isolated Keycloak 26.8.1: 339 passed, 0 failed, and 5 existing version-specific skips (344 total). - Generated NuGet package contains only lib/net10.0 assets. - Dependency vulnerability scan and whitespace checks passed. 简体中文 - 客户端及测试项目统一仅支持 net10.0，删除 net8.0/net9.0 条件依赖分支及旧版认证包引用。 - 升级运行时与测试依赖，适配 MSTest 4 异常断言和 PasswordGenerator 3 测试数据生成接口。 - 将 RPT Bearer 令牌限定在单个 HTTP 请求中，修复共享 HttpClient 默认请求头污染后续用户请求的问题。 - 为组织模型保留 Newtonsoft.Json 与 System.Text.Json 两种字段映射，并将初始访问令牌创建断言修正为 HTTP 201。 - 新增请求隔离、组织序列化、密码生成及 JWT 会话解析回归测试，同步更新 .NET 10 的 CI 配置和文档。 验证结果 - Debug、Release 解决方案编译通过。 - 在隔离的 Keycloak 26.8.1 环境完整运行 .NET 10 测试：339 项通过、0 失败、5 项原有版本限制跳过，共 344 项。 - 生成的 NuGet 包仅包含 lib/net10.0 产物。 - 依赖漏洞扫描及空白检查通过。
Verify the existing .NET 10 client against Keycloak 26.8.1. Fix repeated UMA permissions, composite-role removal, resource serialization, and admin-token expiry, refresh fallback and concurrent renewal. Add optional request-scoped Basic client authentication while preserving Post. Add isolated security regressions, independent units, FGAP v1/v2 CI and a complete inventory/coverage gate for 178 public methods across 13 modules. 验证现有 .NET 10 客户端与 Keycloak 26.8.1 的兼容性。 修复多权限 UMA 请求、组合角色移除、资源序列化及管理员令牌续期。 新增可选 Basic 认证、隔离安全回归、独立单测、双配置 CI 和完整接口清单。 Validation / 验证: - Full local FGAP v1 suite: 434 passed, zero failures/skips. - Independent units without integration credentials: 54 passed (included above). - FGAP v2 targeted regressions: 31 passed, zero failures/skips. - Coverage: 99.65% lines, 83.72% branches; 178 declared methods executed. - NuGet direct/transitive vulnerability scan: no known vulnerable packages. - Linux/PostgreSQL GitHub CI remains pending the manually created PR.
Remove the legacy SLN solution, track the existing SLNX solution, update all five Cake solution references, and document the build entry point. 保留相同项目和功能代码。Validated Release solution build and 54 independent unit tests; zero test failures or skips.
Replace unsafe XML report parsing with defusedxml and reject DTDs/entities. Reduce the Python environment to required tools, retain python-keycloak for fixture scripts, and hash-lock the full dependency graph. Pin Ansible collections including the Docker collection's transitive helper. Validate Python 3.12/3.14, audit every locked pin without vulnerability exceptions, and retain separate FOSSA library/test inventories. Confirm the library inventory includes its restored transitive NuGet dependency graph. Keep fork builds and tests independent of Sonar credentials. Update obsolete Actions, protect generated secrets, and poll PostgreSQL/Keycloak readiness. Restore package metadata to the upstream project. No production API behavior changes; fix only the Linux analyzer formatting in one existing test. 修复 XML 解析告警，精简并锁定测试依赖，补充 Python 3.14 验证。 分别审计生产包与测试工具；修复 fork CI、旧版 Action 及环境启动时序。 保护生成的测试凭据，恢复上游包元数据，保持客户端功能行为不变。 Validation / 验证: - Linux .NET 10 + Keycloak 26.8.1/PostgreSQL 16: 434 passed per Python 3.12 and 3.14 fixture profile; zero failures/skips; 178 methods executed. - FGAP v2: 31 passed, zero failures/skips. - XML security regressions: 5 passed per Python version. - Coverage: 99.65% lines, 83.72% branches. - Both Python audits: all 26 pins, zero known vulnerabilities. - NuGet direct/transitive audit: no known vulnerable packages reported. - All workflow definitions pass local actionlint. - External LLM review was not completed; local/manual review used instead. - Upstream Actions approval and FOSSA license-policy review remain external.
Run the branch naming policy on synchronize events so each PR revision receives a current check. Run dependency consistency and XML security regressions in both Python audit jobs. Validated actionlint and both isolated Python environments.
Replace Python/Ansible/Make test infrastructure with BCL-only .NET 10 file-based applications and isolated Docker Compose services. Preserve Keycloak realm, client, role, scope and JavaScript policy fixtures in JSON. Keep client APIs and all existing MSTest scenarios unchanged. Remove Python manifests, helper tests and CI version matrices. Run native TRX/Cobertura security checks and direct/transitive NuGet audits instead. Update Cake, documentation and FOSSA test inventory; resolve CLI tools via PATH and mask Sonar credentials in process arguments. 使用仅依赖 .NET 基础类库的单文件应用和隔离 Docker Compose 环境， 替换 Python、Ansible、Make 工具链，保留原有客户端功能和 MSTest 场景。 迁移 Realm、客户端、角色、作用域和 JavaScript 策略配置，更新 CI、 Cake、双语说明和 FOSSA 清单，保留完整依赖与许可证审计。 Validation / 验证： - Keycloak 26.8.1 + PostgreSQL 16: 434/434 passed, zero failures/skips. - FGAP v2: 31/31 passed; independent MSTest category: 54/54 passed. - Native verifier: 22 regressions passed on Windows and Linux. - HTTP method coverage: 178/178 methods across 13 modules. - Coverage: 99.65% lines (3517/3529), 83.72% branches (494/590). - NuGet audit: no reported direct/transitive vulnerabilities. - Cake compile/tool checks, actionlint and staged credential checks passed. - FOSSA local profiles: production 25 deps/7 direct; tests 27 deps/8 direct. Refs Black-Cockpit#28.
Split native environment provisioning and NuGet audit validation into focused private helpers. Split optional user search filters out of BuildQuery while retaining query order, formatting and public behavior. Address all three CodeFactor method-complexity findings without exclusions. 拆分原生环境搭建、NuGet 审计和用户查询构造中的复杂方法， 保持公开接口、查询参数顺序、格式和既有功能不变。 通过真实回归验证，未增加复杂度或许可证忽略规则。 Validation / 验证： - Rebuilt .NET 10 Release; 434/434 full tests and 31/31 FGAP v2 tests pass. - All 178 HTTP methods executed; zero failed or skipped tests. - Coverage: 99.66% lines (3519/3531), 83.72% branches (494/590). - Native verifier: 22 regressions pass on Windows and Linux. - NuGet audit reports no vulnerabilities; workflow/static checks pass. - FOSSA scan 128535862: License scan passed, 15 direct dependencies; the previous seven flagged issues disappeared with the Python removal. Refs Black-Cockpit#28.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
English
Verify the existing client API surface against Keycloak 26.8.1 and target
.NET 10 exclusively for both the library and tests.
Changes:
Validation:
Scope:
This verifies the existing client surface, not every Keycloak server feature.
Local integration tests use dev mode/H2. Linux/PostgreSQL CI must pass before merge.
Legacy management-permission APIs require FGAP v1; v2 receives targeted regression coverage.
简体中文
完整验证现有客户端接口与 Keycloak 26.8.1 的兼容性，
客户端库和测试项目统一仅支持 .NET 10。
修改内容：
验证结果：
范围说明：
本次验收覆盖已有客户端功能，不代表覆盖 Keycloak 全部服务端功能。
本地集成测试使用开发模式/H2，合并前需通过 Linux/PostgreSQL CI。
旧版管理权限接口依赖 FGAP v1；FGAP v2 已进行专项回归验证。