Feature/keycloak 26 8 1 support

.editorconfig

@@ -514,7 +514,3 @@ indent_size = 4
 [*.sh]
 indent_size = 4
 end_of_line = lf
-
-[**/*.venv/**/*.cs]
-ignore = true
-generated_code = true

.fossa-tests.yml

@@ -0,0 +1,9 @@
+version: 3
+
+# Use a separate FOSSA test-infrastructure project/revision with this config.
+# Test tooling uses .NET 10 file-based applications with BCL-only dependencies.
+# Inventory restored test NuGet dependencies, including transitives.
+targets:
+  only:
+    - type: nuget
+      path: NETCore.Keycloak.Client.Tests/obj

.fossa.yml

@@ -1,18 +1,17 @@
-version: 1
+version: 3
 
-analysis:
-  # Paths to exclude from license/security analysis (relative to repo root)
-  ignorePaths:
-  - "NETCore.Keycloak.Client.Tests/**"
-  # Specific package locators to ignore (use exact locator shown by FOSSA)
-  ignorePackages:
-  - "pip+ansible$13.2.0"
-  - "pip+ansible-core$2.17.7"
-  - "nuget+Microsoft.NET.Test.Sdk$17.6.0"
-
-# Notes:
-# - Commit and push this file and then trigger a new FOSSA scan so the server-side
-#   analysis picks up the repo-level exclusions. Local changes alone won't modify
-#   the existing project findings until FOSSA re-analyzes the repository.
-# - If your organization manages FOSSA centrally, you may need to update project
-#   settings in the FOSSA UI instead of relying on this file.
+# Run dotnet restore NETCore.Keycloak.slnx before CLI analysis. The NuGet
+# analyzer reads obj/project.assets.json, so do not exclude that directory.
+# Published library scope. Test infrastructure has its own inventory in
+# .fossa-tests.yml and is also audited in the compatibility workflow.
+# Select these scopes in FOSSA Quick Import if that integration does not
+# consume CLI configuration; changing this file alone does not change policy.
+paths:
+  only:
+    - NETCore.Keycloak.Client
+  exclude:
+    - "**/bin/**"
+targets:
+  exclude:
+    # Generated package manifests duplicate the restored project graph.
+    - type: nuspec

.github/workflows/branch_naming_policy.yml

@@ -7,12 +7,13 @@ on:
     types:
       - opened
       - reopened
+      - synchronize
 jobs:
   branch-naming-policy:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Extract branch name
         shell: bash
@@ -30,4 +31,4 @@ jobs:
           PR_NUMBER: ${{ github.event.number }}
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh pr close "$PR_NUMBER" -c "Pull request has been closed due the breach of branch naming policy" -d
+          gh pr close "$PR_NUMBER" -c "Pull request has been closed due the breach of branch naming policy" -d

.github/workflows/build_test_analyze.yml

@@ -12,6 +12,9 @@ on:
       - edited
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   # Build test and analyze source code
   build_test_analyze:
@@ -25,44 +28,59 @@ jobs:
 
       # Setup OpenJDK
       - name: Setup OpenJDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
-          distribution: "adopt"
+          distribution: "temurin"
           java-version: ${{ matrix.java-version }}
 
-      # Setup Python
-      - name: Setup Python
-        uses: actions/setup-python@v5
+      # Install the supported .NET SDK
+      - name: Install .NET 10 SDK
+        uses: actions/setup-dotnet@v4
         with:
-          python-version: '3.12'
+          dotnet-version: 10.0.x
 
-      # Install all required .NET SDK versions
-      - name: Install .NET SDKs (8.0, 9.0 and 10.0)
-        uses: actions/setup-dotnet@v1
-        with:
-          dotnet-version: |
-            8.0.x
-            9.0.x
-            10.0.x
+      - name: Build and test without repository secrets
+        run: |
+          cp LICENSE NETCore.Keycloak.Client/
+          dotnet build NETCore.Keycloak.slnx --configuration Release
+          dotnet test NETCore.Keycloak.slnx --configuration Release --no-build \
+            --filter 'TestCategory=CoverageUnit' --logger 'trx;LogFileName=unit.trx' \
+            --results-directory NETCore.Keycloak.Client.Tests/obj/build-verification
 
-      # Install dependencies
+      - name: Detect Sonar analysis availability
+        id: sonar
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        shell: bash
+        run: |
+          if [[ -n "$SONAR_TOKEN" ]]; then
+            echo 'available=true' >> "$GITHUB_OUTPUT"
+          else
+            echo 'available=false' >> "$GITHUB_OUTPUT"
+            echo '::notice::Sonar analysis requires an upstream secret. Build/unit tests and the independent compatibility workflow still run.'
+          fi
+
+      # Sonar credentials are unavailable to fork pull requests.
       - name: Install dependencies
+        if: steps.sonar.outputs.available == 'true'
         run: |
-          sudo apt install -y make python3-rpm
           dotnet tool install --global dotnet-sonarscanner
           dotnet tool install --global Cake.Tool
           dotnet tool install --global JetBrains.dotCover.CommandLineTools
 
       # Build test and analyze the project
       - name: Build test and analyze the project
-        if: success()
+        if: steps.sonar.outputs.available == 'true'
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          VIRTUAL_ENV_DIR: keycloak.venv
         run: |
           # Copy Licence
           cp LICENSE NETCore.Keycloak.Client/
 
           # Build, test and analyze project with keycloak version 26
           cd NETCore.Keycloak.Client.Tests
-          dotnet cake build_test_analyse.cake --kc_major_version=26 --sonar_token=${SONAR_TOKEN}
+          dotnet cake build_test_analyse.cake --kc_major_version=26 --sonar_token="${SONAR_TOKEN}"
+
+      - name: Stop the managed Sonar test environment
+        if: always() && steps.sonar.outputs.available == 'true'
+        run: dotnet run --file tools/KeycloakTestEnvironment.cs -- down

.github/workflows/deploy.yml

@@ -5,6 +5,9 @@ on:
       - closed
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   # Deploy nuget package when a branch is labeled with `release` and the merge is done to master, or when triggered manually.
   Deploy:
@@ -19,7 +22,7 @@ jobs:
 
       # Setup .NET SDK
       - name: Set up .NET SDK ${{ matrix.dotnet-version }}
-        uses: actions/setup-dotnet@v1
+        uses: actions/setup-dotnet@v4
         with:
           dotnet-version: ${{ matrix.dotnet-version }}
 

.github/workflows/keycloak_2681.yml

@@ -0,0 +1,91 @@
+name: Keycloak 26.8.1 compatibility
+
+on:
+  pull_request:
+    branches: [master]
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  unit:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+      - name: Verify native report-parser security boundaries
+        run: dotnet run --file tools/VerifyTestResults.cs -- --self-test
+      - name: Audit direct and transitive NuGet dependencies
+        run: |
+          dotnet restore NETCore.Keycloak.slnx
+          mkdir -p NETCore.Keycloak.Client.Tests/obj/dependency-audit
+          dotnet list NETCore.Keycloak.slnx package --vulnerable --include-transitive --format json \
+            > NETCore.Keycloak.Client.Tests/obj/dependency-audit/nuget.json
+          dotnet run --file tools/VerifyTestResults.cs -- \
+            --audit-json NETCore.Keycloak.Client.Tests/obj/dependency-audit/nuget.json
+      - name: Run independent coverage unit tests
+        run: |
+          dotnet test NETCore.Keycloak.Client.Tests/NETCore.Keycloak.Client.Tests.csproj \
+            --configuration Release --filter 'TestCategory=CoverageUnit' --collect 'XPlat Code Coverage' \
+            --logger 'trx;LogFileName=unit.trx' --results-directory NETCore.Keycloak.Client.Tests/obj/unit-verification
+          dotnet run --file tools/VerifyTestResults.cs -- NETCore.Keycloak.Client.Tests/obj/unit-verification
+      - name: Upload unit reports and dependency audit
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: independent-unit-tests
+          path: |
+            NETCore.Keycloak.Client.Tests/obj/unit-verification/**/*.trx
+            NETCore.Keycloak.Client.Tests/obj/unit-verification/**/coverage.cobertura.xml
+            NETCore.Keycloak.Client.Tests/obj/dependency-audit/nuget.json
+  compatibility:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        fgap: [v1, v2]
+    env:
+      KC_FGAP_VERSION: ${{ matrix.fgap }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+      - name: Prepare isolated Keycloak 26.8.1 environment
+        run: dotnet run --file tools/KeycloakTestEnvironment.cs -- up --fgap "$KC_FGAP_VERSION"
+      - name: Run complete suite or FGAP v2 regressions
+        shell: bash
+        run: |
+          filter=()
+          if [[ "$KC_FGAP_VERSION" == "v2" ]]; then
+            # Legacy /management/permissions APIs require FGAP v1 and are covered by the full v1 job.
+            filter=(--filter 'TestCategory=Keycloak2681&TestCategory!=LegacyAdminPermissions')
+          fi
+          dotnet test NETCore.Keycloak.Client.Tests/NETCore.Keycloak.Client.Tests.csproj --framework net10.0 --configuration Release \
+            "${filter[@]}" --logger 'trx;LogFileName=keycloak-26.8.1.trx' \
+            --results-directory "NETCore.Keycloak.Client.Tests/obj/keycloak-26.8.1/$KC_FGAP_VERSION" --collect 'XPlat Code Coverage'
+          coverage_check=()
+          if [[ "$KC_FGAP_VERSION" == "v1" ]]; then
+            coverage_check=(--require-http-method-coverage)
+          fi
+          dotnet run --file tools/VerifyTestResults.cs -- \
+            "NETCore.Keycloak.Client.Tests/obj/keycloak-26.8.1/$KC_FGAP_VERSION" "${coverage_check[@]}"
+      - name: Upload test and coverage reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: keycloak-26.8.1-fgap-${{ matrix.fgap }}
+          path: |
+            NETCore.Keycloak.Client.Tests/obj/keycloak-26.8.1/**/*.trx
+            NETCore.Keycloak.Client.Tests/obj/keycloak-26.8.1/**/coverage.cobertura.xml
+          if-no-files-found: warn
+      - name: Stop the managed test environment
+        if: always()
+        run: dotnet run --file tools/KeycloakTestEnvironment.cs -- down

CONTRIBUTING.md

@@ -35,7 +35,7 @@ Examples:
 
 ### Pull Request Process
 
-1. Fork the repo and create your branch from `main` following the branch naming convention
+1. Fork the repo and create your branch from `master` following the branch naming convention
 2. Ensure your code follows the existing code style and formatting rules defined in `.editorconfig`
 3. Update the documentation if needed
 4. Ensure all tests pass

NETCore.Keycloak.Client.Tests/Abstraction/KcTestingModule.cs

@@ -564,6 +564,13 @@ protected void LoadConfiguration()
         TestEnvironment = JsonConvert.DeserializeObject<KcTestEnvironment>(sr.ReadToEnd());
 
         Assert.IsNotNull(TestEnvironment, "The test environment configuration must not be null.");
+
+        // Allows the same isolated regressions to run against separate FGAP v1 and v2 servers.
+        var baseUrl = Environment.GetEnvironmentVariable("KC_TEST_BASE_URL");
+        if ( !string.IsNullOrWhiteSpace(baseUrl) )
+        {
+            TestEnvironment.BaseUrl = baseUrl;
+        }
     }
 
     /// <summary>

NETCore.Keycloak.Client.Tests/ExceptionsTests/KcExecptionTests.cs

@@ -13,7 +13,7 @@
     /// Verifies that the exception is correctly identified.
     /// </summary>
     [TestMethod]
-    public void ShouldThrowKcException() => Assert.ThrowsException<KcException>(() => throw new KcException());
+    public void ShouldThrowKcException() => _ = Assert.ThrowsExactly<KcException>(() => throw new KcException());
 
     /// <summary>
     /// Tests that a <see cref="KcException"/> with a specified message retains the message correctly.
@@ -26,7 +26,7 @@
         var exception = new KcException("KcExceptionWithMessage");
 
         // Verify the exception message
         Assert.AreEqual(exception.Message, "KcExceptionWithMessage");
     }
 
     /// <summary>
@@ -39,10 +39,10 @@
         var exception = new KcException("KcExceptionWithInnerException", new ArgumentNullException());
 
         // Verify the exception message
         Assert.AreEqual(exception.Message, "KcExceptionWithInnerException");
 
         // Verify the inner exception
         Assert.IsNotNull(exception.InnerException);
-        Assert.IsInstanceOfType<ArgumentNullException>(exception.InnerException);
+        _ = Assert.IsInstanceOfType<ArgumentNullException>(exception.InnerException);
     }
 }

NETCore.Keycloak.Client.Tests/ExceptionsTests/KcSessionClosedExceptionTests.cs

@@ -14,7 +14,7 @@
     /// </summary>
     [TestMethod]
     public void ShouldThrowKcSessionClosedException() =>
-        Assert.ThrowsException<KcSessionClosedException>(() => throw new KcSessionClosedException());
+        _ = Assert.ThrowsExactly<KcSessionClosedException>(() => throw new KcSessionClosedException());
 
     /// <summary>
     /// Tests that a <see cref="KcSessionClosedException"/> with a specified message retains the message correctly.
@@ -26,7 +26,7 @@
         var exception = new KcSessionClosedException("KcSessionClosedExceptionWithMessage");
 
         // Verify the exception message
         Assert.AreEqual(exception.Message, "KcSessionClosedExceptionWithMessage");
     }
 
     /// <summary>
@@ -40,10 +40,10 @@
             new KcSessionClosedException("KcSessionClosedExceptionWithInnerException", new ArgumentNullException());
 
         // Verify the exception message
         Assert.AreEqual(exception.Message, "KcSessionClosedExceptionWithInnerException");
 
         // Verify the inner exception
         Assert.IsNotNull(exception.InnerException);
-        Assert.IsInstanceOfType<ArgumentNullException>(exception.InnerException);
+        _ = Assert.IsInstanceOfType<ArgumentNullException>(exception.InnerException);
     }
 }

NETCore.Keycloak.Client.Tests/ExceptionsTests/KcUserNotFoundExceptionTests.cs

@@ -14,7 +14,7 @@
     /// </summary>
     [TestMethod]
     public void ShouldThrowKcUserNotFoundException() =>
-        Assert.ThrowsException<KcUserNotFoundException>(() => throw new KcUserNotFoundException());
+        _ = Assert.ThrowsExactly<KcUserNotFoundException>(() => throw new KcUserNotFoundException());
 
     /// <summary>
     /// Tests that a <see cref="KcUserNotFoundException"/> with a specified message retains the message correctly.
@@ -26,7 +26,7 @@
         var exception = new KcUserNotFoundException("KcUserNotFoundExceptionWithMessage");
 
         // Verify the exception message
         Assert.AreEqual(exception.Message, "KcUserNotFoundExceptionWithMessage");
     }
 
     /// <summary>
@@ -40,10 +40,10 @@
             new KcUserNotFoundException("KcUserNotFoundExceptionWithInnerException", new ArgumentNullException());
 
         // Verify the exception message
         Assert.AreEqual(exception.Message, "KcUserNotFoundExceptionWithInnerException");
 
         // Verify the inner exception
         Assert.IsNotNull(exception.InnerException);
-        Assert.IsInstanceOfType<ArgumentNullException>(exception.InnerException);
+        _ = Assert.IsInstanceOfType<ArgumentNullException>(exception.InnerException);
     }
 }

NETCore.Keycloak.Client.Tests/Infrastructure/StubHttpTransport.cs

@@ -0,0 +1,18 @@
+using System.Net;
+using System.Text;
+
+namespace NETCore.Keycloak.Client.Tests.Infrastructure;
+
+internal sealed class StubHttpTransport(Func<HttpRequestMessage, Task<HttpResponseMessage>> respond)
+    : HttpMessageHandler, IHttpClientFactory
+{
+    public HttpClient CreateClient(string name) => new(this, disposeHandler: false);
+
+    protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,
+        CancellationToken cancellationToken) => respond(request);
+
+    public static HttpResponseMessage Json(string json, HttpStatusCode status = HttpStatusCode.OK) => new(status)
+    {
+        Content = new StringContent(json, Encoding.UTF8, "application/json")
+    };
+}