feat(aspnetcore): warn at startup when the API is mapped with no auth (#227)

Auth inherits from the host (ADR D20) and the engine imposes no default — but a
host that just calls MapNeoReports() with no authentication configured and
without setting RequireAuthorization exposes the whole report-management surface
(trigger runs, register reports, store source connection strings, mutate
schedules, download artifacts) unauthenticated. That is a valid deployment only
behind a trusted boundary.

MapNeoReports now logs a single Warning at mapping time when RequireAuthorization
is not set AND no IAuthenticationSchemeProvider is registered (i.e. the host
called neither AddAuthentication nor RequireAuthorization), so the unauthenticated
posture is a deliberate choice rather than a silent default. The default behaviour
is unchanged (still no imposed auth), so this is non-breaking; the warning stays
quiet whenever the host has any authentication configured.

Tests cover all three cases: warns with no auth, silent with AddAuthentication,
silent with RequireAuthorization=true.

Author: thiagoluga

src/Integrations/NeoReports.AspNetCore/NeoReportsEndpointRouteBuilderExtensions.cs

@@ -1,6 +1,7 @@
 using System.Globalization;
 using System.IO.Compression;
 using System.Text.Json;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -81,6 +82,23 @@ public static RouteGroupBuilder MapNeoReports(
             else
                 group.RequireAuthorization(options.AuthorizationPolicy);
         }
+        else if (endpoints.ServiceProvider.GetService<IAuthenticationSchemeProvider>() is null)
+        {
+            // Auth inherits from the host (ADR D20) — the engine does not impose a default. But when
+            // no authentication is configured on the host at all AND RequireAuthorization was not set,
+            // this management surface (trigger runs, register reports, store source connection
+            // strings, mutate schedules, download artifacts) is reachable unauthenticated. That is a
+            // valid deployment only behind a trusted boundary; warn once at startup so it is a
+            // deliberate choice, not a silent default.
+            endpoints.ServiceProvider.GetService<ILoggerFactory>()?
+                .CreateLogger("NeoReports.AspNetCore")
+                .LogWarning(
+                    "NeoReports endpoints mapped at '{Prefix}' with no authentication configured on the host and " +
+                    "NeoReportsEndpointOptions.RequireAuthorization not set — the report management API is reachable " +
+                    "unauthenticated. Configure the host's authentication/authorization (or set RequireAuthorization) " +
+                    "before exposing it beyond a trusted network.",
+                    prefix);
+        }
 
         // Compiling a report — Create and Validate below — must resolve IConfigSourceProvider
         // (and, for a Ref-based source, ISourceRegistry) through the app's ROOT provider, never

tests/NeoReports.AspNetCore.IntegrationTests/AuthWarningTests.cs

@@ -0,0 +1,96 @@
+using System.Collections.Concurrent;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using NeoReports.AspNetCore;
+using NeoReports.Core.Building;
+using NeoReports.Core.DependencyInjection;
+using Shouldly;
+using Xunit;
+using static NeoReports.Core.Building.ReportColumns;
+using static NeoReports.Formats.Csv.Format;
+
+namespace NeoReports.AspNetCore.IntegrationTests;
+
+public class AuthWarningTests
+{
+    private static async Task<IReadOnlyCollection<string>> WarningsFromMapping(
+        Action<IServiceCollection>? extraServices, Action<NeoReportsEndpointOptions>? options)
+    {
+        var capture = new CapturingLoggerProvider();
+        using var host = await new HostBuilder()
+            .ConfigureWebHost(web =>
+            {
+                web.UseTestServer();
+                web.ConfigureServices(services =>
+                {
+                    services.AddRouting();
+                    services.AddLogging(b => b.AddProvider(capture));
+                    services.AddReport<Sale>("sales", b => b
+                        .From(new InMemorySource(rows: 1, pageSize: 10))
+                        .Column(v => v.Id, "ID")
+                        .To(Csv(o => o.Delimiter(';'))));
+                    extraServices?.Invoke(services);
+                })
+                .Configure(app =>
+                {
+                    app.UseRouting();
+                    app.UseEndpoints(e => e.MapNeoReports("/api", options));
+                });
+            })
+            .StartAsync();
+
+        return capture.Warnings;
+    }
+
+    [Fact]
+    public async Task Warns_when_mapped_without_auth_and_no_authentication_configured()
+    {
+        var warnings = await WarningsFromMapping(extraServices: null, options: null);
+        warnings.ShouldContain(w => w.Contains("reachable", StringComparison.Ordinal) && w.Contains("/api", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task Does_not_warn_when_the_host_has_authentication_configured()
+    {
+        var warnings = await WarningsFromMapping(
+            extraServices: s => s.AddAuthentication(), options: null);
+        warnings.ShouldNotContain(w => w.Contains("reachable unauthenticated", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public async Task Does_not_warn_when_authorization_is_required()
+    {
+        var warnings = await WarningsFromMapping(
+            extraServices: s => s.AddAuthorizationBuilder(),
+            options: o => o.RequireAuthorization = true);
+        warnings.ShouldNotContain(w => w.Contains("reachable unauthenticated", StringComparison.Ordinal));
+    }
+
+    private sealed class CapturingLoggerProvider : ILoggerProvider
+    {
+        public ConcurrentBag<string> Warnings { get; } = [];
+
+        public ILogger CreateLogger(string categoryName) => new CapturingLogger(Warnings);
+
+        public void Dispose() { }
+
+        private sealed class CapturingLogger(ConcurrentBag<string> warnings) : ILogger
+        {
+            public IDisposable? BeginScope<TState>(TState state)
+                where TState : notnull => null;
+
+            public bool IsEnabled(LogLevel logLevel) => logLevel >= LogLevel.Warning;
+
+            public void Log<TState>(
+                LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
+            {
+                if (logLevel >= LogLevel.Warning)
+                    warnings.Add(formatter(state, exception));
+            }
+        }
+    }
+}