Preserve non-service parameters and harden POST binding source handling in OpenAPI metadata generation

src/Modules/Grand.Module.Api/ApiExplorer/MetadataApiDescriptionProvider.cs

@@ -17,12 +17,13 @@
 using Microsoft.AspNetCore.Routing.Template;
 using Microsoft.Extensions.Options;
 using System.Reflection;
+using System.Threading;
 
 namespace Grand.Module.Api.ApiExplorer;
 
 public class MetadataApiDescriptionProvider : IApiDescriptionProvider
 {
     private readonly MvcOptions _mvcOptions;
     private readonly ApiResponseTypeProvider _responseTypeProvider;
     private readonly RouteOptions _routeOptions;
     private readonly IModelMetadataProvider _modelMetadataProvider;
@@ -62,7 +63,7 @@
             {
                 var apiDescription = CreateApiDescription(action, httpMethod, apiGroup.GroupName);
                 context.Results.Add(apiDescription);
             };
         }
     }
 
@@ -101,11 +102,14 @@
         }
         return apiDescription;
     }
     private void AddGetParameters(ApiDescription apiDescription, ControllerActionDescriptor action)
     {
         var actionParameters = apiDescription.ActionDescriptor.Parameters;
         foreach (var param in actionParameters)
         {
+            if (IsServiceParameter(param))
+                continue;
+
             var paramType = param.ParameterType;
             if (!IsSimpleType(paramType))
             {
@@ -120,7 +124,11 @@
                         Name = property.Name,
                         ModelMetadata = _modelMetadataProvider.GetMetadataForType(property.PropertyType),
                         Source = BindingSource.Query,
-                        Type = property.PropertyType
+                        Type = property.PropertyType,
+                        ParameterDescriptor = new ParameterDescriptor {
+                            Name = property.Name,
+                            ParameterType = property.PropertyType
+                        }
                     });
                 }
             }
@@ -129,24 +137,50 @@
                     Name = param.Name,
                     ModelMetadata = GetModel(param),
                     Source = BindingSource.Query,
-                    Type = param.ParameterType
+                    Type = param.ParameterType,
+                    ParameterDescriptor = param
                 });
         }
     }
 
     private void AddPostParameters(ApiDescription apiDescription, ControllerActionDescriptor action)
     {
         var actionParameters = apiDescription.ActionDescriptor.Parameters;
         foreach (var param in actionParameters)
         {
+            if (IsServiceParameter(param))
+                continue;
+
+            var parameterBindingSource = GetPostParameterBindingSource(param);
+            if (parameterBindingSource == null)
+                continue;
+
             apiDescription.ParameterDescriptions.Add(new ApiParameterDescription {
                 Name = param.Name,
                 ModelMetadata = GetModel(param),
-                Source = BindingSource.Body,
-                Type = param.ParameterType
+                Source = parameterBindingSource,
+                Type = param.ParameterType,
+                ParameterDescriptor = param
             });
         }
     }
+    private BindingSource? GetPostParameterBindingSource(ParameterDescriptor param)
+    {
+        var bindingSource = param.BindingInfo?.BindingSource ?? GetModel(param).BindingSource;
+
+        if (bindingSource != null && !bindingSource.IsFromRequest)
+            return null;
+
+        if (bindingSource == BindingSource.Body ||
+            bindingSource == BindingSource.Query ||
+            bindingSource == BindingSource.Path ||
+            bindingSource == BindingSource.Header ||
+            bindingSource == BindingSource.Form ||
+            bindingSource == BindingSource.FormFile)
+            return bindingSource;
+
+        return IsSimpleType(param.ParameterType) ? BindingSource.Query : BindingSource.Body;
+    }
     private ModelMetadata GetModel(ParameterDescriptor param)
     {
         ModelMetadata metadata;
@@ -162,6 +196,18 @@
 
         return metadata;
     }
+    private static bool IsServiceParameter(ParameterDescriptor param)
+    {
+        if (param.ParameterType == typeof(CancellationToken))
+            return true;
+
+        if (param.BindingInfo?.BindingSource == BindingSource.Services ||
+            param.BindingInfo?.BindingSource == BindingSource.Special)
+            return true;
+
+        return param is ControllerParameterDescriptor controllerParameterDescriptor &&
+               controllerParameterDescriptor.ParameterInfo.GetCustomAttribute<FromServicesAttribute>() != null;
+    }
     private static bool IsSimpleType(Type type)
     {
         return type.IsPrimitive
@@ -208,8 +254,8 @@
             var currentSegment = string.Empty;
             foreach (var part in segment.Parts)
                 if (part.IsLiteral)
                     currentSegment += _routeOptions.LowercaseUrls ? part.Text!.ToLowerInvariant() : part.Text;
                 else if (part.IsParameter) currentSegment += "{" + part.Name + "}";
 
             segments.Add(currentSegment);
         }