Preserve non-service parameters and harden POST binding source handling in OpenAPI metadata generation by Copilot · Pull Request #730 · grandnode/grandnode2

Copilot · 2026-07-05T16:23:40Z

Actions that include a [FromServices] parameter were losing request parameter metadata in generated OpenAPI descriptions (e.g., checkout save and account register endpoints). This change ensures service-injected parameters are excluded from API docs while request parameters remain correctly documented, and prevents invalid runtime/non-request parameter metadata from causing OpenAPI generation failures.

API description generation
- Updated MetadataApiDescriptionProvider to skip service-bound parameters when building parameter descriptions for both GET and POST.
- Added a dedicated service-parameter check that handles:
  - BindingSource.Services
  - explicit [FromServices] on controller parameters
- Corrected POST parameter source mapping:
  - preserve explicit binding source when available
  - infer unbound simple parameters as query
  - infer unbound complex parameters as body
- Hardened POST parameter source resolution to:
  - fall back to model metadata binding source when BindingInfo is missing
  - skip non-request binding sources
  - exclude runtime CancellationToken parameters from API parameter descriptions
Regression coverage
- Added focused tests for MetadataApiDescriptionProvider:
  - POST action with [FromServices] + body model keeps only the body model parameter.
  - GET action with [FromServices] + query parameter keeps only the query parameter.
  - POST action with missing BindingSource on [FromServices] still excludes the DI parameter.
  - POST action with complex model + simple parameter maps to body + query sources correctly.
  - POST action with missing binding source on CancellationToken excludes the runtime parameter and keeps the request model.

apiDescription.ParameterDescriptions.Add(new ApiParameterDescription {
    Name = param.Name,
    ModelMetadata = GetModel(param),
    Source = parameterBindingSource,
    Type = param.ParameterType
});

Co-authored-by: KrzysztofPajak <16772986+KrzysztofPajak@users.noreply.github.com>

Copilot

Pull request overview

This PR fixes OpenAPI/ApiExplorer metadata generation so that controller action parameters injected from DI ([FromServices] / BindingSource.Services) are excluded from generated API parameter documentation, while normal request parameters (body/query) remain documented.

Changes:

Updated MetadataApiDescriptionProvider to skip service-injected parameters when building parameter descriptions for both GET and POST.
Added IsServiceParameter helper to detect service parameters via BindingSource.Services and explicit [FromServices] attributes.
Added regression tests covering GET and POST actions that include a DI parameter plus a normal request parameter.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/Modules/Grand.Module.Api/ApiExplorer/MetadataApiDescriptionProvider.cs	Skips DI/service parameters when generating ApiExplorer/OpenAPI parameter descriptions.
src/Tests/Grand.Module.Api.Tests/ApiExplorer/MetadataApiDescriptionProviderTests.cs	Adds regression tests ensuring `[FromServices]` does not suppress normal body/query parameters.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

sonarqubecloud · 2026-07-05T16:40:56Z

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

KrzysztofPajak · 2026-07-05T17:31:20Z

@copilot why endpoint "/Account/Register" looks like this in
"post": {
"tags": [
"Account"
],
"parameters": [
{
"name": "X-CSRF-TOKEN",
"in": "header",
"required": true,
"schema": {
"type": "string",
"description": "Antiforgery token"
}
}
],
"responses": {
"200": {
"description": "OK"
}
}
v2.json open api
Where is the input model?

Co-authored-by: KrzysztofPajak <16772986+KrzysztofPajak@users.noreply.github.com>

Copilot · 2026-07-05T17:38:46Z

@copilot why endpoint "/Account/Register" looks like this in
"post": {
"tags": [
...

It was missing because our metadata provider treated all POST action parameters as body parameters; for Register(RegisterModel model, string returnUrl) that produced invalid metadata and the request model was dropped from the generated spec. I fixed this in 6d1db8c by preserving explicit binding sources and inferring unbound simple POST params (like returnUrl) as query while keeping complex params (the register model) as body.

KrzysztofPajak · 2026-07-05T17:46:01Z

@copilot Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
An unhandled exception has occurred while executing the request.
System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.<>c.b__33_0(ApiParameterDescription parameter)
at System.Linq.Lookup2.Create(IEnumerable1 source, Func2 keySelector, IEqualityComparer1 comparer)
at System.Linq.Enumerable.GroupByIterator2.GetCount(Boolean onlyIfCheap) at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetFormRequestBody(OpenApiDocument document, IList1 supportedRequestFormats, IEnumerable1 formParameters, IList1 endpointMetadata, IServiceProvider scopedServiceProvider, IOpenApiSchemaTransformer[] schemaTransformers, CancellationToken cancellationToken)
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetRequestBodyAsync(OpenApiDocument document, ApiDescription description, IServiceProvider scopedServiceProvider, IOpenApiSchemaTransformer[] schemaTransformers, CancellationToken cancellationToken)
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetOperationAsync(ApiDescription description, OpenApiDocument document, IServiceProvider scopedServiceProvider, IOpenApiSchemaTransformer[] schemaTransformers, CancellationToken cancellationToken)
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetOperationsAsync(IGrouping`2 descriptions, OpenApiDocument document, IServiceProvider scopedServiceProvider, IOpenApiOperationTransformer[] operationTransformers, IOpenApiSchemaTransformer[] schemaTransformers, CancellationToken cancellationToken)
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetOpenApiPathsAsync(OpenApiDocument document, IServiceProvider scopedServiceProvider, IOpenApiOperationTransformer[] operationTransformers, IOpenApiSchemaTransformer[] schemaTransformers, CancellationToken cancellationToken)
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetOpenApiDocumentAsync(IServiceProvider scopedServiceProvider, HttpRequest httpRequest, CancellationToken cancellationToken)
at Microsoft.AspNetCore.Builder.OpenApiEndpointRouteBuilderExtensions.<>c__DisplayClass0_0.<b__0>d.MoveNext()

Co-authored-by: KrzysztofPajak <16772986+KrzysztofPajak@users.noreply.github.com>

Copilot · 2026-07-05T17:48:49Z

@copilot Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
An unhandled exception has occurred while executing the request.
System.NullReferenceException: Objec...

Fixed in 398cf46. I hardened POST parameter source handling to avoid emitting unsupported binding sources into OpenAPI metadata and excluded BindingSource.Special parameters (non-request/runtime values) from generated API parameter descriptions. I also added regression tests for model-binding source fallback and special-source exclusion.

KrzysztofPajak · 2026-07-05T17:54:48Z

@copilot problem still exist
Executed endpoint 'HTTP: GET /openapi/{documentName}.json'
fail: Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
An unhandled exception has occurred while executing the request.
System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.<>c.b__33_0(ApiParameterDescription parameter)
at System.Linq.Lookup2.Create(IEnumerable1 source, Func2 keySelector, IEqualityComparer1 comparer)
at System.Linq.Enumerable.GroupByIterator2.GetCount(Boolean onlyIfCheap) at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetFormRequestBody(OpenApiDocument document, IList1 supportedRequestFormats, IEnumerable1 formParameters, IList1 endpointMetadata, IServiceProvider scopedServiceProvider, IOpenApiSchemaTransformer[] schemaTransformers, CancellationToken cancellationToken)
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetRequestBodyAsync(OpenApiDocument document, ApiDescription description, IServiceProvider scopedServiceProvider, IOpenApiSchemaTransformer[] schemaTransformers, CancellationToken cancellationToken)
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetOperationAsync(ApiDescription description, OpenApiDocument document, IServiceProvider scopedServiceProvider, IOpenApiSchemaTransformer[] schemaTransformers, CancellationToken cancellationToken)
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetOperationsAsync(IGrouping`2 descriptions, OpenApiDocument document, IServiceProvider scopedServiceProvider, IOpenApiOperationTransformer[] operationTransformers, IOpenApiSchemaTransformer[] schemaTransformers, CancellationToken cancellationToken)
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetOpenApiPathsAsync(OpenApiDocument document, IServiceProvider scopedServiceProvider, IOpenApiOperationTransformer[] operationTransformers, IOpenApiSchemaTransformer[] schemaTransformers, CancellationToken cancellationToken)
at Microsoft.AspNetCore.OpenApi.OpenApiDocumentService.GetOpenApiDocumentAsync(IServiceProvider scopedServiceProvider, HttpRequest httpRequest, CancellationToken cancellationToken)
at Microsoft.AspNetCore.Builder.OpenApiEndpointRouteBuilderExtensions.<>c__DisplayClass0_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Http.Generated.<GeneratedRouteBuilderExtensions_g>F0399B8B15BE443123F4BECEE84B112C1912EE3F44D9DDD7BFA38E371FB917343__GeneratedRouteBuilderExtensionsCore.<>c__DisplayClass2_0.<g__RequestHandler|5>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Routing.EndpointMiddleware.g__AwaitRequestTask|7_0(Endpoint endpoint, Task requestTask, ILogger logger)
at Grand.Web.Common.Middleware.ContextLoggingMiddleware.InvokeAsync(HttpContext context, IContextAccessor contextAccessor) in C:\Projects\Grandnode\grandnode2\src\Web\Grand.Web.Common\Middleware\ContextLoggingMiddleware.cs:line 32
at Grand.Web.Common.Middleware.CultureSettingMiddleware.InvokeAsync(HttpContext context, IContextAccessor contextAccessor) in C:\Projects\Grandnode\grandnode2\src\Web\Grand.Web.Common\Middleware\CultureSettingMiddleware.cs:line 32
at Grand.Web.Common.Middleware.ContextMiddleware.InvokeAsync(HttpContext context, IContextAccessor contextAccessor) in C:\Projects\Grandnode\grandnode2\src\Web\Grand.Web.Common\Middleware\ContextMiddleware.cs:line 50
at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
at Grand.Web.Common.Middleware.PoweredByMiddleware.InvokeAsync(HttpContext context, IPoweredByMiddlewareOptions options) in C:\Projects\Grandnode\grandnode2\src\Web\Grand.Web.Common\Middleware\PoweredByMiddleware.cs:line 23
at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
at Grand.Web.Common.Middleware.InstallUrlMiddleware.InvokeAsync(HttpContext context) in C:\Projects\Grandnode\grandnode2\src\Web\Grand.Web.Common\Middleware\InstallUrlMiddleware.cs:line 72
at Microsoft.FeatureManagement.UseForFeatureExtensions.<>c__DisplayClass0_1.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at Grand.Web.Common.Infrastructure.ApplicationBuilderExtensions.<>c.<b__4_0>d.MoveNext() in C:\Projects\Grandnode\grandnode2\src\Web\Grand.Web.Common\Infrastructure\ApplicationBuilderExtensions.cs:line 83
--- End of stack trace from previous location ---
at Microsoft.AspNetCore.Diagnostics.StatusCodePagesMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Diagnostics.StatusCodePagesMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddlewareImpl.Invoke(HttpContext context)
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
Request finished HTTP/2 GET https://localhost:44350/openapi/v2.json - 500 - application/problem+json 205.9424ms

Co-authored-by: KrzysztofPajak <16772986+KrzysztofPajak@users.noreply.github.com>

Copilot · 2026-07-05T18:00:52Z

@copilot problem still exist
Executed endpoint 'HTTP: GET /openapi/{documentName}.json'
fail: Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
...

Fixed in 9e7840b. I hardened MetadataApiDescriptionProvider so POST parameter binding now falls back to model metadata, skips any non-request binding sources, and excludes runtime CancellationToken parameters when binding info is missing. I also added a regression test for that missing-binding-source case.

MetadataApiDescriptionProvider emitted ApiParameterDescription objects without a ParameterDescriptor, which OpenApiDocumentService.GetFormRequestBody dereferences when grouping form parameters, crashing /openapi/v2.json with a NullReferenceException. Populate ParameterDescriptor on every emitted description and add regression tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Initial plan

c2cb3ab

Copilot AI assigned Copilot and KrzysztofPajak Jul 5, 2026

Copilot started work on behalf of KrzysztofPajak July 5, 2026 16:23 View session

Copilot AI linked an issue Jul 5, 2026 that may be closed by this pull request

Frontend Api action parameters ignored #689

Closed

Copilot AI and others added 2 commits July 5, 2026 16:26

Fix OpenAPI parameter discovery for actions using FromServices

e4eb382

Co-authored-by: KrzysztofPajak <16772986+KrzysztofPajak@users.noreply.github.com>

Add tests for FromServices parameter filtering in API descriptions

444cb9c

Co-authored-by: KrzysztofPajak <16772986+KrzysztofPajak@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix ignored action parameters in OpenApi documents~~ Preserve non-service action parameters in OpenAPI metadata generation Jul 5, 2026

Copilot AI requested a review from KrzysztofPajak July 5, 2026 16:27

Copilot finished work on behalf of KrzysztofPajak July 5, 2026 16:27

KrzysztofPajak marked this pull request as ready for review July 5, 2026 16:30

Copilot AI review requested due to automatic review settings July 5, 2026 16:30

Copilot started reviewing on behalf of KrzysztofPajak July 5, 2026 16:31 View session

Copilot AI reviewed Jul 5, 2026

View reviewed changes

Comment thread src/Tests/Grand.Module.Api.Tests/ApiExplorer/MetadataApiDescriptionProviderTests.cs

Copilot started work on behalf of KrzysztofPajak July 5, 2026 17:31 View session

Fix POST parameter source inference for OpenAPI metadata

6d1db8c

Co-authored-by: KrzysztofPajak <16772986+KrzysztofPajak@users.noreply.github.com>

Copilot AI changed the title ~~Preserve non-service action parameters in OpenAPI metadata generation~~ Preserve non-service parameters and correct POST binding sources in OpenAPI metadata generation Jul 5, 2026

Copilot finished work on behalf of KrzysztofPajak July 5, 2026 17:39

Copilot started work on behalf of KrzysztofPajak July 5, 2026 17:46 View session

Harden OpenAPI POST binding source handling

398cf46

Co-authored-by: KrzysztofPajak <16772986+KrzysztofPajak@users.noreply.github.com>

Copilot finished work on behalf of KrzysztofPajak July 5, 2026 17:49

Copilot started work on behalf of KrzysztofPajak July 5, 2026 17:55 View session

Harden OpenAPI parameter filtering for non-request bindings

9e7840b

Co-authored-by: KrzysztofPajak <16772986+KrzysztofPajak@users.noreply.github.com>

Copilot AI changed the title ~~Preserve non-service parameters and correct POST binding sources in OpenAPI metadata generation~~ Preserve non-service parameters and harden POST binding source handling in OpenAPI metadata generation Jul 5, 2026

Copilot finished work on behalf of KrzysztofPajak July 5, 2026 18:01

KrzysztofPajak merged commit 746dd9f into develop Jul 5, 2026
4 of 6 checks passed

KrzysztofPajak deleted the copilot/fix-frontend-api-parameters-ignored branch July 5, 2026 18:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Preserve non-service parameters and harden POST binding source handling in OpenAPI metadata generation#730

Preserve non-service parameters and harden POST binding source handling in OpenAPI metadata generation#730
KrzysztofPajak merged 7 commits into
developfrom
copilot/fix-frontend-api-parameters-ignored

Copilot AI commented Jul 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 5, 2026

Uh oh!

KrzysztofPajak commented Jul 5, 2026

Uh oh!

Copilot AI commented Jul 5, 2026

Uh oh!

KrzysztofPajak commented Jul 5, 2026

Uh oh!

Copilot AI commented Jul 5, 2026

Uh oh!

KrzysztofPajak commented Jul 5, 2026

Uh oh!

Copilot AI commented Jul 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 5, 2026

Quality Gate passed

Uh oh!

KrzysztofPajak commented Jul 5, 2026

Uh oh!

Copilot AI commented Jul 5, 2026

Uh oh!

KrzysztofPajak commented Jul 5, 2026

Uh oh!

Copilot AI commented Jul 5, 2026

Uh oh!

KrzysztofPajak commented Jul 5, 2026

Uh oh!

Copilot AI commented Jul 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 5, 2026 •

edited

Loading