Skip to content

.Net: Harden structured data mutation boundaries - #14718

Merged
Roger Barreto (rogerbarreto) merged 2 commits into
mainfrom
i612r773-data-hardening
Nov 4, 2026
Merged

Roger Barreto (rogerbarreto) merged 2 commits into
mainfrom
i612r773-data-hardening

Conversation

@rogerbarreto

Copy link
Copy Markdown
Member

Motivation and Context

Structured data mutation functions need a clear boundary between model-provided request data and Entity Framework persistence entities. Applications also need to control how update and delete targets are resolved before a mutation runs.

Description

  • Makes the convenience plugin factory query-only by default and rejects mutation operations that lack explicit application configuration.
  • Keeps the legacy direct-entity mutation overloads for compatibility, but makes them fail closed.
  • Adds safe mutation overloads that use separate request types, explicit insert/update mapping, and application-scoped tracked-entity resolution for update and delete.
  • Updates the structured data sample to demonstrate explicit safe function composition.
  • Adds regression coverage for request mapping, scoped resolution, detached entities, and the fail-closed legacy surface.

Validation:

  • dotnet build dotnet\src\Plugins\Plugins.StructuredData.EntityFramework\Plugins.StructuredData.EntityFramework.csproj -c Debug --tl:off --warnaserror --no-restore — passed for net10.0, net8.0, and net462 with 0 warnings and 0 errors.
  • dotnet build dotnet\src\Plugins\Plugins.UnitTests\Plugins.UnitTests.csproj -c Debug -f net10.0 --tl:off --warnaserror --no-restore — passed with 0 warnings and 0 errors.
  • dotnet test dotnet\src\Plugins\Plugins.UnitTests\Plugins.UnitTests.csproj -c Debug -f net10.0 --no-build --no-restore -v Normal --logger trx — 592 passed, 15 skipped, 0 failed.
  • dotnet build dotnet\samples\Demos\StructuredDataPlugin\StructuredDataPlugin.csproj -c Debug --tl:off --warnaserror --no-restore — passed with 0 warnings and 0 errors.
  • Scoped dotnet format --verify-no-changes — passed natively and with mcr.microsoft.com/dotnet/sdk:10.0 for all affected projects.

Contribution Checklist

@rogerbarreto
Roger Barreto (rogerbarreto) requested a review from a team as a code owner November 3, 2026 23:27
Copilot AI balanced review requested due to automatic review settings November 3, 2026 23:27
@semantic-kernel-automation semantic-kernel-automation Bot added the .NET Issue or Pull requests regarding .NET code label Nov 3, 2026
@github-actions github-actions Bot changed the title Harden structured data mutation boundaries .Net: Harden structured data mutation boundaries Nov 3, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Update and delete operations resolve products by non-unique names, so valid duplicate-name products cause exceptions and cannot be targeted individually without using their unique IDs.

1 open issue
What changed in this PR

This PR hardens .NET structured-data mutations by separating model-provided requests from Entity Framework entities and requiring application-controlled mapping and target resolution.

Changes:

  • Makes the convenience factory query-only and disables legacy direct-entity mutation overloads.
  • Adds explicit request-based mutation APIs and updates the sample to compose them.
  • Adds regression coverage for mapping, scoped resolution, tracked entities, and fail-closed behavior.
File Description
dotnet/​src/​Plugins/​Plugins.UnitTests/​StructuredData/​StructuredDataServiceTests.cs Adds mutation-boundary regression tests and supporting fixtures.
dotnet/​src/​Plugins/​Plugins.StructuredData.EntityFramework/​StructuredDataServiceExtensions.cs Adds request-based mutation overloads and disables legacy overloads.
dotnet/​src/​Plugins/​Plugins.StructuredData.EntityFramework/​StructuredDataPluginFactory.cs Restricts convenience composition to queries and rejects mutations.
dotnet/​src/​Plugins/​Plugins.StructuredData.EntityFramework/​StructuredDataOperation.cs Changes default operations to selection only.
dotnet/​samples/​Demos/​StructuredDataPlugin/​Program.cs Explicitly composes query and application-configured mutation functions.
dotnet/​samples/​Demos/​StructuredDataPlugin/​Product.cs Adds separate create, update, and delete request types.

Review effort: Balanced

@rogerbarreto
Roger Barreto (rogerbarreto) added this pull request to the merge queue Nov 4, 2026
Merged via the queue into main with commit 28c0d60 Nov 4, 2026
22 checks passed
@rogerbarreto
Roger Barreto (rogerbarreto) deleted the i612r773-data-hardening branch November 4, 2026 15:35

This branch was successfully deployed

2 active deployments
integration — 37a5c356 Deployed Nov 3, 2026 by rogerbarreto via dotnet-integration-tests #33111
github-app-auth — 37a5c356 Deployed Nov 3, 2026 by rogerbarreto via add_label #29583
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

.NET Issue or Pull requests regarding .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants