feat: add max children validation to enrollment check requests

Author: adbergen

src/SEBT.Portal.Api/Models/EnrollmentCheck/EnrollmentCheckApiRequest.cs

@@ -1,13 +1,21 @@
+using System.ComponentModel.DataAnnotations;
+
 namespace SEBT.Portal.Api.Models.EnrollmentCheck;
 
 /// <summary>
 /// Request model for checking enrollment status of one or more children.
 /// </summary>
 public class EnrollmentCheckApiRequest
 {
+    /// <summary>
+    /// Maximum number of children that can be checked in a single request.
+    /// </summary>
+    public const int MaxChildren = 20;
+
     /// <summary>
     /// The children to check enrollment for.
     /// </summary>
+    [MaxLength(MaxChildren)]
     public IList<ChildCheckApiRequest> Children { get; set; } = new List<ChildCheckApiRequest>();
 }
 

src/SEBT.Portal.Api/Program.cs

@@ -95,7 +95,7 @@
 builder.Host.UseSerilog();
 
 // Registers plugins and allows them to be constructor injected into ASP.NET controllers
-builder.Services.AddPlugins();
+builder.Services.AddPlugins(builder.Configuration);
 
 // Add services to the container.
 builder.Services.AddControllers();

src/SEBT.Portal.Infrastructure/Dependencies.cs

@@ -161,20 +161,9 @@ public static IServiceCollection AddPortalInfrastructureAppSettings(this IServic
                 postConfig.PostConfigure(null, options);
             });
 
-<<<<<<< feature/DC-172-backend-enrollment
-        services.AddOptions<AppConfigFeatureFlagSettings>()
-            .Bind(configuration.GetSection(AppConfigFeatureFlagSettings.SectionName))
-            .PostConfigure<IConfiguration, ILogger<AppConfigFeatureFlagOptionsConfiguration>>((options, config, logger) =>
-            {
-                var postConfig = new AppConfigFeatureFlagOptionsConfiguration(config, logger);
-                postConfig.PostConfigure(null, options);
-            });
-
         services.AddOptionsWithValidateOnStart<EnrollmentCheckRateLimitSettings>()
             .BindConfiguration(EnrollmentCheckRateLimitSettings.SectionName);
 
-=======
->>>>>>> feature/DC-172-design-system
         services.AddOptions<SeedingSettings>()
             .BindConfiguration(SeedingSettings.SectionName);
 

src/SEBT.Portal.UseCases/EnrollmentCheck/CheckEnrollmentCommandHandler.cs

@@ -26,6 +26,13 @@ public async Task<Result<EnrollmentCheckResult>> Handle(
                 "Children", "At least one child is required.");
         }
 
+        const int maxChildren = 20;
+        if (command.Children.Count > maxChildren)
+        {
+            return Result<EnrollmentCheckResult>.ValidationFailed(
+                "Children", $"A maximum of {maxChildren} children can be checked per request.");
+        }
+
         var request = new EnrollmentCheckRequest
         {
             Children = command.Children.Select(c => new ChildCheckRequest

test/SEBT.Portal.Tests/Integration/PortalWebApplicationFactory.cs

@@ -1,76 +1,66 @@
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using NSubstitute;
 using SEBT.Portal.Core.Services;
-using SEBT.Portal.Infrastructure.Data;
 using SEBT.Portal.Infrastructure.Services;
-using SEBT.Portal.StatesPlugins.Interfaces;
 
 namespace SEBT.Portal.Tests.Integration;
 
 /// <summary>
 /// Shared test factory for integration tests that spin up the real HTTP pipeline.
 /// Handles common concerns so individual test classes can focus on endpoint behavior:
 /// <list type="bullet">
-///   <item>Configures plugin assembly paths to a non-existent directory so no plugins load</item>
-///   <item>Replaces SQL Server with InMemory EF provider</item>
-///   <item>Replaces database migration/seeding with no-op mocks</item>
-///   <item>Mocks plugin service interfaces so tests don't depend on state plugins</item>
+///   <item>Redirects plugin assembly paths to prevent loading DLLs with missing transitive dependencies</item>
+///   <item>Replaces database services with no-op mocks (no SQL Server required)</item>
 /// </list>
 /// </summary>
 public class PortalWebApplicationFactory : WebApplicationFactory<Program>
 {
     protected override void ConfigureWebHost(IWebHostBuilder builder)
     {
-        builder.UseEnvironment("Development");
+        // Override plugin assembly paths via environment variables BEFORE the server starts.
+        // WebApplicationFactory lazily starts the server, so env vars set here are visible
+        // when Program.cs reads builder.Configuration during startup.
+        // This prevents loading plugin DLLs (copied to test output by the API csproj)
+        // that have unresolvable transitive dependencies in the test environment.
+        Environment.SetEnvironmentVariable("PluginAssemblyPaths__0", "plugins-none");
+        Environment.SetEnvironmentVariable("PluginAssemblyPaths__1", "plugins-none");
 
-        builder.ConfigureAppConfiguration((_, config) =>
-            config.AddInMemoryCollection(new Dictionary<string, string?>
-            {
-                ["PluginAssemblyPaths:0"] = "plugins-test",
-                ["JwtSettings:SecretKey"] =
-                    "integration-test-key-must-be-at-least-32-bytes-long",
-            }));
+        // Provide a dummy JWT secret so the JwtBearer handler can initialize.
+        // The auth middleware runs on every request (including /health), and
+        // PostConfigure reads JwtSettings:SecretKey to create a SymmetricSecurityKey.
+        Environment.SetEnvironmentVariable("JwtSettings__SecretKey",
+            "integration-test-secret-key-at-least-32-chars!");
 
         builder.ConfigureServices(services =>
         {
-            // Remove the real SQL Server DbContext registration
-            var dbContextDescriptor = services.SingleOrDefault(
-                d => d.ServiceType == typeof(DbContextOptions<PortalDbContext>));
-            if (dbContextDescriptor != null)
-            {
-                services.Remove(dbContextDescriptor);
-            }
-
-            // Add InMemory EF provider instead
-            services.AddDbContext<PortalDbContext>(options =>
-                options.UseInMemoryDatabase("IntegrationTests"));
+            // Replace database services with no-op mocks so startup
+            // doesn't require a real SQL Server instance.
+            ReplaceWithMock<IDatabaseMigrator>(services);
+            ReplaceWithMock<IDatabaseSeeder>(services);
+        });
+    }
 
-            // Replace database migrator and seeder with no-ops
-            var migratorDescriptor = services.SingleOrDefault(
-                d => d.ServiceType == typeof(IDatabaseMigrator));
-            if (migratorDescriptor != null)
-            {
-                services.Remove(migratorDescriptor);
-            }
-            services.AddScoped(_ => Substitute.For<IDatabaseMigrator>());
+    /// <summary>
+    /// Replaces an existing service registration with a no-op NSubstitute mock.
+    /// </summary>
+    private static void ReplaceWithMock<TService>(IServiceCollection services) where TService : class
+    {
+        var descriptor = services.SingleOrDefault(d => d.ServiceType == typeof(TService));
+        if (descriptor != null)
+        {
+            services.Remove(descriptor);
+        }
 
-            var seederDescriptor = services.SingleOrDefault(
-                d => d.ServiceType == typeof(IDatabaseSeeder));
-            if (seederDescriptor != null)
-            {
-                services.Remove(seederDescriptor);
-            }
-            services.AddScoped(_ => Substitute.For<IDatabaseSeeder>());
+        services.AddScoped(_ => Substitute.For<TService>());
+    }
 
-            // Override plugin service registrations with mocks.
-            // These AddSingleton calls come after AddPlugins' TryAddSingleton defaults
-            // and any MEF-loaded plugins, so they win — last registration wins in DI.
-            services.AddSingleton(Substitute.For<ISummerEbtCaseService>());
-            services.AddSingleton(Substitute.For<IEnrollmentCheckService>());
-        });
+    protected override void Dispose(bool disposing)
+    {
+        Environment.SetEnvironmentVariable("PluginAssemblyPaths__0", null);
+        Environment.SetEnvironmentVariable("PluginAssemblyPaths__1", null);
+        Environment.SetEnvironmentVariable("JwtSettings__SecretKey", null);
+        base.Dispose(disposing);
     }
 }

test/SEBT.Portal.Tests/Unit/UseCases/EnrollmentCheck/CheckEnrollmentCommandHandlerTests.cs

@@ -33,6 +33,28 @@ public async Task Handle_WhenNoChildren_ReturnsValidationFailed()
         Assert.IsType<Kernel.Results.ValidationFailedResult<EnrollmentCheckResult>>(result);
     }
 
+    [Fact]
+    public async Task Handle_WhenTooManyChildren_ReturnsValidationFailed()
+    {
+        var handler = CreateHandler();
+        var children = Enumerable.Range(0, 21).Select(i => new CheckEnrollmentCommand.ChildInput
+        {
+            FirstName = $"Child{i}",
+            LastName = "Doe",
+            DateOfBirth = new DateOnly(2015, 1, 1)
+        }).ToList();
+        var command = new CheckEnrollmentCommand
+        {
+            Children = children,
+            IpAddress = "127.0.0.1"
+        };
+
+        var result = await handler.Handle(command);
+
+        Assert.False(result.IsSuccess);
+        Assert.IsType<Kernel.Results.ValidationFailedResult<EnrollmentCheckResult>>(result);
+    }
+
     [Fact]
     public async Task Handle_WithValidChild_CallsPluginAndReturnsResults()
     {