Merge branch 'main' into dependabot/npm_and_yarn/npm_and_yarn-a75b47bd17

Author: ShaynaCummings

packages/design-system/design/sass/components/_footer.scss

@@ -2,16 +2,27 @@
 ----------------------------------------
 Footer Styles
 ----------------------------------------
-Custom footer background colors per Figma design.
-TODO: Replace hardcoded color with design token when available.
+State-specific footer backgrounds via CSS custom properties.
+Each state defines --footer-section-bg on a BEM modifier class
+(.usa-footer--dc, .usa-footer--co). Colors are bespoke values
+from each state's Figma design that don't map to USWDS tokens.
 ----------------------------------------
 */
 
 @use 'uswds-core' as *;
 
-// Footer sections - #00A4A4
-// TODO: This should use a token like color('footer-bg') when defined
+// DC: teal background per DC Figma global footer (node I2035:1118;6002:23451)
+.usa-footer--dc {
+  --footer-section-bg: #00a4a4;
+}
+
+// CO: neutral gray per CO Figma CDHS global footer (nodes 8007:29245, 8007:29246)
+// Computed from Figma's rgba(0,0,0,0.1) overlay on #f5f5f5
+.usa-footer--co {
+  --footer-section-bg: #dddddd;
+}
+
 .usa-footer__primary-section,
 .usa-footer__secondary-section {
-  background-color: #00a4a4;
+  background-color: var(--footer-section-bg);
 }

packages/design-system/design/scripts/generate-sass-tokens.js

@@ -265,6 +265,11 @@ function generateSettingsContent(state, variables, timestamp) {
   settingsLines.push('  $theme-alert-icon-size: 3,')
   settingsLines.push('')
 
+  // Suppress USWDS release notes printed on every compile
+  settingsLines.push('  // Suppress verbose USWDS compile notifications')
+  settingsLines.push('  $theme-show-notifications: false,')
+  settingsLines.push('')
+
   // Add utility settings - ensures utility classes override component styles
   settingsLines.push('  // Utility settings')
   settingsLines.push('  $utilities-use-important: true')

packages/design-system/src/components/layout/Footer.tsx

@@ -28,7 +28,7 @@ export function Footer({ state = 'dc' }: FooterProps) {
 
   return (
     <footer
-      className="usa-footer usa-footer--slim"
+      className={`usa-footer usa-footer--slim usa-footer--${state}`}
       role="contentinfo"
     >
       <div className="usa-footer__primary-section padding-top-4">
@@ -96,19 +96,19 @@ function COFooter({ state = 'co' }: FooterProps) {
 
   return (
     <footer
-      className="usa-footer usa-footer--slim"
+      className={`usa-footer usa-footer--slim usa-footer--${state}`}
       role="contentinfo"
     >
       <div className="usa-footer__primary-section padding-y-2">
         <div className="grid-container text-center">
-          <p className="margin-0 text-white font-sans-xs">
+          <p className="margin-0 text-ink font-sans-xs">
             {t('copyrite', '© 2026 State of Colorado')}
             {' | '}
             <Link
               href={links.footer.transparencyOnline ?? '#'}
               target="_blank"
               rel="noopener noreferrer"
-              className="usa-link text-white text-underline"
+              className="usa-link text-ink text-underline"
             >
               {t('transparencyOnline', 'Transparency Online')}
             </Link>
@@ -117,7 +117,7 @@ function COFooter({ state = 'co' }: FooterProps) {
               href={links.footer.generalNotices ?? '#'}
               target="_blank"
               rel="noopener noreferrer"
-              className="usa-link text-white text-underline"
+              className="usa-link text-ink text-underline"
             >
               {t('generalNotices', 'General Notices')}
             </Link>

src/SEBT.Portal.Api/Composition/PluginAssemblyLoader.cs

@@ -1,5 +1,6 @@
 using System.Reflection;
 using System.Runtime.Loader;
+using Serilog;
 
 namespace SEBT.Portal.Api.Composition;
 
@@ -15,15 +16,27 @@ namespace SEBT.Portal.Api.Composition;
 // The assembly loading logic here is standalone and does not depend on MEF.
 internal static class PluginAssemblyLoader
 {
+    /// <param name="paths">Entries from configuration (relative to the API output or content root, or absolute).</param>
+    /// <param name="searchOption">Whether to scan subdirectories when counting and loading DLLs.</param>
+    /// <param name="contentRootPath">Host content root (project directory during <c>dotnet run</c> / watch). Used when plugin DLLs exist under <c>plugins-*</c> there but were not copied into <c>AppContext.BaseDirectory</c>.</param>
     public static List<Assembly> LoadAssembliesFromPaths(
         string[] paths,
-        SearchOption searchOption = SearchOption.TopDirectoryOnly)
+        SearchOption searchOption = SearchOption.TopDirectoryOnly,
+        string? contentRootPath = null)
     {
         var baseDir = AppContext.BaseDirectory;
-        var existingPaths = paths
-            .Select(p => Path.GetFullPath(Path.Combine(baseDir, p)))
-            .Where(Directory.Exists)
-            .ToArray();
+        var existingPaths = ResolvePluginDirectoriesWithDlls(paths, baseDir, contentRootPath, searchOption);
+
+        if (paths.Length > 0 && existingPaths.Length == 0)
+        {
+            Log.Warning(
+                "No plugin directories containing DLLs were found. PluginAssemblyPaths: {ConfiguredPaths}. " +
+                "BaseDirectory: {BaseDirectory}. ContentRoot: {ContentRoot}. " +
+                "For local dev, build the state connector (e.g. pnpm api:build-co) so DLLs exist under src/SEBT.Portal.Api/plugins-* or under the API output folder.",
+                paths,
+                baseDir,
+                contentRootPath ?? "(not provided)");
+        }
 
         if (existingPaths.Length == 0)
             return [];
@@ -48,23 +61,18 @@ public static List<Assembly> LoadAssembliesFromPaths(
 
         var loadedNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
 
-        // Connector post-builds often copy transitive dependencies (contracts, Kiota, etc.) into
-        // plugins-* alongside the implementation. Those DLLs are already in the app base or default
-        // context — loading them again from the plugin path causes duplicate loads and type/MEF issues.
+        // Skip only assemblies already loaded in the default context. Do NOT treat every *.dll file
+        // under BaseDirectory as loaded: connector outputs are copied next to the host EXE via
+        // CopyToOutputDirectory, so SEBT.Portal.StatePlugins.*.dll may exist on disk without being
+        // loaded — those must still load from the plugins-* folder or plugin types never register.
+        // (Loading the same assembly twice from different paths still trips the catch below.)
         var hostAssemblySimpleNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
         foreach (var assemblyName in AssemblyLoadContext.Default.Assemblies.Select(a => a.GetName().Name))
         {
             if (!string.IsNullOrEmpty(assemblyName))
                 hostAssemblySimpleNames.Add(assemblyName);
         }
 
-        foreach (var dllPath in Directory.GetFiles(baseDir, "*.dll"))
-        {
-            var simpleName = Path.GetFileNameWithoutExtension(dllPath);
-            if (!string.IsNullOrEmpty(simpleName))
-                hostAssemblySimpleNames.Add(simpleName);
-        }
-
         var allAssemblies = new List<Assembly>();
 
         foreach (var combinedPath in existingPaths)
@@ -95,4 +103,62 @@ public static List<Assembly> LoadAssembliesFromPaths(
 
         return allAssemblies;
     }
+
+    /// <summary>
+    /// Picks one directory per configured path: first tries the app output (<paramref name="baseDir"/>),
+    /// then host content root, skipping folders that do not exist or contain no DLLs.
+    /// Absolute <paramref name="paths"/> entries are used as-is.
+    /// </summary>
+    private static string[] ResolvePluginDirectoriesWithDlls(
+        string[] paths,
+        string baseDir,
+        string? contentRootPath,
+        SearchOption searchOption)
+    {
+        var chosen = new List<string>();
+
+        foreach (var raw in paths)
+        {
+            if (string.IsNullOrWhiteSpace(raw))
+                continue;
+
+            var trimmed = raw.Trim();
+            var candidates = new List<string>();
+            if (Path.IsPathRooted(trimmed))
+            {
+                candidates.Add(Path.GetFullPath(trimmed));
+            }
+            else
+            {
+                candidates.Add(Path.GetFullPath(Path.Combine(baseDir, trimmed)));
+                if (!string.IsNullOrEmpty(contentRootPath))
+                    candidates.Add(Path.GetFullPath(Path.Combine(contentRootPath, trimmed)));
+            }
+
+            string? existing = null;
+            foreach (var dir in candidates.Distinct(StringComparer.OrdinalIgnoreCase))
+            {
+                if (!Directory.Exists(dir))
+                    continue;
+                try
+                {
+                    if (Directory.GetFiles(dir, "*.dll", searchOption).Length == 0)
+                        continue;
+                }
+                catch (IOException ex)
+                {
+                    Log.Warning(ex, "Could not enumerate plugin DLLs in directory {PluginDirectory}", dir);
+                    continue;
+                }
+
+                existing = dir;
+                break;
+            }
+
+            if (existing != null)
+                chosen.Add(existing);
+        }
+
+        return chosen.Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
+    }
 }

src/SEBT.Portal.Api/Composition/ServiceCollectionPluginExtensions.cs

@@ -25,22 +25,31 @@ namespace SEBT.Portal.Api.Composition;
 internal static class ServiceCollectionPluginExtensions
 {
     public static IServiceCollection AddPlugins(this IServiceCollection services, IConfiguration configuration)
-    {
-        services.TryAddSingleton<IStateAuthenticationService, Defaults.DefaultStateAuthenticationService>();
-        services.TryAddSingleton<IStateHealthCheckService, Defaults.DefaultStateHealthCheckService>();
-        services.TryAddSingleton<ISummerEbtCaseService, Defaults.DefaultSummerEbtCaseService>();
-        services.TryAddSingleton<IEnrollmentCheckService, Defaults.DefaultEnrollmentCheckService>();
-        services.TryAddSingleton<IAddressUpdateService, Defaults.DefaultAddressUpdateService>();
+        => services.AddPlugins(configuration, contentRootPath: null);
 
+    /// <param name="services">The service collection.</param>
+    /// <param name="configuration">Application configuration (must include PluginAssemblyPaths).</param>
+    /// <param name="contentRootPath">
+    /// <see cref="Microsoft.Extensions.Hosting.IHostEnvironment.ContentRootPath"/> so plugin folders under
+    /// the API project directory are found when DLLs were not copied into <c>AppContext.BaseDirectory</c>.
+    /// </param>
+    public static IServiceCollection AddPlugins(
+        this IServiceCollection services,
+        IConfiguration configuration,
+        string? contentRootPath)
+    {
         var healthChecksBuilder = services.AddHealthChecks();
 
         var pluginAssemblyPaths = configuration
                                       .GetSection("PluginAssemblyPaths")
                                       .Get<string[]>()
                                   ?? throw new InvalidOperationException("PluginAssemblyPaths missing from configuration.");
-        Log.Information("Loading plugins from: {PluginAssemblyPaths}", pluginAssemblyPaths);
+        Log.Debug("Loading plugins from: {PluginAssemblyPaths}", pluginAssemblyPaths);
 
-        var loadedAssemblies = PluginAssemblyLoader.LoadAssembliesFromPaths(pluginAssemblyPaths);
+        var loadedAssemblies = PluginAssemblyLoader.LoadAssembliesFromPaths(
+            pluginAssemblyPaths,
+            SearchOption.TopDirectoryOnly,
+            contentRootPath);
 
         var pluginTypes = loadedAssemblies
             .SelectMany(a =>
@@ -57,10 +66,12 @@ public static IServiceCollection AddPlugins(this IServiceCollection services, IC
 
         foreach (var pluginType in pluginTypes)
         {
-            Log.Information("Discovered plugin type: {PluginType}", pluginType.FullName);
+            Log.Debug("Discovered plugin type: {PluginType}", pluginType.FullName);
 
+            // Only service interfaces that extend IStatePlugin (excludes IDisposable and other
+            // non-state contracts that appear on GetInterfaces()).
             var pluginInterfaces = pluginType.GetInterfaces()
-                .Where(i => i != typeof(IStatePlugin))
+                .Where(i => i != typeof(IStatePlugin) && typeof(IStatePlugin).IsAssignableFrom(i))
                 .ToList();
 
             switch (pluginInterfaces.Count)
@@ -98,7 +109,7 @@ public static IServiceCollection AddPlugins(this IServiceCollection services, IC
                 // with a lazy resolve adapter.
                 using var tempProvider = services.BuildServiceProvider();
                 var instance = ActivatorUtilities.CreateInstance(tempProvider, pluginType);
-                Log.Information("Constructed health check plugin: {PluginType}", pluginType.FullName);
+                Log.Debug("Constructed health check plugin: {PluginType}", pluginType.FullName);
 
                 ((IStateHealthCheckService)instance).ConfigureHealthChecks(healthChecksBuilder);
                 services.AddSingleton(pluginInterface, instance);
@@ -113,12 +124,27 @@ public static IServiceCollection AddPlugins(this IServiceCollection services, IC
                 {
                     var logger = sp.GetRequiredService<ILoggerFactory>()
                         .CreateLogger("SEBT.Portal.Api.Composition");
-                    logger.LogInformation("Constructing plugin: {PluginType}", capturedType.FullName);
+                    logger.LogDebug("Constructing plugin: {PluginType}", capturedType.FullName);
                     return ActivatorUtilities.CreateInstance(sp, capturedType);
                 });
             }
         }
 
+        if (pluginTypes.Count == 0 && loadedAssemblies.Count > 0)
+        {
+            Log.Warning(
+                "Loaded {AssemblyCount} plugin assemblies but discovered 0 IStatePlugin implementations. " +
+                "See earlier warnings for TypeLoadException from GetExportedTypes.",
+                loadedAssemblies.Count);
+        }
+
+        // Register in-process defaults only for services no connector plugin provided.
+        services.TryAddSingleton<IStateAuthenticationService, Defaults.DefaultStateAuthenticationService>();
+        services.TryAddSingleton<IStateHealthCheckService, Defaults.DefaultStateHealthCheckService>();
+        services.TryAddSingleton<ISummerEbtCaseService, Defaults.DefaultSummerEbtCaseService>();
+        services.TryAddSingleton<IEnrollmentCheckService, Defaults.DefaultEnrollmentCheckService>();
+        services.TryAddSingleton<IAddressUpdateService, Defaults.DefaultAddressUpdateService>();
+
         return services;
     }
 }

src/SEBT.Portal.Api/Program.cs

@@ -122,7 +122,7 @@
 builder.Services.AddCaching(builder.Configuration);
 
 // Registers plugins and allows them to be constructor injected into ASP.NET controllers
-builder.Services.AddPlugins(builder.Configuration);
+builder.Services.AddPlugins(builder.Configuration, builder.Environment.ContentRootPath);
 
 // Add services to the container.
 builder.Services.AddControllers();

src/SEBT.Portal.Api/SEBT.Portal.Api.csproj

@@ -127,6 +127,7 @@
 
   <ItemGroup>
     <Folder Include="plugins-dc\" />
+    <Folder Include="plugins-co\" />
   </ItemGroup>
 
 </Project>

src/SEBT.Portal.Infrastructure/Repositories/DatabaseDocVerificationChallengeRepository.cs

@@ -86,9 +86,41 @@ public async Task CreateAsync(
             throw new ArgumentNullException(nameof(challenge));
         }
 
-        var entity = MapToEntity(challenge);
-        dbContext.DocVerificationChallenges.Add(entity);
-        await dbContext.SaveChangesAsync(cancellationToken);
+        var now = DateTime.UtcNow;
+
+        // Single transaction: bulk expire + insert commit together. Without this, a failure after
+        // ExecuteUpdateAsync could leave stale rows expired with no new challenge (recoverable on
+        // retry but inconsistent until then).
+        await using var transaction =
+            await dbContext.Database.BeginTransactionAsync(cancellationToken);
+        try
+        {
+            // Bulk expire via SQL: does not use RowVersion optimistic concurrency or
+            // DocVerificationChallenge.TransitionTo (same Created→Expired transition as the domain).
+            // The predicate limits rows to stale Created/Pending; revisit if concurrent writers race here.
+            await dbContext.DocVerificationChallenges
+                .Where(c => c.UserId == challenge.UserId
+                    && (c.Status == (int)DocVerificationStatus.Created
+                        || c.Status == (int)DocVerificationStatus.Pending)
+                    && c.ExpiresAt != null
+                    && c.ExpiresAt <= now)
+                .ExecuteUpdateAsync(
+                    setters => setters
+                        .SetProperty(e => e.Status, (int)DocVerificationStatus.Expired)
+                        .SetProperty(e => e.UpdatedAt, now),
+                    cancellationToken);
+
+            var entity = MapToEntity(challenge);
+            dbContext.DocVerificationChallenges.Add(entity);
+            await dbContext.SaveChangesAsync(cancellationToken);
+
+            await transaction.CommitAsync(cancellationToken);
+        }
+        catch
+        {
+            await transaction.RollbackAsync(cancellationToken);
+            throw;
+        }
     }
 
     public async Task UpdateAsync(

src/SEBT.Portal.Infrastructure/Services/HouseholdIdentifierResolver.cs

@@ -79,7 +79,7 @@ public HouseholdIdentifierResolver(
             var overridePhone = _phoneOverrideProvider.GetOverridePhone();
             if (!string.IsNullOrWhiteSpace(overridePhone))
             {
-                _logger?.LogInformation("Using development phone override for household lookup ");
+                _logger?.LogInformation("Using development phone override for household lookup");
                 return new HouseholdIdentifier(PreferredHouseholdIdType.Phone, overridePhone);
             }
 

src/SEBT.Portal.Web/e2e/card-replacement/address-flow.spec.ts

@@ -12,11 +12,11 @@ import { currentState } from '../fixtures/state'
 
 const ADDRESS_FORM_DATA =
   currentState === 'co'
-    ? { street: '200 E Colfax Ave', city: 'Denver', state: 'Colorado', zip: '80203' }
+    ? { street: '200 E Colfax Ave', city: 'Denver', state: 'CO', zip: '80203' }
     : {
         street: '456 Oak Avenue NW',
         city: 'Washington',
-        state: 'District of Columbia',
+        state: 'DC',
         zip: '20002'
       }