test: enhance coverage and stabilize infrastructure

src/.editorconfig

@@ -262,6 +262,9 @@ dotnet_diagnostic.CA1724.severity = none
 dotnet_diagnostic.CA1819.severity = none
 dotnet_diagnostic.CA1040.severity = none
 dotnet_diagnostic.CA1848.severity = none
+dotnet_diagnostic.CA1054.severity = none
+dotnet_diagnostic.CA1056.severity = none
+dotnet_diagnostic.MSG0005.severity = none
 
 [**/Migrations.PostgreSQL/**/*.cs]
 dotnet_diagnostic.CA1062.severity = none

src/BuildingBlocks/Mailing/Services/SmtpMailService.cs

@@ -132,8 +132,12 @@ private async Task SendEmailAsync(MimeMessage email, CancellationToken ct)
 
         try
         {
-            await client.ConnectAsync(_settings.Smtp!.Host, _settings.Smtp.Port, SecureSocketOptions.StartTls, ct);
-            await client.AuthenticateAsync(_settings.Smtp.UserName, _settings.Smtp.Password, ct);
+            await client.ConnectAsync(_settings.Smtp!.Host!, _settings.Smtp.Port, SecureSocketOptions.StartTls, ct);
+
+            if (!string.IsNullOrWhiteSpace(_settings.Smtp.UserName) && !string.IsNullOrWhiteSpace(_settings.Smtp.Password))
+            {
+                await client.AuthenticateAsync(_settings.Smtp.UserName, _settings.Smtp.Password, ct);
+            }
             await client.SendAsync(email, ct);
         }
         // Broad catch is intentional: any SMTP failure (auth, network, protocol) is logged

src/BuildingBlocks/Quota/InMemoryQuotaService.cs

@@ -15,7 +15,7 @@ public sealed class InMemoryQuotaService : IQuotaService
     private readonly QuotaOptions _options;
     private readonly QuotaPlanResolver _planResolver;
     private readonly IMultiTenantContextAccessor<AppTenantInfo>? _tenantAccessor;
-    private readonly IReadOnlyDictionary<QuotaResource, IQuotaGaugeProvider> _gauges;
+    private readonly Dictionary<QuotaResource, IQuotaGaugeProvider> _gauges;
     private readonly TimeProvider _timeProvider;
 
     internal InMemoryQuotaService(

src/BuildingBlocks/Quota/InMemoryQuotaStore.cs

@@ -6,7 +6,7 @@ namespace FSH.Framework.Quota;
 /// Singleton backing store for <see cref="InMemoryQuotaService"/> so counters survive request scopes.
 /// Keyed by <c>quota:{tenantId}:{resource}:{period}</c> exactly like the Redis backend.
 /// </summary>
-internal sealed class InMemoryQuotaStore
+public sealed class InMemoryQuotaStore
 {
     public ConcurrentDictionary<string, long> Counters { get; } = new();
 }

src/BuildingBlocks/Quota/NoopQuotaService.cs

@@ -6,7 +6,7 @@ namespace FSH.Framework.Quota;
 /// Used when quota enforcement is disabled via configuration. Every check returns allowed with
 /// an unlimited result so calling code remains unchanged.
 /// </summary>
-internal sealed class NoopQuotaService : IQuotaService
+public sealed class NoopQuotaService : IQuotaService
 {
     public ValueTask<QuotaCheckResult> CheckAsync(string tenantId, QuotaResource resource, long amount, CancellationToken ct = default)
         => ValueTask.FromResult(QuotaCheckResult.Unlimited(resource, 0));

src/BuildingBlocks/Quota/Quota.csproj

@@ -13,13 +13,6 @@
 	<ItemGroup>
 		<PackageReference Include="Finbuckle.MultiTenant" />
 		<PackageReference Include="Finbuckle.MultiTenant.Abstractions" />
-		<PackageReference Include="Microsoft.Extensions.Configuration" />
-		<PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" />
-		<PackageReference Include="Microsoft.Extensions.Configuration.Binder" />
-		<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
-		<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
-		<PackageReference Include="Microsoft.Extensions.Options" />
-		<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" />
 		<PackageReference Include="StackExchange.Redis" />
 	</ItemGroup>
 

src/BuildingBlocks/Quota/QuotaOptions.cs

@@ -20,7 +20,7 @@ public sealed class QuotaOptions
     public string DefaultPlan { get; set; } = "free";
 
     /// <summary>Plan name → per-resource limit map. Use -1 or long.MaxValue for "unlimited".</summary>
-    public Dictionary<string, Dictionary<QuotaResource, long>> Plans { get; set; } = new();
+    public Dictionary<string, Dictionary<QuotaResource, long>> Plans { get; } = new();
 
     /// <summary>
     /// Whether the root/platform tenant is exempt from quota enforcement. Defaults to true; platform

src/BuildingBlocks/Quota/RedisQuotaService.cs

@@ -18,7 +18,7 @@ public sealed class RedisQuotaService : IQuotaService
     private readonly QuotaOptions _options;
     private readonly QuotaPlanResolver _planResolver;
     private readonly IMultiTenantContextAccessor<AppTenantInfo>? _tenantAccessor;
-    private readonly IReadOnlyDictionary<QuotaResource, IQuotaGaugeProvider> _gauges;
+    private readonly Dictionary<QuotaResource, IQuotaGaugeProvider> _gauges;
     private readonly TimeProvider _timeProvider;
     private readonly ILogger<RedisQuotaService> _logger;
 

src/BuildingBlocks/Storage/Storage.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
 	<PropertyGroup>
 		<RootNamespace>FSH.Framework.Storage</RootNamespace>
@@ -16,7 +16,6 @@
 	<ItemGroup>
 		<PackageReference Include="Finbuckle.MultiTenant" />
 		<PackageReference Include="Finbuckle.MultiTenant.Abstractions" />
-		<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
 	</ItemGroup>
 
 	<ItemGroup>

src/BuildingBlocks/Web/Exceptions/GlobalExceptionHandler.cs

@@ -1,4 +1,5 @@
-using System.Diagnostics;
+using System.Diagnostics;
+using System;
 using FSH.Framework.Core.Exceptions;
 using Microsoft.AspNetCore.Diagnostics;
 using Microsoft.AspNetCore.Http;
@@ -52,10 +53,23 @@ public async ValueTask<bool> TryHandleAsync(HttpContext httpContext, Exception e
                 problemDetails.Extensions["errors"] = e.ErrorMessages;
             }
         }
+        else if (exception is UnauthorizedAccessException)
+        {
+            statusCode = StatusCodes.Status401Unauthorized;
+            problemDetails.Status = statusCode;
+            problemDetails.Title = "Unauthorized";
+            problemDetails.Detail = exception.Message;
+        }
+        else if (exception is KeyNotFoundException)
+        {
+            statusCode = StatusCodes.Status404NotFound;
+            problemDetails.Status = statusCode;
+            problemDetails.Title = "Not Found";
+            problemDetails.Detail = exception.Message;
+        }
         else
         {
             statusCode = StatusCodes.Status500InternalServerError;
-
             problemDetails.Status = statusCode;
             problemDetails.Title = "An unexpected error occurred";
             problemDetails.Detail = "An unexpected error occurred. Please try again later.";

src/BuildingBlocks/Web/Versioning/Extensions.cs

@@ -1,4 +1,4 @@
-using Asp.Versioning;
+using Asp.Versioning;
 using Microsoft.Extensions.DependencyInjection;
 
 namespace FSH.Framework.Web.Versioning;
@@ -7,6 +7,7 @@ public static class Extensions
 {
     public static IServiceCollection AddHeroVersioning(this IServiceCollection services)
     {
+        ArgumentNullException.ThrowIfNull(services);
         services
             .AddApiVersioning(options =>
             {

src/Directory.Build.props

@@ -17,7 +17,7 @@
 
 		<!-- Docs -->
 		<GenerateDocumentationFile>true</GenerateDocumentationFile>
-		<NoWarn>$(NoWarn);CS1591</NoWarn>
+		<NoWarn>$(NoWarn);CS1591;MSG0005;CA1054;CA1056</NoWarn>
 		<!-- Suppress warning about missing XML docs -->
 
 		<!-- Container tags (if using container builds) -->

src/Host/FSH.Starter.Api/DevSeeding/DevDataSeeder.cs

@@ -18,7 +18,7 @@ namespace FSH.Starter.Api.DevSeeding;
 /// idempotent — every step checks before creating, so subsequent restarts are no-ops.
 ///
 /// Activation:
-///   - Only registered when <see cref="IHostEnvironment.IsDevelopment"/>.
+///   - Only registered when <c>IHostEnvironment.IsDevelopment()</c>.
 ///   - Additionally gated on <c>Seed:Demo == true</c> in configuration so a developer can
 ///     opt out without code changes.
 ///
@@ -74,7 +74,10 @@ protected override async Task ExecuteAsync(CancellationToken stoppingToken)
         // Default-on in Development unless explicitly disabled.
         if (!_config.GetValue("Seed:Demo", true))
         {
-            _logger.LogInformation("[DevDataSeeder] disabled via Seed:Demo=false");
+            if (_logger.IsEnabled(LogLevel.Information))
+            {
+                _logger.LogInformation("[DevDataSeeder] disabled via Seed:Demo=false");
+            }
             return;
         }
 
@@ -87,7 +90,10 @@ protected override async Task ExecuteAsync(CancellationToken stoppingToken)
             await SeedRootSuperAdminAsync(stoppingToken).ConfigureAwait(false);
             await SeedTenantUsersAsync(Acme, stoppingToken).ConfigureAwait(false);
             await SeedTenantUsersAsync(Globex, stoppingToken).ConfigureAwait(false);
-            _logger.LogInformation("[DevDataSeeder] complete · superadmin@root.com · acme + globex demo users · password '{Password}'", SharedPassword);
+            if (_logger.IsEnabled(LogLevel.Information))
+            {
+                _logger.LogInformation("[DevDataSeeder] complete · superadmin@root.com · acme + globex demo users seeded (shared dev password configured)");
+            }
         }
         catch (Exception ex) when (ex is not OperationCanceledException)
         {
@@ -107,7 +113,10 @@ private async Task EnsureTenantsAsync(CancellationToken cancellationToken)
                 continue;
             }
 
-            _logger.LogInformation("[DevDataSeeder] creating demo tenant '{TenantId}'", demo.Id);
+            if (_logger.IsEnabled(LogLevel.Information))
+            {
+                _logger.LogInformation("[DevDataSeeder] creating demo tenant '{TenantId}'", demo.Id);
+            }
             await tenantService.CreateAsync(
                 demo.Id,
                 demo.Name,
@@ -142,7 +151,10 @@ private async Task WaitForProvisioningAsync(
             }
             await Task.Delay(TimeSpan.FromSeconds(2), cancellationToken).ConfigureAwait(false);
         }
-        _logger.LogWarning("[DevDataSeeder] tenant '{TenantId}' did not finish provisioning within 2 minutes; skipping user seed", tenantId);
+        if (_logger.IsEnabled(LogLevel.Warning))
+        {
+            _logger.LogWarning("[DevDataSeeder] tenant '{TenantId}' did not finish provisioning within 2 minutes; skipping user seed", tenantId);
+        }
     }
 
     private async Task SeedRootSuperAdminAsync(CancellationToken cancellationToken)
@@ -195,7 +207,10 @@ private async Task SeedUsersInTenantAsync(
             {
                 role = new FshRole(demoRole.Name, demoRole.Description);
                 await roleManager.CreateAsync(role).ConfigureAwait(false);
-                _logger.LogInformation("[DevDataSeeder] [{Tenant}] created custom role '{Role}'", tenant.Id, demoRole.Name);
+                if (_logger.IsEnabled(LogLevel.Information))
+                {
+                    _logger.LogInformation("[DevDataSeeder] [{Tenant}] created custom role '{Role}'", tenant.Id, demoRole.Name);
+                }
             }
 
             var existingClaims = await roleManager.GetClaimsAsync(role).ConfigureAwait(false);
@@ -237,11 +252,14 @@ private async Task SeedUsersInTenantAsync(
                 var created = await userManager.CreateAsync(user).ConfigureAwait(false);
                 if (!created.Succeeded)
                 {
-                    _logger.LogWarning(
-                        "[DevDataSeeder] [{Tenant}] failed to create '{Email}': {Errors}",
-                        tenant.Id,
-                        demoUser.Email,
-                        string.Join("; ", created.Errors.Select(e => e.Description)));
+                    if (_logger.IsEnabled(LogLevel.Warning))
+                    {
+                        _logger.LogWarning(
+                            "[DevDataSeeder] [{Tenant}] failed to create '{Email}': {Errors}",
+                            tenant.Id,
+                            demoUser.Email,
+                            string.Join("; ", created.Errors.Select(e => e.Description)));
+                    }
                     continue;
                 }
                 existing = user;
@@ -305,27 +323,33 @@ private async Task EnsureSharedPasswordAsync(
         var result = await userManager.UpdateAsync(user).ConfigureAwait(false);
         if (!result.Succeeded)
         {
-            _logger.LogWarning(
-                "[DevDataSeeder] failed to reset password for '{Email}': {Errors}",
-                user.Email,
-                string.Join("; ", result.Errors.Select(e => e.Description)));
+            if (_logger.IsEnabled(LogLevel.Warning))
+            {
+                _logger.LogWarning(
+                    "[DevDataSeeder] failed to reset password for '{Email}': {Errors}",
+                    user.Email,
+                    string.Join("; ", result.Errors.Select(e => e.Description)));
+            }
             return;
         }
 
-        _logger.LogInformation(
-            "[DevDataSeeder] aligned '{Email}' to shared dev password", user.Email);
+        if (_logger.IsEnabled(LogLevel.Information))
+        {
+            _logger.LogInformation(
+                "[DevDataSeeder] aligned '{Email}' to shared dev password", user.Email);
+        }
     }
 
     // ─── Demo content (mirrors clients/dashboard/src/pages/login.demo-accounts.ts) ───
 
-    public sealed record DemoTenant(string Id, string Name, string AdminEmail, string Issuer, bool Populated);
-    public sealed record DemoUser(
+    internal sealed record DemoTenant(string Id, string Name, string AdminEmail, string Issuer, bool Populated);
+    internal sealed record DemoUser(
         string UserName,
         string Email,
         string FirstName,
         string LastName,
         IReadOnlyList<string> Roles);
-    public sealed record DemoRole(string Name, string Description, IReadOnlyList<string> Permissions);
+    internal sealed record DemoRole(string Name, string Description, IReadOnlyList<string> Permissions);
 
     private static IReadOnlyList<DemoUser> BuildRootUsers() =>
     [

src/Modules/Auditing/Modules.Auditing/AuditingModule.cs

@@ -73,6 +73,7 @@ public void ConfigureMiddleware(IApplicationBuilder app)
 
     public void MapEndpoints(IEndpointRouteBuilder endpoints)
     {
+        ArgumentNullException.ThrowIfNull(endpoints);
         var apiVersionSet = endpoints.NewApiVersionSet()
             .HasApiVersion(new ApiVersion(1))
             .ReportApiVersions()

src/Modules/Billing/Modules.Billing/Services/BillingService.cs

@@ -42,8 +42,11 @@ public BillingService(
             .ConfigureAwait(false);
         if (existing is not null)
         {
-            _logger.LogInformation("[Billing] invoice already exists for tenant {TenantId} period {Year}-{Month:00}, skipping",
-                tenantId, periodYear, periodMonth);
+            if (_logger.IsEnabled(LogLevel.Information))
+            {
+                _logger.LogInformation("[Billing] invoice already exists for tenant {TenantId} period {Year}-{Month:00}, skipping",
+                    tenantId, periodYear, periodMonth);
+            }
             return existing;
         }
 
@@ -90,8 +93,11 @@ public BillingService(
 
         _db.Invoices.Add(invoice);
         await _db.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
-        _logger.LogInformation("[Billing] generated draft invoice {InvoiceNumber} for tenant {TenantId} period {Year}-{Month:00} total={Total} {Currency}",
-            invoice.InvoiceNumber, tenantId, periodYear, periodMonth, invoice.SubtotalAmount, invoice.Currency);
+        if (_logger.IsEnabled(LogLevel.Information))
+        {
+            _logger.LogInformation("[Billing] generated draft invoice {InvoiceNumber} for tenant {TenantId} period {Year}-{Month:00} total={Total} {Currency}",
+                invoice.InvoiceNumber, tenantId, periodYear, periodMonth, invoice.SubtotalAmount, invoice.Currency);
+        }
         return invoice;
     }
 

src/Modules/Billing/Modules.Billing/Services/MonthlyInvoiceJob.cs

@@ -21,11 +21,17 @@ public MonthlyInvoiceJob(IBillingService billing, ILogger<MonthlyInvoiceJob> log
     public async Task RunAsync(CancellationToken cancellationToken)
     {
         var previous = DateTime.UtcNow.AddMonths(-1);
-        _logger.LogInformation("[Billing] MonthlyInvoiceJob generating invoices for period {Year}-{Month:00}",
-            previous.Year, previous.Month);
+        if (_logger.IsEnabled(LogLevel.Information))
+        {
+            _logger.LogInformation("[Billing] MonthlyInvoiceJob generating invoices for period {Year}-{Month:00}",
+                previous.Year, previous.Month);
+        }
 
         var count = await _billing.GenerateInvoicesForAllTenantsAsync(previous.Year, previous.Month, cancellationToken).ConfigureAwait(false);
-        _logger.LogInformation("[Billing] MonthlyInvoiceJob generated {Count} draft invoices for {Year}-{Month:00}",
-            count, previous.Year, previous.Month);
+        if (_logger.IsEnabled(LogLevel.Information))
+        {
+            _logger.LogInformation("[Billing] MonthlyInvoiceJob generated {Count} draft invoices for {Year}-{Month:00}",
+                count, previous.Year, previous.Month);
+        }
     }
 }

src/Modules/Billing/Modules.Billing/Services/UsageReporter.cs

@@ -62,8 +62,11 @@ public async Task<IReadOnlyList<UsageSnapshot>> CaptureForPeriodAsync(
         }
 
         await _db.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
-        _logger.LogInformation("[Billing] captured {Count} usage snapshots for tenant {TenantId} period {Year}-{Month:00}",
-            snapshots.Count, tenantId, periodYear, periodMonth);
+        if (_logger.IsEnabled(LogLevel.Information))
+        {
+            _logger.LogInformation("[Billing] captured {Count} usage snapshots for tenant {TenantId} period {Year}-{Month:00}",
+                snapshots.Count, tenantId, periodYear, periodMonth);
+        }
         return snapshots;
     }
 }

src/Modules/Catalog/Modules.Catalog.Contracts/v1/Brands/SearchBrandsQuery.cs

@@ -4,11 +4,17 @@
 
 namespace FSH.Modules.Catalog.Contracts.v1.Brands;
 
+/// <summary>
+/// Search for brands with pagination and sorting.
+/// </summary>
+/// <param name="Search">Search term.</param>
+/// <param name="PageNumber">Page number.</param>
+/// <param name="PageSize">Page size.</param>
+/// <param name="SortBy">Sort column. One of: name | slug | createdAtUtc.</param>
+/// <param name="SortDir">Sort direction. One of: asc | desc.</param>
 public sealed record SearchBrandsQuery(
     string? Search = null,
     int PageNumber = 1,
     int PageSize = 20,
-    /// <summary>Sort column. One of: name | slug | createdAtUtc.</summary>
     string? SortBy = null,
-    /// <summary>Sort direction. One of: asc | desc.</summary>
     string? SortDir = null) : IQuery<PagedResponse<BrandDto>>;

src/Modules/Catalog/Modules.Catalog.Contracts/v1/Categories/SearchCategoriesQuery.cs

@@ -4,12 +4,19 @@
 
 namespace FSH.Modules.Catalog.Contracts.v1.Categories;
 
+/// <summary>
+/// Search for categories with pagination and sorting.
+/// </summary>
+/// <param name="Search">Search term.</param>
+/// <param name="ParentCategoryId">Optional parent category ID filter.</param>
+/// <param name="PageNumber">Page number.</param>
+/// <param name="PageSize">Page size.</param>
+/// <param name="SortBy">Sort column. One of: name | slug | createdAtUtc.</param>
+/// <param name="SortDir">Sort direction. One of: asc | desc.</param>
 public sealed record SearchCategoriesQuery(
     string? Search = null,
     Guid? ParentCategoryId = null,
     int PageNumber = 1,
     int PageSize = 50,
-    /// <summary>Sort column. One of: name | slug | createdAtUtc.</summary>
     string? SortBy = null,
-    /// <summary>Sort direction. One of: asc | desc.</summary>
     string? SortDir = null) : IQuery<PagedResponse<CategoryDto>>;