andy
9f22b522df
Move Saxonite’s projects into a dedicated `Workspace` folder and align the solution with .NET 10 and the current Common workspace. Update encryption integration, test project structure and coverage, and repository guidance and upgrade notes. - Relocate application and library projects while retaining Git rename history. - Split tests into Admin, Online, and Shared projects; add representative behavioral and serialization tests. - Update Common integration, application version, and repository documentation. Application version: 1.3.0 Reviewed-on: #1 Co-authored-by: andy <andy@sarand.com>
2.7 KiB
.NET and Authenticated Encryption Upgrade
Date started: 2026-10-16
Framework and Common Alignment
All Saxonite projects have been retargeted from .NET 6 to .NET 10. The solution's relative references now resolve to sibling Common-VS/Workspace; SaxoniteStandardBase references Common's SacsBusinessBase for the shared item option definition. Razor runtime compilation was moved to 10.0.12, and redundant legacy System.Collections.Specialized and ASP.NET Identity package references were removed where the framework/API now supplies the needed surface.
Restore and Debug build completed. The build succeeds; restore reports inherited package vulnerability advisories detailed below. All three test projects pass (Admin: 7 tests; Online: 7 tests; Shared: 37 tests). Coverage includes purpose isolation, tamper rejection, omission of IV fields from serialized session data, representative shared bus rules and XML serialization, and Admin/Online model behavior.
Authenticated Encryption
Saxonite callers now use Common's purpose-bound SACSENC2. AES-GCM wrappers with distinct purposes for Admin and Online parameters, keep-logged-in cookies, password-reset links, and Online ID obfuscation. Fixed and session IV state has been removed from application session data and reset-link encryption. Decryption remains fail-closed with no legacy CBC fallback.
This is an intentional clean break. Existing encrypted keep-logged-in cookies, password-reset links, and encrypted session/query parameters will no longer decrypt and users may need to sign in again or request a new password-reset link. Admin and Online purposes are separated even where they share key material. Common's migration record is ../../../Common-VS/Workspace/docs/authenticated-encryption-migration.md.
Remaining Validation and Package Work
Saxonite's three test projects now use the aligned test stack: NUnit 4.6.1, NUnit3TestAdapter 6.3.1, NUnit.Analyzers 4.15.0, Microsoft.NET.Test.Sdk 18.11.0, Moq 4.21.0, and coverlet.collector 10.1.0. Existing test cases were migrated from MSTest attributes and assertions. The tests are a targeted baseline, not a full coverage measure.
The restore reports moderate and high severity advisories for Common's SixLabors.ImageSharp 3.1.12 and System.Security.Cryptography.Xml/Pkcs 10.0.12 (with Pkcs 10.0.0 also in part of the graph). These package references belong to Common projects and are outside the Saxonite upgrade scope. Reassess after Common is updated independently.
Runtime validation with machine-specific configuration and database access remains outstanding. The current tests are focused unit tests and do not verify deployment configuration or production flows.