Merge branch 'develop' into feature/audit-log

Resolve conflicts and adapt the audit-log feature to develop's OpenShockDb
reorg + centralized Postgres enum registration (0f5c323):

- OpenShockContext: keep develop's .RegisterPgEnums() instead of the manual
  HasPostgresEnum chain.
- Move AuditAction into OpenShockDb/Enums with [PgEnum("audit_action")] and
  register it in NpgsqlEnumExtensions.Enums, so it flows through both
  MapPgEnums() and RegisterPgEnums(). This makes the audit_action column map as
  a real Postgres enum (addresses Copilot review comment #1).
- Move UserAuditLog into OpenShockDb/Models for folder consistency.
- Point controllers/response models at the new OpenShock.Common.OpenShockDb
  namespace for AuditAction/RoleType.

Recreate the migration on top of develop:
- Regenerate AddUserAuditLog (now 20260701144432, last in order) via EF so its
  designer + model snapshot reflect develop's refactored enums; the old
  20260612 migration sorted before AddEmailOutbox/RefactorPgEnums and left the
  snapshot inconsistent. 'has-pending-model-changes' now reports clean.

Address remaining Copilot review comments:
- Email verify: use the stored UserEmailChange.OldEmail rather than the user's
  current email, which can change between request and verification.
- Token audit metadata: persist canonical permission names via
  PermissionTypeBindings instead of PermissionType.ToString() (Shockers_Use).

Author: hhvrc

.github/workflows/ci-build.yml

@@ -43,9 +43,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: '${{ env.DOTNET_VERSION }}'
 
@@ -63,7 +63,7 @@ jobs:
 
       - name: Upload test artifacts
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: test-results
           path: artifacts/test-results
@@ -78,14 +78,14 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: '${{ env.DOTNET_VERSION }}'
 
       - name: Download test artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: test-results
           path: artifacts/test-results
@@ -136,7 +136,7 @@ jobs:
           PY
 
       - name: Upload merged coverage report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-report
           path: artifacts/coverage
@@ -157,22 +157,22 @@ jobs:
 
     steps:
       - name: Configure Pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Download merged coverage report
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: coverage-report
           path: _site/coverage
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: _site
 
       - name: Deploy Pages site
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
 
   build:
     name: Build (${{ matrix.image }})
@@ -190,7 +190,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
@@ -226,7 +226,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Log in to Container Registry
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
@@ -284,7 +284,7 @@ jobs:
     environment: development
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           sparse-checkout: |
             .github

.github/workflows/codeql.yml

@@ -27,17 +27,17 @@ jobs:
       contents: read
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      uses: github/codeql-action/init@c35d1b164463ee62a100735382aaaa525c5d3496 # codeql-bundle-v2.25.6
       with:
         languages: csharp
         build-mode: manual
 
     - name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
-      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -50,6 +50,6 @@ jobs:
         dotnet publish Cron/Cron.csproj -c Release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      uses: github/codeql-action/analyze@c35d1b164463ee62a100735382aaaa525c5d3496 # codeql-bundle-v2.25.6
       with:
         category: "/language:csharp"

.github/workflows/update-cloudflare-proxies.yml

@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.ref }}
 
-      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           global-json-file: global.json
 

API.IntegrationTests/Helpers/TestHelper.cs

@@ -2,6 +2,7 @@
 using System.Net;
 using System.Text;
 using System.Text.Json;
+using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.Extensions.DependencyInjection;
 using OpenShock.Common.Constants;
 using OpenShock.Common.OpenShockDb;
@@ -50,7 +51,7 @@ public static async Task<AuthenticatedUser> CreateAndLoginUser(
     /// </summary>
     public static HttpClient CreateAuthenticatedClient(WebApplicationFactory factory, string sessionToken)
     {
-        var client = factory.CreateClient(new Microsoft.AspNetCore.Mvc.Testing.WebApplicationFactoryClientOptions
+        var client = factory.CreateClient(new WebApplicationFactoryClientOptions
         {
             AllowAutoRedirect = false,
             HandleCookies = false
@@ -64,7 +65,7 @@ public static HttpClient CreateAuthenticatedClient(WebApplicationFactory factory
     /// </summary>
     public static HttpClient CreateApiTokenClient(WebApplicationFactory factory, string apiToken)
     {
-        var client = factory.CreateClient(new Microsoft.AspNetCore.Mvc.Testing.WebApplicationFactoryClientOptions
+        var client = factory.CreateClient(new WebApplicationFactoryClientOptions
         {
             AllowAutoRedirect = false,
             HandleCookies = false
@@ -78,7 +79,7 @@ public static HttpClient CreateApiTokenClient(WebApplicationFactory factory, str
     /// </summary>
     public static HttpClient CreateHubTokenClient(WebApplicationFactory factory, string hubToken)
     {
-        var client = factory.CreateClient(new Microsoft.AspNetCore.Mvc.Testing.WebApplicationFactoryClientOptions
+        var client = factory.CreateClient(new WebApplicationFactoryClientOptions
         {
             AllowAutoRedirect = false,
             HandleCookies = false
@@ -146,7 +147,7 @@ public static async Task<Guid> CreateUserInDb(
         WebApplicationFactory factory,
         Guid userId,
         string name = "TestToken",
-        List<Common.Models.PermissionType>? permissions = null)
+        List<PermissionType>? permissions = null)
     {
         await using var scope = factory.Services.CreateAsyncScope();
         var db = scope.ServiceProvider.GetRequiredService<OpenShockContext>();
@@ -160,7 +161,7 @@ public static async Task<Guid> CreateUserInDb(
             Name = name,
             TokenHash = HashingUtils.HashToken(rawToken),
             CreatedByIp = IPAddress.Loopback,
-            Permissions = permissions ?? [Common.Models.PermissionType.Shockers_Use]
+            Permissions = permissions ?? [PermissionType.Shockers_Use]
         });
         await db.SaveChangesAsync();
         return (tokenId, rawToken);

API.IntegrationTests/RegistrationDisabledWebApplicationFactory.cs

@@ -0,0 +1,26 @@
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using OpenShock.Common.Options;
+
+namespace OpenShock.API.IntegrationTests;
+
+/// <summary>
+/// Variant of <see cref="WebApplicationFactory"/> that runs with user registration disabled.
+/// </summary>
+public sealed class RegistrationDisabledWebApplicationFactory : WebApplicationFactory
+{
+    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    {
+        base.ConfigureWebHost(builder);
+
+        builder.ConfigureTestServices(services =>
+        {
+            var descriptor = services.SingleOrDefault(d => d.ServiceType == typeof(AccountOptions));
+            if (descriptor is not null)
+                services.Remove(descriptor);
+
+            services.AddSingleton(new AccountOptions { RegistrationEnabled = false });
+        });
+    }
+}

API.IntegrationTests/Tests/AccountLoginTests.cs

@@ -10,60 +10,20 @@ public sealed class AccountLoginTests
     [ClassDataSource<WebApplicationFactory>(Shared = SharedType.PerTestSession)]
     public required WebApplicationFactory WebApplicationFactory { get; init; }
 
-    // --- V1 Login ---
+    // --- V1 Login (retired) ---
 
     [Test]
-    public async Task V1Login_Success_ReturnsCookie()
+    public async Task V1Login_Retired_Returns410Gone()
     {
-        await TestHelper.CreateUserInDb(WebApplicationFactory, "loginv1", "loginv1@test.org", "SecurePassword123#");
-
-        using var client = WebApplicationFactory.CreateClient(new Microsoft.AspNetCore.Mvc.Testing.WebApplicationFactoryClientOptions
-        {
-            AllowAutoRedirect = false,
-            HandleCookies = false
-        });
-
-        var response = await client.PostAsync("/1/account/login", TestHelper.JsonContent(new
-        {
-            email = "loginv1@test.org",
-            password = "SecurePassword123#"
-        }));
-
-        await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.OK);
-
-        var setCookie = response.Headers.GetValues("Set-Cookie").ToArray();
-        var hasSessionCookie = setCookie.Any(c => c.Contains(AuthConstants.UserSessionCookieName));
-        await Assert.That(hasSessionCookie).IsTrue();
-    }
-
-    [Test]
-    public async Task V1Login_InvalidPassword_Returns401()
-    {
-        await TestHelper.CreateUserInDb(WebApplicationFactory, "loginv1bad", "loginv1bad@test.org", "SecurePassword123#");
-
         using var client = WebApplicationFactory.CreateClient();
 
         var response = await client.PostAsync("/1/account/login", TestHelper.JsonContent(new
         {
-            email = "loginv1bad@test.org",
-            password = "WrongPassword999!"
-        }));
-
-        await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.Unauthorized);
-    }
-
-    [Test]
-    public async Task V1Login_NonexistentUser_Returns401()
-    {
-        using var client = WebApplicationFactory.CreateClient();
-
-        var response = await client.PostAsync("/1/account/login", TestHelper.JsonContent(new
-        {
-            email = "doesnotexist@test.org",
-            password = "SomePassword123#"
+            email = "whatever@test.org",
+            password = "SecurePassword123#"
         }));
 
-        await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.Unauthorized);
+        await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.Gone);
     }
 
     // --- V2 Login ---

API.IntegrationTests/Tests/AccountSignupTests.cs

@@ -11,56 +11,21 @@ public sealed class AccountSignupTests
     [ClassDataSource<WebApplicationFactory>(Shared = SharedType.PerTestSession)]
     public required WebApplicationFactory WebApplicationFactory { get; init; }
 
-    // --- V1 Signup ---
+    // --- V1 Signup (retired) ---
 
     [Test]
-    public async Task V1Signup_Success_CreatesUser()
+    public async Task V1Signup_Retired_Returns410Gone()
     {
         using var client = WebApplicationFactory.CreateClient();
 
         var response = await client.PostAsync("/1/account/signup", TestHelper.JsonContent(new
         {
-            username = "v1user",
+            username = "v1retired",
             password = "SecurePassword123#",
-            email = "v1user@test.org"
+            email = "v1retired@test.org"
         }));
 
-        await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.OK);
-
-        await using var scope = WebApplicationFactory.Services.CreateAsyncScope();
-        var db = scope.ServiceProvider.GetRequiredService<OpenShockContext>();
-        var user = await db.Users.FirstOrDefaultAsync(u => u.Email == "v1user@test.org");
-        await Assert.That(user).IsNotNull();
-    }
-
-    [Test, DependsOn(nameof(V1Signup_Success_CreatesUser))]
-    public async Task V1Signup_DuplicateEmail_Returns409()
-    {
-        using var client = WebApplicationFactory.CreateClient();
-
-        var response = await client.PostAsync("/1/account/signup", TestHelper.JsonContent(new
-        {
-            username = "v1userDifferent",
-            password = "SecurePassword123#",
-            email = "v1user@test.org" // same email
-        }));
-
-        await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.Conflict);
-    }
-
-    [Test, DependsOn(nameof(V1Signup_Success_CreatesUser))]
-    public async Task V1Signup_DuplicateUsername_Returns409()
-    {
-        using var client = WebApplicationFactory.CreateClient();
-
-        var response = await client.PostAsync("/1/account/signup", TestHelper.JsonContent(new
-        {
-            username = "v1user", // same username
-            password = "SecurePassword123#",
-            email = "v1different@test.org"
-        }));
-
-        await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.Conflict);
+        await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.Gone);
     }
 
     // --- V2 Signup ---
@@ -118,6 +83,22 @@ public async Task V2Signup_DuplicateEmail_Returns409()
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.Conflict);
     }
 
+    [Test, DependsOn(nameof(V2Signup_Success_CreatesUser))]
+    public async Task V2Signup_DuplicateUsername_Returns409()
+    {
+        using var client = WebApplicationFactory.CreateClient();
+
+        var response = await client.PostAsync("/2/account/signup", TestHelper.JsonContent(new
+        {
+            username = "v2user", // same username
+            password = "SecurePassword123#",
+            email = "v2different@test.org",
+            turnstileResponse = "valid-token"
+        }));
+
+        await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.Conflict);
+    }
+
     // --- Validation ---
 
     [Test]