• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
No logging added: The new host/test server setup and lifecycle changes add operations without any audit or
log trail in the added lines, but as this is test code and only a partial diff, it may be
acceptable.

public async Task Setup() {
    _host = new HostBuilder()
        .ConfigureWebHost(webHostBuilder => webHostBuilder
            .UseTestServer()
            .UseStartup<Startup>()
        )
        .Build();
    await _host.StartAsync();

    _server = _host.GetTestServer();
}

[After(Test)]
public async Task Teardown() {
    _server.Dispose();
    await _host.StopAsync();
    _host.Dispose();
}

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Missing null checks: Newly added parsing and indexing assume presence and format (e.g., Guid.Parse and
streamEvents[0]) without explicit error handling or bounds checks, which may be handled
elsewhere but is not visible here.

var streamEvents = await database.StreamRangeAsync(new(stream), streamPosition).NoContext();
var entry        = streamEvents[0];

persistentEvents.Add(
    new(
        Guid.Parse(entry[MessageId].ToString()),
        entry[MessageType]!,
        entry.Id.ToLong(),
        entry.Id.ToLong(),

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Unvalidated input: The new Guid.Parse on message ID and direct dictionary/index access assume trusted data
without validation or try-parse fallbacks, which might be acceptable if upstream
guarantees exist but not shown in this diff.

evt => new ReceivedEvent(
    Guid.Parse(evt[MessageId].ToString()),
    evt[MessageType]!,
    evt.Id.ToLong(),
    evt.Id.ToLong(),
    evt[JsonData]!,

In the property group for .NET 8, change the MicrosoftExtensionsVer from 9.0.10
to a .NET 8-compatible version like 8.0.0 to avoid referencing incorrect
assemblies.

Directory.Packages.props [13-16]

 <PropertyGroup Label="Package versions for .NET 8" Condition="'$(TargetFramework)' == 'net8.0'">
   <MicrosoftTestHostVer>8.0.21</MicrosoftTestHostVer>
-  <MicrosoftExtensionsVer>9.0.10</MicrosoftExtensionsVer>
+  <MicrosoftExtensionsVer>8.0.0</MicrosoftExtensionsVer>
 </PropertyGroup>

[Suggestion processed]

Correct the package reference for System.Linq.Async to be included only when the
target framework is not net10.0, and remove the ExcludeAssets="All" attribute.

src/EventStore/src/Eventuous.EventStore/Eventuous.EventStore.csproj [17-19]

-<ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
-    <PackageReference Include="System.Linq.Async" ExcludeAssets="All"/>
+<ItemGroup Condition="'$(TargetFramework)' != 'net10.0'">
+    <PackageReference Include="System.Linq.Async" />
 </ItemGroup>

• Apply / Chat