fix: per-topic Kafka builder methods drop SASL_SSL credentials from ConsumerConfig/ProducerConfig

[lahma]

Description

GetEffectiveConsumerConfig() already inherited BootstrapServers and GroupId from the parent transport config (the latter fixed in #3174), but not SecurityProtocol/SaslMechanism/SaslUsername/SaslPassword.

BeginAtEarliest()/BeginAtLatest()/UseReadCommitted()/UseCooperativeStickyAssignment() (listener-level)/UseStaticMembership()/TailFromLatest() all build a fresh per-topic ConsumerConfig containing only the one property each sets (e.g. topic.ConsumerConfig ??= new ConsumerConfig(); topic.ConsumerConfig.AutoOffsetReset = ...). A listener that uses any of these without a trailing ExtendConsumerConfiguration(...) call therefore ends up with a ConsumerConfig missing the transport's security settings entirely.

This is a real production incident, not a theoretical gap. Against a SASL_SSL-secured broker (Confluent Cloud, in our case), the resulting client silently attempts a plaintext connection. The broker can't parse the plaintext bytes as TLS and closes the connection during the very first, pre-auth step (APIVERSION_QUERY) — logged as a Local_AllBrokersDown/"1/1 brokers are down" cycle that repeats indefinitely since the bootstrap connection never progresses past the handshake. This ran undetected in our deployment for about two weeks: outbound publishing was unaffected (producers use the fully-configured parent ProducerConfig), the admin-client-based health check uses a separate, fully-explicit config path, and downstream consumers just kept serving stale data instead of erroring.

The identical pattern exists on the producer side: UseIdempotentProducer() builds a fresh ProducerConfig containing only EnableIdempotence, and GetEffectiveProducerConfig() only backfilled BootstrapServers.

Fix

Add SecurityProtocol/SaslMechanism/SaslUsername/SaslPassword backfill to both GetEffectiveConsumerConfig() and GetEffectiveProducerConfig(), using the exact same pattern already used for BootstrapServers/GroupId (only backfill when the topic-level value is unset, so explicit per-topic overrides still win).

Tests

Added coverage for every affected builder method on both the consumer and producer side, following the existing begin_at_earliest_inherits_group_id_from_parent_transport-style pattern in KafkaTransportTests.cs, plus a producer-side case in kafka_eos_building_blocks.cs alongside the existing subscriber_idempotent_producer test.

Test plan

• dotnet test on Wolverine.Kafka.Tests (net10.0) — all tests pass, including the new SASL_SSL inheritance cases
• Verified against a real SASL_SSL-secured Confluent Cloud cluster: reproduced the exact APIVERSION_QUERY/Local_AllBrokersDown failure signature with the bug present, confirmed clean connection with the fix

[Copilot]

Pull request overview

This PR fixes a Kafka transport configuration inheritance bug where per-topic builder methods (that create sparse ConsumerConfig/ProducerConfig instances) could unintentionally drop transport-level SASL/TLS-related settings, leading to failed authentication/handshake against secured brokers.

Changes:

• Backfill SecurityProtocol, SaslMechanism, SaslUsername, and SaslPassword from the parent transport into topic-level ConsumerConfig/ProducerConfig when those values are unset.
• Add unit tests covering SASL_SSL inheritance behavior for the affected listener and subscriber builder methods.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/Transports/Kafka/Wolverine.Kafka/KafkaTopic.cs	Extends effective config inheritance to include SASL/security properties for both consumer and producer configs.
src/Transports/Kafka/Wolverine.Kafka.Tests/KafkaTransportTests.cs	Adds tests verifying consumer-side SASL_SSL inheritance across multiple per-topic builder methods.
src/Transports/Kafka/Wolverine.Kafka.Tests/kafka_eos_building_blocks.cs	Adds a test verifying producer-side SASL_SSL inheritance when using UseIdempotentProducer().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.