Fix transitive Azure role assignments through WaitFor dependencies

src/Aspire.Hosting/ApplicationModel/ResourceExtensions.cs

@@ -1416,7 +1416,6 @@ private static void CollectDependenciesFromValue(object? value, HashSet<IResourc
             {
                 newDependencies.Add(resource);
             }
-            CollectAnnotationDependencies(resource, dependencies, newDependencies);
         }
 
         // Resource builder wrapping a resource
@@ -1426,7 +1425,6 @@ private static void CollectDependenciesFromValue(object? value, HashSet<IResourc
             {
                 newDependencies.Add(resourceBuilder.Resource);
             }
-            CollectAnnotationDependencies(resourceBuilder.Resource, dependencies, newDependencies);
             value = resourceBuilder.Resource;
         }
 

tests/Aspire.Hosting.Azure.Tests/RoleAssignmentTests.cs

@@ -301,6 +301,36 @@ public async Task ClearDefaultRoleAssignmentsDoesNotAffectExplicitRoleAssignment
         Assert.NotNull(projRoles);
     }
 
+    [Fact]
+    public async Task WaitForDoesNotCreateTransitiveRoleAssignments()
+    {
+        var builder = TestDistributedApplicationBuilder.Create(DistributedApplicationOperation.Publish);
+        builder.AddAzureContainerAppEnvironment("env");
+
+        var cache = builder.AddAzureManagedRedis("cache");
+
+        var server = builder.AddProject<Project>("server", launchProfileName: null)
+            .WithHttpEndpoint()
+            .WithExternalHttpEndpoints()
+            .WithReference(cache)
+            .WaitFor(cache);
+
+        builder.AddProject<Project>("webfrontend", launchProfileName: null)
+            .WithReference(server)
+            .WaitFor(server);
+
+        var app = builder.Build();
+        var model = app.Services.GetRequiredService<DistributedApplicationModel>();
+
+        await ExecuteBeforeStartHooksAsync(app, default);
+
+        // The server should have a role assignment to the cache since it directly references it
+        Assert.Single(model.Resources.OfType<AzureProvisioningResource>(), r => r.Name == "server-roles-cache");
+
+        // The webfrontend should NOT have a role assignment to the cache since it only references the server
+        Assert.DoesNotContain(model.Resources, r => r.Name == "webfrontend-roles-cache");
+    }
+
     private static async Task RoleAssignmentTest(
         string azureResourceName,
         Action<IDistributedApplicationBuilder> configureBuilder,

tests/Aspire.Hosting.Tests/ResourceDependencyTests.cs

@@ -545,6 +545,31 @@ public async Task DirectOnlyIncludesReferencedResourcesFromConnectionString()
         Assert.Contains(postgres.Resource, dependencies);
     }
 
+    [Fact]
+    public async Task DirectOnlyDoesNotIncludeWaitForDependenciesFromReferencedResources()
+    {
+        using var builder = TestDistributedApplicationBuilder.Create();
+
+        // Chain: A -> (ref) B -> (waitfor) C
+        // A has WithReference(B) and WaitFor(B)
+        // B has WaitFor(C) but A does NOT reference C directly
+        var c = builder.AddRedis("c");
+        var b = builder.AddContainer("b", "alpine")
+            .WithHttpEndpoint(5000, 5000, "http")
+            .WaitFor(c);
+        var a = builder.AddContainer("a", "alpine")
+            .WithReference(b.GetEndpoint("http"))
+            .WaitFor(b);
+
+        var executionContext = new DistributedApplicationExecutionContext(DistributedApplicationOperation.Run);
+        var dependencies = await a.Resource.GetResourceDependenciesAsync(executionContext, ResourceDependencyDiscoveryMode.DirectOnly);
+
+        // A depends on B (via WithReference and WaitFor)
+        Assert.Contains(b.Resource, dependencies);
+        // A should NOT depend on C because C is only a WaitFor dependency of B, not of A
+        Assert.DoesNotContain(c.Resource, dependencies);
+    }
+
     [Fact]
     public async Task DefaultOverloadUsesTransitiveClosure()
     {