chore(sonar): burn down 32 Roslyn/analyzer smells across API + tests

Directory.Build.props

@@ -8,11 +8,15 @@
     <AdditionalFiles Include="$(MSBuildThisFileDirectory)CodeMetricsConfig.txt" />
   </ItemGroup>
 
-  <ItemGroup Condition="'$(MSBuildProjectName)' != 'Orbit.Analyzers'">
+  <ItemGroup Condition="'$(MSBuildProjectName)' != 'Orbit.Analyzers' And '$(MSBuildProjectName)' != 'Orbit.Analyzers.CodeFixes'">
     <ProjectReference Include="$(MSBuildThisFileDirectory)src/Orbit.Analyzers/Orbit.Analyzers.csproj"
                       OutputItemType="Analyzer"
                       ReferenceOutputAssembly="false"
                       PrivateAssets="all" />
+    <ProjectReference Include="$(MSBuildThisFileDirectory)src/Orbit.Analyzers.CodeFixes/Orbit.Analyzers.CodeFixes.csproj"
+                      OutputItemType="Analyzer"
+                      ReferenceOutputAssembly="false"
+                      PrivateAssets="all" />
   </ItemGroup>
 
 </Project>

Orbit.slnx

@@ -1,6 +1,7 @@
 <Solution>
   <Folder Name="/src/">
     <Project Path="src/Orbit.Analyzers/Orbit.Analyzers.csproj" />
+    <Project Path="src/Orbit.Analyzers.CodeFixes/Orbit.Analyzers.CodeFixes.csproj" />
     <Project Path="src/Orbit.Api/Orbit.Api.csproj" />
     <Project Path="src/Orbit.Application/Orbit.Application.csproj" />
     <Project Path="src/Orbit.Domain/Orbit.Domain.csproj" />

src/Orbit.Analyzers.CodeFixes/Orbit.Analyzers.CodeFixes.csproj

@@ -0,0 +1,22 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>netstandard2.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <LangVersion>latest</LangVersion>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <IncludeBuildOutput>false</IncludeBuildOutput>
+    <EnforceExtendedAnalyzerRules>false</EnforceExtendedAnalyzerRules>
+    <IsPackable>false</IsPackable>
+    <NoWarn>$(NoWarn);RS2008</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.6.0" PrivateAssets="all" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Orbit.Analyzers\Orbit.Analyzers.csproj" />
+  </ItemGroup>
+
+</Project>

src/Orbit.Analyzers/Orbit.Analyzers.csproj

@@ -12,7 +12,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.6.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.6.0" PrivateAssets="all" />
   </ItemGroup>
 
 </Project>

src/Orbit.Api/Controllers/AdminController.cs

@@ -37,7 +37,11 @@ public async Task<IActionResult> SendMarketingBroadcast(
         if (result.IsFailure)
             return result.ToErrorResult();
 
-        LogBroadcastRequested(logger, HttpContext.GetUserId(), result.Value.RecipientCount, result.Value.WasTest);
+        if (logger.IsEnabled(LogLevel.Information))
+        {
+            var adminUserId = HttpContext.GetUserId();
+            LogBroadcastRequested(logger, adminUserId, result.Value.RecipientCount, result.Value.WasTest);
+        }
         return Accepted(new { recipientCount = result.Value.RecipientCount, test = result.Value.WasTest });
     }
 

src/Orbit.Api/Controllers/SyncControllerMutations.cs

@@ -48,7 +48,7 @@ private static async Task ApplyEntityMutationAsync<TEntity>(
         Action<TEntity> mutate,
         CancellationToken ct) where TEntity : class
     {
-        if (mutation.Action.ToLowerInvariant() != supportedAction)
+        if (!string.Equals(mutation.Action, supportedAction, StringComparison.OrdinalIgnoreCase))
             throw new InvalidOperationException($"Unsupported action: {mutation.Action} for {entityNoun}.");
 
         if (mutation.Id is null)

src/Orbit.Api/Controllers/WaitlistController.cs

@@ -33,7 +33,11 @@ public async Task<IActionResult> Join(
     {
         await mediator.Send(new JoinWaitlistCommand(request.Email, request.Language), cancellationToken);
 
-        LogWaitlistJoinRequested(logger, HttpContext.GetRequestId());
+        if (logger.IsEnabled(LogLevel.Information))
+        {
+            var requestId = HttpContext.GetRequestId();
+            LogWaitlistJoinRequested(logger, requestId);
+        }
         return Ok(new { message = "Check your inbox to confirm your spot." });
     }
 

src/Orbit.Api/Extensions/ServiceCollectionExtensions.cs

@@ -239,11 +239,9 @@ public static WebApplicationBuilder AddOrbitAuthentication(this WebApplicationBu
             };
         });
 
-        builder.Services.AddAuthorization(options =>
-        {
-            options.AddPolicy(AdminPolicy.Name, policy =>
+        builder.Services.AddAuthorizationBuilder()
+            .AddPolicy(AdminPolicy.Name, policy =>
                 policy.Requirements.Add(new AdminRequirement()));
-        });
         builder.Services.AddScoped<IAuthorizationHandler, AdminAuthorizationHandler>();
 
         return builder;

src/Orbit.Api/Middleware/MinimumVersionMiddleware.cs

@@ -44,7 +44,11 @@ public async Task InvokeAsync(HttpContext context, IAppConfigService configServi
             return;
         }
 
-        LogUpgradeRequired(logger, clientVersion, minimumVersion, context.GetRequestId());
+        if (logger.IsEnabled(LogLevel.Information))
+        {
+            var requestId = context.GetRequestId();
+            LogUpgradeRequired(logger, clientVersion, minimumVersion, requestId);
+        }
 
         context.Response.StatusCode = StatusCodes.Status426UpgradeRequired;
         context.Response.ContentType = "application/json";

src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.Persistence.cs

@@ -20,7 +20,7 @@ private async Task PersistExecutionResultsAsync(
         {
             await ConcurrencyRetry.SaveWithRetryAsync(
                 execution.UnitOfWork,
-                ct => execution.UserStreakService.RecalculateAsync(userId, ct),
+                ct => execution.UserStreakService.RecalculateAsync(userId, cancellationToken: ct),
                 cancellationToken);
         }
 

src/Orbit.Application/Chat/Commands/ProcessUserChatCommand.cs

@@ -177,7 +177,7 @@ public async Task<Result<ChatResponse>> Handle(
             goalList));
     }
 
-    private (string? AiMessage, HabitListCard? HabitList, GoalListCard? GoalList) BuildResponseCards(
+    private static (string? AiMessage, HabitListCard? HabitList, GoalListCard? GoalList) BuildResponseCards(
         string? aiMessage, ProcessUserChatCommand request, ChatContext context)
     {
         HabitListCard? habitList = null;

src/Orbit.Application/Gamification/Queries/GetRecapQuery.cs

@@ -46,7 +46,7 @@ public async Task<Result<RecapResponse>> Handle(GetRecapQuery request, Cancellat
             cancellationToken);
 
         var streakState = await userStreakService.RecalculateAsync(
-            request.UserId, cancellationToken, awardFreezeIfEligible: false);
+            request.UserId, awardFreezeIfEligible: false, cancellationToken);
 
         var metrics = RetrospectiveMetricsCalculator.Compute(
             habits.ToList(),

src/Orbit.Application/Gamification/Queries/GetStreakInfoQuery.cs

@@ -44,7 +44,7 @@ public async Task<Result<StreakInfoResponse>> Handle(GetStreakInfoQuery request,
             return Result.PayGateFailure<StreakInfoResponse>("Streak insights are a Pro feature. Upgrade to unlock!");
 
         var recalculatedStreak = await userStreakService.RecalculateAsync(
-            request.UserId, cancellationToken, awardFreezeIfEligible: false);
+            request.UserId, awardFreezeIfEligible: false, cancellationToken);
         if (recalculatedStreak is not null)
             await unitOfWork.SaveChangesAsync(cancellationToken);
 

src/Orbit.Application/Habits/Commands/BulkDeleteHabitsCommand.cs

@@ -63,7 +63,7 @@ await unitOfWork.ExecuteInTransactionAsync(async ct =>
             {
                 await ConcurrencyRetry.SaveWithRetryAsync(
                     unitOfWork,
-                    c => userStreakService.RecalculateAsync(request.UserId, c),
+                    c => userStreakService.RecalculateAsync(request.UserId, cancellationToken: c),
                     ct);
             }
         }, cancellationToken);

src/Orbit.Application/Habits/Commands/BulkLogHabitsCommand.cs

@@ -94,7 +94,7 @@ await unitOfWork.ExecuteInTransactionAsync(async ct =>
 
                 await ConcurrencyRetry.SaveWithRetryAsync(
                     unitOfWork,
-                    c => services.UserStreakService.RecalculateAsync(request.UserId, c),
+                    c => services.UserStreakService.RecalculateAsync(request.UserId, cancellationToken: c),
                     ct);
             }
         }, cancellationToken);

src/Orbit.Application/Habits/Commands/DeleteHabitCommand.cs

@@ -41,7 +41,7 @@ public async Task<Result> Handle(DeleteHabitCommand request, CancellationToken c
         await unitOfWork.SaveChangesAsync(cancellationToken);
         await ConcurrencyRetry.SaveWithRetryAsync(
             unitOfWork,
-            ct => userStreakService.RecalculateAsync(request.UserId, ct),
+            ct => userStreakService.RecalculateAsync(request.UserId, cancellationToken: ct),
             cancellationToken);
 
         var today = await userDateService.GetUserTodayAsync(request.UserId, cancellationToken);

src/Orbit.Application/Habits/Commands/LogHabitCommand.cs

@@ -141,7 +141,7 @@ private async Task<Result<LogHabitResponse>> HandleUnlogAsync(
         await ConcurrencyRetry.SaveWithRetryAsync(
             unitOfWork,
             async ct => streakState = await services.UserStreakService.RecalculateAsync(
-                habit.UserId, ct, awardFreezeIfEligible: false),
+                habit.UserId, awardFreezeIfEligible: false, ct),
             cancellationToken);
         CacheInvalidationHelper.InvalidateUserAiCaches(cache, habit.UserId, today);
 
@@ -197,7 +197,7 @@ private async Task<Result<LogHabitResponse>> HandleLogAsync(
             attempt++;
         }
 
-        var streakState = await services.UserStreakService.RecalculateAsync(request.UserId, cancellationToken);
+        var streakState = await services.UserStreakService.RecalculateAsync(request.UserId, cancellationToken: cancellationToken);
         var gamificationResult = await ProcessGamificationSafeAsync(request.UserId, request.HabitId, cancellationToken);
         await ProcessChallengeProgressSafeAsync(request.UserId, request.HabitId, cancellationToken);
         await ProcessOnboardingChecklistSafeAsync(request.UserId, OnboardingChecklistSignal.HabitLogged, cancellationToken);
@@ -243,7 +243,7 @@ private async Task PersistStreakRecalcAsync(Guid userId, CancellationToken cance
             catch (DbUpdateConcurrencyException) when (attempt < MaxLogAttempts)
             {
                 unitOfWork.ResetTracking();
-                await services.UserStreakService.RecalculateAsync(userId, cancellationToken);
+                await services.UserStreakService.RecalculateAsync(userId, cancellationToken: cancellationToken);
             }
 
             attempt++;

src/Orbit.Application/Habits/Commands/RestoreHabitCommand.cs

@@ -40,7 +40,7 @@ public async Task<Result> Handle(RestoreHabitCommand request, CancellationToken
         await unitOfWork.SaveChangesAsync(cancellationToken);
         await ConcurrencyRetry.SaveWithRetryAsync(
             unitOfWork,
-            ct => userStreakService.RecalculateAsync(request.UserId, ct),
+            ct => userStreakService.RecalculateAsync(request.UserId, cancellationToken: ct),
             cancellationToken);
 
         var today = await userDateService.GetUserTodayAsync(request.UserId, cancellationToken);

src/Orbit.Application/Habits/Queries/GetRetrospectiveQuery.cs

@@ -75,7 +75,7 @@ public async Task<Result<RetrospectiveResponse>> Handle(
             return Result.Failure<RetrospectiveResponse>(ErrorMessages.NoHabitsForPeriod);
 
         var streakState = await userStreakService.RecalculateAsync(
-            request.UserId, cancellationToken, awardFreezeIfEligible: false);
+            request.UserId, awardFreezeIfEligible: false, cancellationToken);
 
         var metrics = RetrospectiveMetricsCalculator.Compute(
             habitList,

src/Orbit.Application/Profile/Commands/SetHandleCommand.cs

@@ -25,9 +25,12 @@ public async Task<Result> Handle(SetHandleCommand request, CancellationToken can
         var normalized = request.Handle.Trim();
         var lowered = normalized.ToLowerInvariant();
 
+        // EF Core cannot translate string.Equals(StringComparison) to SQL; the case-insensitive handle match stays as ToLower(). https://github.com/dotnet/efcore/issues/1222
+#pragma warning disable CA1862
         var taken = await userRepository.AnyAsync(
             u => u.Id != request.UserId && u.Handle != null && u.Handle.ToLower() == lowered,
             cancellationToken);
+#pragma warning restore CA1862
         if (taken)
             return Result.Failure(ErrorMessages.HandleTaken);
 

src/Orbit.Application/Social/Services/FriendGraphService.cs

@@ -20,9 +20,12 @@ public class FriendGraphService(
         if (!string.IsNullOrWhiteSpace(handle))
         {
             var normalized = handle.Trim().ToLowerInvariant();
+            // EF Core cannot translate string.Equals(StringComparison) to SQL; the case-insensitive handle match stays as ToLower(). https://github.com/dotnet/efcore/issues/1222
+#pragma warning disable CA1862
             var matches = await userRepository.FindAsync(
                 u => u.Handle != null && u.Handle.ToLower() == normalized,
                 cancellationToken);
+#pragma warning restore CA1862
             return matches.Count > 0 ? matches[0] : null;
         }
 

src/Orbit.Domain/Interfaces/IUserStreakService.cs

@@ -16,6 +16,6 @@ public interface IUserStreakService
     /// <param name="cancellationToken">Cancellation.</param>
     Task<UserStreakState?> RecalculateAsync(
         Guid userId,
-        CancellationToken cancellationToken = default,
-        bool awardFreezeIfEligible = true);
+        bool awardFreezeIfEligible = true,
+        CancellationToken cancellationToken = default);
 }

src/Orbit.Infrastructure/AI/AiCompletionClient.cs

@@ -92,10 +92,10 @@ internal AiCompletionClient(
         string systemPrompt,
         string userPrompt,
         double temperature = 0.7,
-        CancellationToken cancellationToken = default,
         int? maxOutputTokens = null,
         string purpose = "text",
-        AiModelTier tier = AiModelTier.Primary)
+        AiModelTier tier = AiModelTier.Primary,
+        CancellationToken cancellationToken = default)
     {
         var messages = new List<ChatMessage>
         {
@@ -136,10 +136,10 @@ internal AiCompletionClient(
         string systemPrompt,
         string userPrompt,
         double temperature = 0.1,
-        CancellationToken cancellationToken = default,
         int? maxOutputTokens = null,
         string purpose = "json",
-        AiModelTier tier = AiModelTier.Primary)
+        AiModelTier tier = AiModelTier.Primary,
+        CancellationToken cancellationToken = default)
     {
         var messages = new List<ChatMessage>
         {

src/Orbit.Infrastructure/Services/AiGoalReviewService.cs

@@ -42,7 +42,7 @@ public async Task<Result<string>> GenerateReviewAsync(
                 "You are a goal progress coach. Review the user's active goals and provide a concise summary.",
                 prompt,
                 temperature: 0.7,
-                cancellationToken,
+                cancellationToken: cancellationToken,
                 purpose: "goal_review");
 
             if (string.IsNullOrWhiteSpace(text))

src/Orbit.Infrastructure/Services/AiIntentService.cs

@@ -236,7 +236,7 @@
         System.Diagnostics.Stopwatch stopwatch,
         bool firstTokenLogged)
     {
         foreach (var part in update.ContentUpdate.Where(part => !string.IsNullOrEmpty(part.Text)))
         {
             if (!firstTokenLogged)
             {
@@ -384,7 +384,7 @@
                 HistorySummarySystemPrompt,
                 transcript,
                 temperature: 0.2,
-                cancellationToken,
+                cancellationToken: cancellationToken,
                 maxOutputTokens: 320,
                 purpose: "history_summary");
 

src/Orbit.Infrastructure/Services/AiProactiveCheckinMessageService.cs

@@ -48,7 +48,7 @@ public sealed partial class AiProactiveCheckinMessageService(
                 "You are Astra, a supportive habit coach sending a proactive check-in push notification to help someone get back on track with the habits they fell behind on today.",
                 prompt,
                 temperature: 0.9,
-                cancellationToken,
+                cancellationToken: cancellationToken,
                 purpose: "proactive_checkin");
 
             if (string.IsNullOrWhiteSpace(text))

src/Orbit.Infrastructure/Services/AiRetrospectiveService.cs

@@ -36,7 +36,7 @@ public async Task<Result<RetrospectiveNarrative>> GenerateRetrospectiveAsync(
                 "You are a thoughtful habit coach writing retrospective reviews.",
                 prompt,
                 temperature: 0.7,
-                cancellationToken,
+                cancellationToken: cancellationToken,
                 purpose: "retrospective");
 
             if (string.IsNullOrWhiteSpace(text))

src/Orbit.Infrastructure/Services/AiSlipAlertMessageService.cs

@@ -47,7 +47,7 @@ public sealed partial class AiSlipAlertMessageService(
                 "You are a supportive habit coach sending a push notification to help someone avoid a bad habit slip-up.",
                 prompt,
                 temperature: 0.9,
-                cancellationToken,
+                cancellationToken: cancellationToken,
                 purpose: "slip_alert");
 
             if (string.IsNullOrWhiteSpace(text))

src/Orbit.Infrastructure/Services/AiSummaryService.cs

@@ -32,7 +32,7 @@ public async Task<Result<DailySummaryContent>> GenerateSummaryAsync(
                 "You are Astra, a perceptive, warm close friend who knows the person well. You notice and celebrate the good things they have already done, you treat a slip on a habit they are trying to quit as a gentle, judgment-free moment rather than something to praise, and you stay easy and unpushy about what is left. You never sound corporate, clinical, or like a coach reading a checklist. You reply with a single JSON object as instructed; the wording inside every field is plain language -- no markdown, bullets, headings, or emoji -- with no greeting and no sign-off, only in the language you are told to use.",
                 prompt,
                 temperature: 0.7,
-                cancellationToken,
+                cancellationToken: cancellationToken,
                 maxOutputTokens: 240,
                 purpose: "daily_summary");
 

src/Orbit.Infrastructure/Services/AiUsageSummaryService.cs

@@ -65,7 +65,11 @@ internal async Task SummarizeYesterdayAsync(CancellationToken cancellationToken)
             .Where(usage => usage.Date == yesterday)
             .ToListAsync(cancellationToken);
 
-        LogAiUsageSummary(logger, BuildSummaryLine(yesterday, rows, _pricing));
+        if (logger.IsEnabled(LogLevel.Information))
+        {
+            var summaryLine = BuildSummaryLine(yesterday, rows, _pricing);
+            LogAiUsageSummary(logger, summaryLine);
+        }
         _lastSummarizedDate = yesterday;
     }
 

src/Orbit.Infrastructure/Services/UserStreakService.cs

@@ -26,8 +26,8 @@ public partial class UserStreakService(
 {
     public async Task<UserStreakState?> RecalculateAsync(
         Guid userId,
-        CancellationToken cancellationToken = default,
-        bool awardFreezeIfEligible = true)
+        bool awardFreezeIfEligible = true,
+        CancellationToken cancellationToken = default)
     {
         var user = await repos.Users.FindOneTrackedAsync(
             u => u.Id == userId,

tests/Orbit.Analyzers.Tests/Orbit.Analyzers.Tests.csproj

@@ -23,6 +23,7 @@
 
   <ItemGroup>
     <ProjectReference Include="..\..\src\Orbit.Analyzers\Orbit.Analyzers.csproj" />
+    <ProjectReference Include="..\..\src\Orbit.Analyzers.CodeFixes\Orbit.Analyzers.CodeFixes.csproj" />
   </ItemGroup>
 
 </Project>

tests/Orbit.Application.Tests/Commands/Auth/SendCodeCommandHandlerTests.cs

@@ -180,7 +180,7 @@ private void AssertEnqueuedVerificationEmail(string expectedEmail, string expect
         _backgroundJobClient.Received(1).Create(
             Arg.Any<Job>(), Arg.Is<IState>(state => state is EnqueuedState));
         _enqueuedJob.Should().NotBeNull();
-        _enqueuedJob!.Type.Should().Be(typeof(SendVerificationCodeEmailJob));
+        _enqueuedJob!.Type.Should().Be<SendVerificationCodeEmailJob>();
         _enqueuedJob.Method.Name.Should().Be(nameof(SendVerificationCodeEmailJob.ExecuteAsync));
         _enqueuedJob.Args.Should().Equal(expectedEmail, expectedCode, expectedLanguage);
     }

tests/Orbit.Application.Tests/Commands/Chat/ProcessUserChatCommandHandlerTests.cs

@@ -86,7 +86,7 @@ public ProcessUserChatCommandHandlerTests()
         _catalogService.BuildDynamicSupplement(Arg.Any<AgentContextSnapshot>()).Returns("dynamic supplement");
 
         _userDateService.GetUserTodayAsync(UserId, Arg.Any<CancellationToken>()).Returns(Today);
-        _userStreakService.RecalculateAsync(UserId, Arg.Any<CancellationToken>())
+        _userStreakService.RecalculateAsync(UserId, cancellationToken: Arg.Any<CancellationToken>())
             .Returns(new UserStreakState(1, 1, Today));
         _streakGoalReadSyncer.ComputeFreshValuesAsync(Arg.Any<Guid>(), Arg.Any<DateOnly>(), Arg.Any<CancellationToken>())
             .Returns(new Dictionary<Guid, int>());