refactor: migrate Exceptionless.Web to Minimal APIs with Foundatio.Mediator

[niemyjski]

Summary

Migrate all Exceptionless.Web controllers to Minimal API endpoints using Foundatio.Mediator for command/query dispatch.

What Changed

• Architecture: Controllers -> thin endpoint functions that delegate to Mediator handlers
• Entry Point: Consolidated Startup.cs into single minimal hosting Program.cs
• Job Runner: Modernized to WebApplication.CreateBuilder() minimal hosting
• OpenAPI: Preserved documentation, tags, parameters, response codes via endpoint/OpenAPI transformers
• Testing: Endpoint manifest + OpenAPI snapshot tests protect route/auth/contract parity

Current Audit Evidence

Area	Evidence	Status
Merge-forward	Branch contains latest origin/main merge commit 6b0c0710; origin/main is 5bde93d	PASS
Route parity	main controller manifest and branch endpoint manifest both have 209 entries / 208 unique method+route keys	PASS
Missing/extra public routes	0 missing, 0 extra by method+route comparison	PASS
OpenAPI parity	main and branch both expose 120 OpenAPI paths / 156 operations	PASS
Public API snapshots	OpenApiSnapshotTests, EndpointManifestTests, ValidationSnapshotTests passed in controller/API suite	PASS
Controller/API tests	dotnet test ... --filter-namespace Exceptionless.Tests.Controllers passed 748/748	PASS
Middleware tests	dotnet test ... --filter-namespace Exceptionless.Tests.Utility.Handlers passed 23/23	PASS
Full backend tests	dotnet test tests/Exceptionless.Tests/Exceptionless.Tests.csproj passed 2347, skipped 2 explicit/perf tests, failed 0	PASS
Frontend tests/builds	Svelte unit 293/293, Svelte build, Svelte check, Angular build	PASS
OpenSpec	openspec validate minimal-api-mediator-openapi-migration --strict --no-interactive passes after adding audit delta	PASS
Local dogfood	Svelte login/stacks/events and Angular login/frequent/events loaded locally with data	PASS with notes

Dogfood notes:

• Svelte emitted two state_proxy_equality_mismatch warnings, but no browser page errors.
• Legacy Angular emitted the existing local Exceptionless-client ApiKey is not set console error while event submission is disabled; no browser page errors were reported.

Main vs Branch Performance

Idle-machine rerun on 2026-07-08 UTC, local AppHost benchmark, browser fetch against direct Aspire API origins, Debug build, shared local Docker infra, fresh local account/project/sample data per run, 10 warmups + 50 measured samples per endpoint. Values are median / p95 milliseconds. Negative delta means the branch is faster. Main ref 5bde93d; branch head 9808110.

Endpoint	main median	branch median	median delta	main p95	branch p95	p95 delta
GET /api/v2/users/me	2.6	2.9	+11.5% slower	3.5	5.6	+60.0% slower
GET /api/v2/organizations	4.9	5.2	+6.1% slower	5.9	7.2	+22.0% slower
GET /api/v2/projects?organizationId=...	8.5	7.8	-8.2% faster	10.5	8.9	-15.2% faster
GET /api/v2/organizations/{id}/saved-views/events	6.5	6.0	-7.7% faster	9.2	9.4	+2.2% slower
GET /api/v2/projects/{id}/events?limit=10	9.8	9.5	-3.1% faster	11.1	14.5	+30.6% slower
GET /api/v2/events/count?...	11.6	10.1	-12.9% faster	23.8	11.6	-51.3% faster
GET /api/v2/events/{id}	8.5	7.1	-16.5% faster	16.6	7.9	-52.4% faster
GET /api/v2/stacks/{id}	2.2	2.1	-4.5% faster	2.8	2.5	-10.7% faster
GET /api/v2/projects/config	1.3	1.2	-7.7% faster	1.7	1.5	-11.8% faster
GET /api/v2/projects/config?v=current	1.2	1.2	0.0% equal	1.6	1.4	-12.5% faster

Performance verdict:

• Branch is faster or equal on 8/10 median paths and 7/10 p95 paths in the idle rerun.
• Aggregate endpoint medians improved from 57.1 ms to 53.1 ms across the measured set, about 7.0% faster overall by summed medians.
• The branch wins most clearly on event/count and event-detail tail latency; the previous projects-list slowdown did not reproduce.
• Watch items: users/me and organizations are slightly slower in median and p95, and events-list median is faster but p95 had branch outliers.
• ProjectConfigMiddleware still looks correct to keep: the hot path remains about 1.2 ms median and tied/faster at p95, so removing it for mediator routing would not be justified by this benchmark.
• Caveat: the benchmark seeds fresh sample data per run; response byte counts are not a formal contract diff. In this run, branch event-detail bytes were smaller than main, so public API parity should continue to rely on the snapshot/manifest tests above rather than benchmark payload size alone.

Coverage Report

Same filtered controller/API namespace on current main vs branch:

Target	Tests	Overall line	Overall branch	Focus area
main controller suite	722 passed	60.25%	49.84%	MVC controllers line 81.30%, branch 69.15%
branch controller/API suite	748 passed	60.73%	49.46%	endpoint files line 97.01%, handlers line 79.85%, filters line 100%
branch middleware suite	23 passed	18.98% suite-wide	11.06% suite-wide	ProjectConfig 100%, Throttling 84.51%, Overage 94.20%, Heartbeat 79.59%

Important coverage caveat: this is not 100% line/branch coverage. Remaining gaps are mostly handler edge paths, ApiResults helper overloads, CurrentUserAccessor, ApiValidation, and middleware edge branches. No optimization beyond the OpenSpec documentation fix was made in this audit.

Key Invariants Preserved

Invariant	Status
All public routes	PASS: 208 unique method+route keys match main exactly
Auth policies on endpoints	PASS: covered by endpoint manifest snapshot
OpenAPI path/operation count	PASS: 120 paths / 156 operations on both sides
Route constraints (token, tokens, objectid)	PASS: covered by endpoint/OpenAPI snapshots
ProblemDetails shape (instance, reference-id, errors, lower_underscore keys)	PASS: covered by validation tests/snapshots
JsonPatch/Delta replacement behavior	PASS: covered by JSON patch tests/snapshots
ThrottlingMiddleware / OverageMiddleware	PASS: unchanged and middleware tests pass
ProjectConfigMiddleware	PASS: faster locally and 100% line/branch covered in middleware suite
Health checks (/health, /ready)	PASS: preserved

Structure

src/Exceptionless.Web/Api/
  Endpoints/       thin HTTP adapters
  Messages/        command/query records
  Handlers/        use-case logic ported from controller actions
  Filters/         AutoValidationEndpointFilter, ConfigurationResponseEndpointFilter
  Results/         ApiResults, PagedResult, mapper helpers
  Infrastructure/  Pagination, TimeRangeParser, CurrentUserAccessor, validation helpers

Breaking Changes

None found in the latest audit. Public route/method parity matches origin/main; OpenAPI snapshot tests pass; local Svelte and Angular dogfood paths load with data.

Known Acceptable Differences

• StringStringValuesKeyValuePair schema removed (MVC model binding artifact) -> ProblemDetails schema added (from .ProducesProblem())
• Versioned subscribe route /api/v{apiVersion:int}/webhooks/subscribe lacks =2 default (Minimal API limitation, canonical /api/v2/webhooks/subscribe route exists)

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

[Copilot]

Copilot wasn't able to review any files in this pull request.

[ejsmith]

Fixed the partial-update compatibility issue in 113c44b.

What changed:

• Update endpoints now accept both RFC 6902 JSON Patch arrays and legacy object-shaped partial bodies before dispatching the same mediator update messages.
• Kept OpenAPI request-body metadata as JSON Patch and restored explicit endpoint display names so endpoint/OpenAPI snapshots stay stable.
• Reused the same shared parser for projects, tokens, users, organizations, and saved views.

Verification:

• dotnet build tests\Exceptionless.Tests\Exceptionless.Tests.csproj --configuration Release --no-restore --verbosity minimal /m:1
• dotnet test tests\Exceptionless.Tests\Exceptionless.Tests.csproj --configuration Release --no-build -- --filter-class Exceptionless.Tests.Controllers.TokenControllerTests --filter-class Exceptionless.Tests.Controllers.UserControllerTests --filter-class Exceptionless.Tests.Controllers.OrganizationControllerTests --filter-class Exceptionless.Tests.Controllers.SavedViewControllerTests
• dotnet test tests\Exceptionless.Tests\Exceptionless.Tests.csproj --configuration Release --no-build -- --filter-class Exceptionless.Tests.Controllers.OpenApiSnapshotTests --filter-class Exceptionless.Tests.Controllers.EndpointManifestTests --filter-class Exceptionless.Tests.Controllers.ControllerManifestTests

Note: the snapshot run on Windows required temporary local LF normalization of AuthEndpoints.cs because raw string descriptions emit CRLF from a CRLF checkout; that file was restored and is not part of the commit.

[github-actions]

Package	Line Rate	Branch Rate	Complexity	Health
Exceptionless.AppHost	39%	41%	136	❌
Exceptionless.Core	71%	64%	8644	➖
Exceptionless.Insulation	23%	23%	205	❌
Exceptionless.Web	82%	65%	6578	✔
Summary	75% (20797 / 27877)	64% (9339 / 14680)	15563	➖