[mckaragoz]

Summary

Add native ASP.NET Core rate limiting to UltimateAuth endpoints and preserve client authentication state when requests receive HTTP 429.

• Classify all 79 mapped endpoints as Sensitive, Standard or Frequent, with moderate defaults, a shared credential-verification budget, and typed endpoint overrides. Preserve application native policy/disable metadata and global limiters.
• Keep UseUltimateAuth() middleware integration opt-in; enable it by default in UseUltimateAuthWithAspNetCore() with explicit opt-out. Retain original public signatures and protect repeated and child-pipeline installations.
• Partition anonymous/security-sensitive requests by the normalized connection IP and other requests by validated tenant/user identity. Device metadata uses the same trusted connection address.
• Reuse existing client results and exceptions for status 429, stable rate_limited errors and optional Retry-After. Preserve state and credentials during throttled validation/refresh, defer maintenance retries, and avoid reporting rejected logout as success.
• Add middleware, proof-preservation, authenticated partition, client-state and JavaScript regressions; reuse native middleware tests on .NET 8, 9 and 10. Synchronize the JavaScript source and minified asset.
• Document middleware ownership/defaults, rule precedence, native rejection ownership, proxy trust, deployment limits, client behavior and upgrade boundaries.

Compatibility and limitations

• Existing hosts that install UseRateLimiter() should opt out of helper-owned installation. Native endpoint policies do not compose; built-in inline policies own their rejection response. Select an application named policy to use application rejection behavior.
• Limits are process-local. Hosts configure trusted forwarding explicitly; UltimateAuth does not trust raw forwarding headers. Shared NATs and fleet-wide quotas need deployment-specific tuning.
• Browser-owned credential navigation cannot expose the final page's status or retry delay through the existing SDK contract. Cross-origin clients need Retry-After exposed by CORS; missing guidance uses the documented maintenance cooldown. Logout redirect/network failure can leave the server outcome uncertain and is not automatically replayed.

Validation

Executed in Release using SDK 10.0.403; no test filters:

Check	Result
Complete unit suite (.NET 10)	2,817 passed, 0 failed/skipped
Complete integration suite (.NET 10)	400 passed, 0 failed/skipped
Complete EF Core integration suite (.NET 10)	3 passed, 0 failed/skipped
Complete IdentityLab suite with PostgreSQL (.NET 10)	112 passed, 0 failed/skipped
Native rate-limiting compatibility (.NET 8 / 9 / 10)	18 passed on each runtime, 0 failed/skipped
JavaScript source	19 passed, 0 failed/skipped
Freshly minified JavaScript	Same 19 passed; byte-identical to the checked-in asset
Release build of UltimateAuth.slnx	Succeeded, 0 errors; 2 existing CS0618 warnings in unchanged unit-test code
Release pack: Core, Server, Client, Client.Blazor, Client.AspNetCore	All five succeeded without warnings; verified net8.0/net9.0/net10.0 assemblies in each package and synchronized Blazor static asset

All 3,386 .NET tests passed with no failures or skips. The test builds also reported existing CS0618 obsolete-uniqueness warnings in unchanged reference/test code and MUD0002 in the unchanged IdentityLab dashboard. No new package dependencies or target-framework changes were introduced.

The full solution build regenerated documentation JSON caches; those build outputs were removed from this change. The final diff contains only the 48 intended source, test, documentation and solution files.

The main shared business-flow fixture opts out of throttling to avoid shared-host quota interference. The explicit limiter/client regression fixtures enable real middleware and exercise rejection, proof/refresh preservation, authenticated isolation and global/native-policy interaction.

git diff --check passes. The whitespace formatter initially flagged new compact initializers; those have been formatted. Its remaining 18 diagnostics match the untouched dev versions of the same files exactly, apart from line offsets, and were left unchanged to avoid unrelated formatting changes.

[codecov]

Codecov Report

❌ Patch coverage is 89.05852% with 43 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.03%. Comparing base (1f04430) to head (d9ca163).

Files with missing lines	Patch %	Lines
...Client.Blazor/Infrastructure/UAuthRequestClient.cs	68.18%	1 Missing and 6 partials ⚠️
...mateAuth.Server/Endpoints/LogoutEndpointHandler.cs	14.28%	5 Missing and 1 partial ⚠️
...teAuth.Server/RateLimiting/UAuthRateLimitPolicy.cs	89.28%	2 Missing and 4 partials ⚠️
...am.UltimateAuth.Client/Services/UAuthFlowClient.cs	83.33%	3 Missing and 2 partials ⚠️
...Client.Blazor/Infrastructure/SessionCoordinator.cs	50.00%	4 Missing ⚠️
...imateAuth.Core/Contracts/Common/IUAuthTryResult.cs	0.00%	3 Missing ⚠️
...timateAuth.Client/Infrastructure/UAuthRateLimit.cs	78.57%	0 Missing and 3 partials ⚠️
...ateAuth.Server/Endpoints/UAuthEndpointRegistrar.cs	97.59%	1 Missing and 1 partial ⚠️
...Server/RateLimiting/UAuthEndpointClassification.cs	97.61%	1 Missing and 1 partial ⚠️
.../Options/Validators/UAuthServerOptionsValidator.cs	50.00%	0 Missing and 1 partial ⚠️
... and 4 more

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #134      +/-   ##
==========================================
+ Coverage   86.88%   87.03%   +0.15%     
==========================================
  Files         682      689       +7     
  Lines       19044    19335     +291     
  Branches     2319     2375      +56     
==========================================
+ Hits        16546    16828     +282     
+ Misses       1747     1742       -5     
- Partials      751      765      +14     

Flag	Coverage Δ
framework	87.03% <89.05%> (+0.15%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.