[thomasluizon]

Part of thomasluizon/orbit-tickets#239 (ORB-233).

Publish the deprecation contract before the social API is removed. FriendsController, PublicProfileController and the three social actions in ProfileController now use the existing [Obsolete] operation transformer from #660 and #753. ProfileResponse.Handle and ProfileResponse.SocialOptIn use property attributes, with a schema transformer in ServiceCollectionExtensions.Infrastructure.cs that publishes their deprecation flags. Both OpenAPI documents are regenerated. Existing controller tests retain their behavior assertions and identify their deprecated calls, following #753.

The only generated changes are 16 operation flags and two required profile-property flags per document. Routes, fields, handlers, scopes, tools, jobs, achievements, moderation, database schema and runtime behavior are retained for part 2.

Deprecated routes

The following operations are marked deprecated: true in both API versions:

Method	Route
GET	/api/friends
GET	/api/friends/{userId}/profile
GET	/api/friends/invite-preview
GET	/api/friends/feed
GET	/api/friends/cheers
POST	/api/friends/requests
POST	/api/friends/requests/{friendshipId}/accept
DELETE	/api/friends/{friendUserId}
POST	/api/friends/cheers
POST	/api/friends/block
DELETE	/api/friends/block/{blockedUserId}
POST	/api/friends/report
GET	/api/u/{slug}
PUT	/api/Profile/handle
PUT	/api/Profile/social-opt-in
PUT	/api/Profile/public

Property removal audit

The workflow pins oasdiff-action commit b9325c9e0a27ab65b0da3b766522cedec6be81dc. Its Dockerfile selects oasdiff v1.33.0. I built that version from its release source and ran checks changelog --id <check> for each rule below; its rule registry confirms the levels.

Schema and properties retired in part 2	Removal check	Level	This PR
ProfileResponse.handle, socialOptIn	response-required-property-removed	ERR	Both properties deprecated
ProfileResponse.publicProfile	response-optional-property-removed	INFO	Retained without a deprecation flag
PublicProfileSettings.enabled, slug, shareUrl, showStreak, showLevel, showAchievements, showTopHabits	Removed with optional publicProfile; response-optional-property-removed	INFO for parent removal	Retained
SendFriendRequestBody.handle, referralCode	request-property-removed	WARN	Route deprecated, properties retained
SendCheerBody.recipientId, habitId, note	request-property-removed	WARN	Route deprecated, properties retained
BlockUserBody.blockedUserId	request-property-removed	WARN	Route deprecated, property retained
ReportUserBody.reportedUserId, reason, details, cheerId	request-property-removed	WARN	Route deprecated, properties retained
SetHandleRequest.handle	request-property-removed	WARN	Route deprecated, property retained
SetSocialOptInRequest.enabled	request-property-removed	WARN	Route deprecated, property retained
UpdatePublicProfileRequest.enabled, showStreak, showLevel, showAchievements, showTopHabits, regenerate	request-property-removed	WARN	Route deprecated, properties retained

Other social success responses and the GDPR export have no typed response schema in the committed documents. There are no additional generated response properties to annotate. No oasdiff exclusions or severity overrides were added. Required response-field removal remains an ERR in this oasdiff version even after deprecation; part 2 must account for that separately.

External interface evidence

The schema transformer uses context.JsonTypeInfo.Properties, property metadata and schema.Properties, following the actual traversal in ASP.NET Core v10.0.13 OpenApiSchemaService. I checked the installed OpenAPI package XML interfaces and compiled against Microsoft.AspNetCore.OpenApi 10.0.13 and Microsoft.OpenApi 2.12.2. The real build output contains deprecated: true on exactly ProfileResponse.properties.handle and .socialOptIn; the generated-document tests read that output rather than a mocked external response.

Test evidence

• Before implementation: dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~FriendsControllerTests|FullyQualifiedName~PublicProfileControllerTests|FullyQualifiedName~ProfileControllerTests' --nologo passed all 48 existing tests unchanged.
• Before implementation: dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~SocialDeprecationTests --nologo failed all 34 new document cases on missing deprecation flags. The cases cover every retiring route in each document and the required profile fields. The final property test follows the verified ERR classification and checks optional publicProfile remains available.
• After implementation: the combined controller and deprecation filter passed all 82 tests, with zero skipped.
• A semantic comparison against the parent commit found exactly 18 added deprecated: true keys in each generated document and no other contract differences.
• oasdiff v1.33.0 breaking <parent>:src/Orbit.Api/openapi.json src/Orbit.Api/openapi.json --fail-on ERR, repeated for openapi_v2.json: both exited 0 with no breaking changes.
• dotnet build Orbit.slnx --nologo: exit 0, zero errors. Existing NU1608 package-version warnings remain; full compilation also reports existing API-versioning, Firebase deprecation and unrelated test warnings. No suppression or dependency changes were made.
• dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~SocialDeprecationTests --nologo: 34 passed, zero skipped after commit.
• dotnet test tests/Orbit.Domain.Tests --nologo: 736 passed, zero skipped, exit 0.
• dotnet test tests/Orbit.Application.Tests --nologo: 5,556 passed, zero skipped, exit 0.
• dotnet test tests/Orbit.Infrastructure.Tests --nologo: 3,713 passed, zero skipped, exit 0.
• dotnet test tests/Orbit.Analyzers.Tests --no-build --no-restore --nologo: 32 passed, zero skipped, exit 0.
• Pre-commit format, dash, timeless, root-allowlist and suppression checks passed. No new bare comments, pragmas or SuppressMessage entries. Both generated documents remain unchanged after rebuilding.

Both locales passed with exit code 0:

Project	en-US	pt-BR
Domain	736	736
Application	5,556	5,556
Infrastructure	3,740	3,740
Analyzer	32	32

Zero failed or skipped. Tests used dotnet test tests/Orbit.<Project>.Tests --no-build --no-restore --nologo.

• Builds passed in both locales with zero errors; warnings remain.
• Social baseline before typing rows: 47 passed. Focused social and AI-memory tests afterward: 61 passed.
• xUnit1042 was not emitted locally, so no failing analyzer reproduction was observed.
• Both contracts preserve all 29 social route cases and correctly deprecate the obsolete profile fields.

Assumptions

• The final part-1 orchestrator instruction supersedes the original deletion scope; the rejected alternative was removing runtime behavior and adding the destructive migration in this PR.
• The generated-document pattern from Deprecate legacy Google auth routes (#1528, part 1) #753 is applied in SocialDeprecationTests, since its Google-auth tests were deleted by Remove deleted Supabase sign-in path (#1528) #752; the rejected alternative was restoring unrelated auth tests.

The opening “This round” instructions govern this revision; the embedded deletion phase was not executed.

Manual steps

None for this revision. The commit is ready for the orchestrator to push to the existing PR.
tokens used
71.893
Committed merge as 67237b303a98673b069e904434e35ac77311412e.

Kept main’s single schema transformer, combined both test sets without losing routes, typed the MemberData source, and regenerated both OpenAPI documents. Working tree is clean. Nothing pushed.

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed all ten changed files, the OpenAPI transformer’s framework behavior, and the affected shared client schemas; no Critical or High regressions found.

• Route deprecation: Marks all sixteen retiring social operations deprecated in both API versions while preserving their routes, authorization, rate limits, and implementations.
• Profile metadata: Marks handle and socialOptIn deprecated through property attributes and the schema transformer without changing response fields, types, or requiredness.
• Regression coverage: Adds generated-document assertions and retains existing controller behavior tests; the focused run passed all 82 tests with zero skipped, and regeneration left both committed documents unchanged. The full suite was not rerun locally; CI Build and the OpenAPI Breaking-Change Gate have passed, with other checks still pending.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
18 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the merge changes since 9726d21; no new Critical or High regressions found.

• Consolidated schema handling: Retained main’s single property-level deprecation transformer, preserving the social profile flags without duplicate transformer logic.
• Combined regression coverage: Preserved both friends/profile and challenge/accountability route assertions, typed the MemberData source, and reused the document reader.
• Verified merged behavior: Passed all 95 focused deprecation and controller tests with zero skipped; rebuilding regenerated both OpenAPI documents without worktree changes. The full suite was not rerun locally.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}