From 0d7e417846a40f42c0932193f8796eb830f47363 Mon Sep 17 00:00:00 2001
From: AzuTear <vmbao62@hotmail.com>
Date: Sat, 1 Aug 2026 02:05:03 +0200
Subject: [PATCH] fix(build): disable OpenAPI key persistence

---
 .gitea/workflows/ci.yaml | 15 ++++++++++++---
 backend/Program.cs       |  3 +++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 8cbf16b..89002e7 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -32,8 +32,13 @@ jobs:
       - name: Restore
         run: dotnet restore backend-tests/Nexus.Api.Tests.csproj
 
-      - name: Build
-        run: dotnet build backend-tests/Nexus.Api.Tests.csproj --no-restore --configuration Release
+      - name: Build without contract-time key persistence
+        run: |
+          key_dir="$HOME/.aspnet/DataProtection-Keys"
+          before="$(find "$key_dir" -type f -name 'key-*.xml' 2>/dev/null | wc -l)"
+          dotnet build backend-tests/Nexus.Api.Tests.csproj --no-restore --configuration Release
+          after="$(find "$key_dir" -type f -name 'key-*.xml' 2>/dev/null | wc -l)"
+          test "$before" -eq "$after"
 
       - name: Verify EF migration model
         run: |
@@ -79,10 +84,14 @@ jobs:
       - name: Verify Docker endpoint
         run: docker info
 
-      - name: Restore and build
+      - name: Restore and build without contract-time key persistence
         run: |
           dotnet restore backend-tests/Nexus.Api.Tests.csproj
+          key_dir="$HOME/.aspnet/DataProtection-Keys"
+          before="$(find "$key_dir" -type f -name 'key-*.xml' 2>/dev/null | wc -l)"
           dotnet build backend-tests/Nexus.Api.Tests.csproj --no-restore --configuration Release
+          after="$(find "$key_dir" -type f -name 'key-*.xml' 2>/dev/null | wc -l)"
+          test "$before" -eq "$after"
 
       - name: Run all container-backed contracts
         run: >-
diff --git a/backend/Program.cs b/backend/Program.cs
index 69da503..3444555 100644
--- a/backend/Program.cs
+++ b/backend/Program.cs
@@ -1,6 +1,7 @@
 using Nexus.Api.Extensions;
 using Nexus.Api.Http;
 using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.DataProtection.KeyManagement;
 using System.Reflection;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -14,6 +15,8 @@ if (isOpenApiGeneration)
         "openapi-contract-generation-only-000000000000000000";
     builder.Services.AddDataProtection()
         .UseEphemeralDataProtectionProvider();
+    builder.Services.Configure<KeyManagementOptions>(options =>
+        options.AutoGenerateKeys = false);
 }
 
 // --- Service Registration ---