AutoTask.Psa.Api 1.1.23

• net10.0

  • Microsoft.Extensions.Logging.Abstractions (>= 10.0.11)
  • Refit (>= 15.2.0)
  • System.ComponentModel.Annotations (>= 5.0.0)

Breaking change: serialization moved from Newtonsoft.Json to System.Text.Json, and the
Newtonsoft.Json package reference is gone.

Entity serialization is unaffected - Refit was already using its System.Text.Json content
serializer, so the Newtonsoft attributes on the models had no effect. Only the raw-JSON
helpers on AutoTaskClient change shape:

- GetJObjectAsync is now GetJsonObjectAsync and returns System.Text.Json.Nodes.JsonObject?
 in place of Newtonsoft.Json.Linq.JObject?.
- Both GetAllAsync overloads now return List<JsonObject> in place of List<JObject>.

Callers of those three methods need updating; paging, error and empty-body behaviour is
unchanged and is now covered by unit tests. Everything reached through the entity
properties (Tickets, Companies and the rest) is source-compatible.

Also in this release: the entity endpoints are built on first use rather than all 249 of
them in the constructor, so constructing an AutoTaskClient is considerably cheaper. Each
property still returns the same instance every time it is read.

Security fix: sensitive HTTP headers are now redacted in diagnostic output.

Previously AuthenticatedHttpClientHandler passed the request header collection straight to the
logger at Debug level. HttpHeaders.ToString() applies no filtering, so the three headers this
client authenticates with were written verbatim - including Secret, which carries the account
password in plain text. Any consumer running at Debug retained usable credentials for the life
of its log store.

Secret, UserName and ApiIntegrationCode are now redacted, along with Authorization,
Proxy-Authorization, Cookie, Set-Cookie and common API key header names, case-insensitively.
The credential length is retained, so requests remain diagnosable without exposing the value.

Consumers should upgrade and then review existing Debug logs for previously captured
credentials.

Also in this release: logging of response content when an exception occurs, which must be
enabled through the client options LogExceptionContent property.