AutoTask.Psa.Api 1.1.27

• net10.0

  • Microsoft.Extensions.Logging.Abstractions (>= 10.0.11)
  • Refit (>= 15.2.0)
  • System.ComponentModel.Annotations (>= 5.0.0)

Fixes GetEntityInfoAsync, which threw for every entity (issue #2). RestUserAccessLevel
was declared with no members, so the userAccessForCreate / Delete / Query / Update
strings AutoTask returns had nothing to bind to and deserialization failed. It now
carries the documented None, All and Restricted levels, reads either the name AutoTask
sends or the number it documents, and maps anything unrecognised to Unknown rather than
failing the whole response. EntityInformationModel.UserAccessForCreate had a private
setter and so was never populated at all; it is now settable like its three siblings.

TicketNotes gains CreateAsync, PatchAsync and UpdateAsync on the flat collection
(issue #1). AutoTask documents the entity as Can Create and Can Update; previously a
note could only be written through the child route under a ticket. There is still no
delete, which matches the entity's documented capabilities.

Breaking change: serialization moved from Newtonsoft.Json to System.Text.Json, and the
Newtonsoft.Json package reference is gone.

Entity serialization is unaffected - Refit was already using its System.Text.Json content
serializer, so the Newtonsoft attributes on the models had no effect. Only the raw-JSON
helpers on AutoTaskClient change shape:

- GetJObjectAsync is now GetJsonObjectAsync and returns System.Text.Json.Nodes.JsonObject?
 in place of Newtonsoft.Json.Linq.JObject?.
- Both GetAllAsync overloads now return List<JsonObject> in place of List<JObject>.

Callers of those three methods need updating; paging, error and empty-body behaviour is
unchanged and is now covered by unit tests. Everything reached through the entity
properties (Tickets, Companies and the rest) is source-compatible.

Also in this release: the entity endpoints are built on first use rather than all 249 of
them in the constructor, so constructing an AutoTaskClient is considerably cheaper. Each
property still returns the same instance every time it is read.

Security fix: sensitive HTTP headers are now redacted in diagnostic output.

Previously AuthenticatedHttpClientHandler passed the request header collection straight to the
logger at Debug level. HttpHeaders.ToString() applies no filtering, so the three headers this
client authenticates with were written verbatim - including Secret, which carries the account
password in plain text. Any consumer running at Debug retained usable credentials for the life
of its log store.

Secret, UserName and ApiIntegrationCode are now redacted, along with Authorization,
Proxy-Authorization, Cookie, Set-Cookie and common API key header names, case-insensitively.
The credential length is retained, so requests remain diagnosable without exposing the value.

Consumers should upgrade and then review existing Debug logs for previously captured
credentials.

Also in this release: logging of response content when an exception occurs, which must be
enabled through the client options LogExceptionContent property.