Fix currentRole fallback logic and exclude from cached response

Co-authored-by: JerryNixon <1749983+JerryNixon@users.noreply.github.com>

Author: Copilot

src/Service/HealthCheck/ComprehensiveHealthReportResponseWriter.cs

@@ -2,7 +2,6 @@
 // Licensed under the MIT License.
 
 using System;
-using System.IO;
 using System.Text.Json;
 using System.Threading;
 using System.Threading.Tasks;
@@ -85,34 +84,33 @@ public async Task WriteResponseAsync(HttpContext context)
                     return;
                 }
 
-                string? response;
                 // Check if the cache is enabled 
                 if (config.CacheTtlSecondsForHealthReport > 0)
                 {
+                    ComprehensiveHealthCheckReport? report = null;
                     try
                     {
-                        response = await _cache.GetOrSetAsync<string?>(
+                        report = await _cache.GetOrSetAsync<ComprehensiveHealthCheckReport?>(
                             key: CACHE_KEY,
-                            async (FusionCacheFactoryExecutionContext<string?> ctx, CancellationToken ct) =>
+                            async (FusionCacheFactoryExecutionContext<ComprehensiveHealthCheckReport?> ctx, CancellationToken ct) =>
                             {
-                                string? response = await ExecuteHealthCheckAsync(config).ConfigureAwait(false);
+                                ComprehensiveHealthCheckReport? r = await _healthCheckHelper.GetHealthCheckResponseAsync(config).ConfigureAwait(false);
                                 ctx.Options.SetDuration(TimeSpan.FromSeconds(config.CacheTtlSecondsForHealthReport));
-                                return response;
+                                return r;
                             });
 
                         _logger.LogTrace($"Health check response is fetched from cache with key: {CACHE_KEY} and TTL: {config.CacheTtlSecondsForHealthReport} seconds.");
                     }
                     catch (Exception ex)
                     {
-                        response = null; // Set response to null in case of an error
                         _logger.LogError($"Error in caching health check response: {ex.Message}");
                     }
 
                     // Ensure cachedResponse is not null before calling WriteAsync
-                    if (response != null)
+                    if (report != null)
                     {
-                        // Return the cached or newly generated response
-                        await context.Response.WriteAsync(response);
+                        // Set currentRole per-request (not cached) so each caller sees their own role
+                        await context.Response.WriteAsync(SerializeReport(report with { CurrentRole = _healthCheckHelper.GetCurrentRole() }));
                     }
                     else
                     {
@@ -124,9 +122,9 @@ public async Task WriteResponseAsync(HttpContext context)
                 }
                 else
                 {
-                    response = await ExecuteHealthCheckAsync(config).ConfigureAwait(false);
+                    ComprehensiveHealthCheckReport report = await _healthCheckHelper.GetHealthCheckResponseAsync(config).ConfigureAwait(false);
                     // Return the newly generated response
-                    await context.Response.WriteAsync(response);
+                    await context.Response.WriteAsync(SerializeReport(report with { CurrentRole = _healthCheckHelper.GetCurrentRole() }));
                 }
             }
             else
@@ -139,13 +137,10 @@ public async Task WriteResponseAsync(HttpContext context)
             return;
         }
 
-        private async Task<string> ExecuteHealthCheckAsync(RuntimeConfig config)
+        private string SerializeReport(ComprehensiveHealthCheckReport report)
         {
-            ComprehensiveHealthCheckReport dabHealthCheckReport = await _healthCheckHelper.GetHealthCheckResponseAsync(config);
-            string response = JsonSerializer.Serialize(dabHealthCheckReport, options: new JsonSerializerOptions { WriteIndented = true, DefaultIgnoreCondition = System.Text.Json.Serialization.JsonIgnoreCondition.WhenWritingNull });
-            _logger.LogTrace($"Health check response writer writing status as: {dabHealthCheckReport.Status}");
-
-            return response;
+            _logger.LogTrace($"Health check response writer writing status as: {report.Status}");
+            return JsonSerializer.Serialize(report, options: new JsonSerializerOptions { WriteIndented = true, DefaultIgnoreCondition = System.Text.Json.Serialization.JsonIgnoreCondition.WhenWritingNull });
         }
     }
 }

src/Service/HealthCheck/HealthCheckHelper.cs

@@ -58,7 +58,6 @@ public async Task<ComprehensiveHealthCheckReport> GetHealthCheckResponseAsync(Ru
             ComprehensiveHealthCheckReport comprehensiveHealthCheckReport = new();
             UpdateVersionAndAppName(ref comprehensiveHealthCheckReport);
             UpdateTimestampOfResponse(ref comprehensiveHealthCheckReport);
-            comprehensiveHealthCheckReport.CurrentRole = AuthorizationResolver.ROLE_ANONYMOUS;
             UpdateDabConfigurationDetails(ref comprehensiveHealthCheckReport, runtimeConfig);
             await UpdateHealthCheckDetailsAsync(comprehensiveHealthCheckReport, runtimeConfig);
             UpdateOverallHealthStatus(ref comprehensiveHealthCheckReport);
@@ -88,6 +87,17 @@ public void StoreIncomingRoleHeader(HttpContext httpContext)
             }
         }
 
+        // Returns the effective role for the current request.
+        // Falls back to "authenticated" if a bearer token is present, or "anonymous" otherwise.
+        public string GetCurrentRole()
+        {
+            return !string.IsNullOrEmpty(_incomingRoleHeader)
+                ? _incomingRoleHeader
+                : !string.IsNullOrEmpty(_incomingRoleToken)
+                    ? AuthorizationResolver.ROLE_AUTHENTICATED
+                    : AuthorizationResolver.ROLE_ANONYMOUS;
+        }
+
         /// <summary>
         /// Checks if the incoming request is allowed to access the health check endpoint.
         /// Anonymous requests are only allowed in Development Mode.