fix: resolve streaming responseId duplication and ownership gaps

- AIChatService: remove responseId yield from StreamingResponseCompletedUpdate;
  StreamingResponseCreatedUpdate already emits the ID early at the start of
  each API call leg, making the CompletedUpdate emit redundant and causing
  duplicate SSE events (one per leg) when tool calls are involved

- AIChatService: drop now-unnecessary per-iteration string? responseId local
  variable and the dead 
esponseId = functionResult.responseId assignment
  inside the tool-call foreach loop

- ChatController: remove 
esponseIdRecorded one-shot flag; instead record
  ownership for every non-null responseId yielded — one per response leg
  (initial + each tool-call continuation) — so tool-call continuation IDs
  are properly bound to the authenticated user before being forwarded to
  the client

- ChatController: add null-guard for userId after FindFirstValue(); [Authorize]
  + ASP.NET Identity guarantees the claim is present but the explicit check
  returns 401 early rather than silently propagating a null into validation

- ResponseIdValidationServiceTests: extract CreateCache() helper with
  SizeLimit = 10_000 matching production config, so SetSize(1) per entry
  is actually exercised in tests rather than silently ignored; add new
  RecordResponseId_SizeLimitEnforced_EntryCountedInCache test

Author: BenjaminMichaelis

EssentialCSharp.Chat.Shared/Services/AIChatService.cs

@@ -190,14 +190,12 @@ private static string SanitizeForXmlContext(string? input) =>
     {
         await foreach (var update in streamingUpdates.WithCancellation(cancellationToken))
         {
-            string? responseId;
 #pragma warning disable OPENAI001 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.
             if (update is StreamingResponseCreatedUpdate created)
             {
                 // Emit the response ID early so the controller can record ownership
                 // before the stream completes — handles client disconnects mid-stream.
-                responseId = created.Response.Id;
-                yield return (string.Empty, responseId: responseId);
+                yield return (string.Empty, responseId: created.Response.Id);
             }
             else if (update is StreamingResponseOutputItemDoneUpdate itemDone)
             {
@@ -207,13 +205,11 @@ private static string SanitizeForXmlContext(string? input) =>
                     if (toolCallDepth >= 10)
                         throw new InvalidOperationException("Maximum tool call depth exceeded.");
 
-                    // Execute the function call and stream its response
+                    // Execute the function call and stream its response.
+                    // Each nested ProcessStreamingUpdatesAsync emits its own StreamingResponseCreatedUpdate
+                    // (which already yields its responseId early), so no extra tracking is needed here.
                     await foreach (var functionResult in ExecuteFunctionCallAsync(functionCallItem, responseOptions, mcpClient, toolCallDepth + 1, endUserId, cancellationToken))
                     {
-                        if (functionResult.responseId != null)
-                        {
-                            responseId = functionResult.responseId;
-                        }
                         yield return functionResult;
                     }
                 }
@@ -222,9 +218,10 @@ private static string SanitizeForXmlContext(string? input) =>
             {
                 yield return (deltaUpdate.Delta.ToString(), null);
             }
-            else if (update is StreamingResponseCompletedUpdate completedUpdate)
+            else if (update is StreamingResponseCompletedUpdate)
             {
-                yield return (string.Empty, responseId: completedUpdate.Response.Id); // Signal completion with response ID
+                // ResponseId was already emitted from StreamingResponseCreatedUpdate at the start
+                // of this response leg — no need to emit again from the completion event.
             }
 #pragma warning restore OPENAI001 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.
         }

EssentialCSharp.Web.Tests/ResponseIdValidationServiceTests.cs

@@ -5,14 +5,17 @@ namespace EssentialCSharp.Web.Tests;
 
 public class ResponseIdValidationServiceTests
 {
+    // Match production SizeLimit so SetSize(1) is exercised in tests, not silently ignored.
+    private static MemoryCache CreateCache() => new(new MemoryCacheOptions { SizeLimit = 10_000 });
+
     private static ResponseIdValidationService CreateService(MemoryCache cache) => new(cache);
 
     [Test]
     [Arguments(null)]
     [Arguments("")]
     public async Task ValidateResponseId_BlankResponseId_AllowsNewConversation(string? responseId)
     {
-        using var cache = new MemoryCache(new MemoryCacheOptions());
+        using var cache = CreateCache();
         var service = CreateService(cache);
 
         bool result = service.ValidateResponseId("user1", responseId);
@@ -25,7 +28,7 @@ public async Task ValidateResponseId_BlankResponseId_AllowsNewConversation(strin
     [Arguments("")]
     public async Task ValidateResponseId_BlankUserId_Rejects(string? userId)
     {
-        using var cache = new MemoryCache(new MemoryCacheOptions());
+        using var cache = CreateCache();
         var service = CreateService(cache);
 
         bool result = service.ValidateResponseId(userId, "resp_123");
@@ -36,7 +39,7 @@ public async Task ValidateResponseId_BlankUserId_Rejects(string? userId)
     [Test]
     public async Task ValidateResponseId_CacheMiss_AllowsGracefulDegradation()
     {
-        using var cache = new MemoryCache(new MemoryCacheOptions());
+        using var cache = CreateCache();
         var service = CreateService(cache);
         // No RecordResponseId call — simulate server restart / different instance
 
@@ -48,7 +51,7 @@ public async Task ValidateResponseId_CacheMiss_AllowsGracefulDegradation()
     [Test]
     public async Task ValidateResponseId_RecordedByOwner_Validates()
     {
-        using var cache = new MemoryCache(new MemoryCacheOptions());
+        using var cache = CreateCache();
         var service = CreateService(cache);
         service.RecordResponseId("user1", "resp_abc");
 
@@ -60,7 +63,7 @@ public async Task ValidateResponseId_RecordedByOwner_Validates()
     [Test]
     public async Task ValidateResponseId_RecordedByDifferentUser_Rejects()
     {
-        using var cache = new MemoryCache(new MemoryCacheOptions());
+        using var cache = CreateCache();
         var service = CreateService(cache);
         service.RecordResponseId("user1", "resp_abc");
 
@@ -72,7 +75,7 @@ public async Task ValidateResponseId_RecordedByDifferentUser_Rejects()
     [Test]
     public async Task RecordResponseId_NullInputs_DoesNotThrow()
     {
-        using var cache = new MemoryCache(new MemoryCacheOptions());
+        using var cache = CreateCache();
         var service = CreateService(cache);
 
         service.RecordResponseId(null, "resp_abc");
@@ -87,7 +90,7 @@ public async Task RecordResponseId_NullInputs_DoesNotThrow()
     [Test]
     public async Task ValidateResponseId_MultipleResponseIds_EachValidatedIndependently()
     {
-        using var cache = new MemoryCache(new MemoryCacheOptions());
+        using var cache = CreateCache();
         var service = CreateService(cache);
         service.RecordResponseId("user1", "resp_001");
         service.RecordResponseId("user1", "resp_002");
@@ -101,7 +104,7 @@ public async Task ValidateResponseId_MultipleResponseIds_EachValidatedIndependen
     [Test]
     public async Task ValidateResponseId_TwoUsers_IsolatedFromEachOther()
     {
-        using var cache = new MemoryCache(new MemoryCacheOptions());
+        using var cache = CreateCache();
         var service = CreateService(cache);
         service.RecordResponseId("user1", "resp_A");
         service.RecordResponseId("user2", "resp_B");
@@ -111,4 +114,17 @@ public async Task ValidateResponseId_TwoUsers_IsolatedFromEachOther()
         await Assert.That(service.ValidateResponseId("user2", "resp_A")).IsFalse();
         await Assert.That(service.ValidateResponseId("user1", "resp_B")).IsFalse();
     }
+
+    [Test]
+    public async Task RecordResponseId_SizeLimitEnforced_EntryCountedInCache()
+    {
+        using var cache = CreateCache();
+        var service = CreateService(cache);
+
+        // Record an entry — with SizeLimit set, SetSize(1) should count toward the cache size.
+        service.RecordResponseId("user1", "resp_size_test");
+
+        // Verify it was recorded (i.e., not silently evicted due to misconfiguration).
+        await Assert.That(service.ValidateResponseId("user1", "resp_size_test")).IsTrue();
+    }
 }

EssentialCSharp.Web/Controllers/ChatController.cs

@@ -33,6 +33,8 @@ public async Task<IActionResult> SendMessage([FromBody] ChatMessageRequest reque
             return BadRequest(new { error = "Message cannot be empty." });
 
         var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
+        if (string.IsNullOrEmpty(userId))
+            return Unauthorized();
 
         var previousResponseId = string.IsNullOrWhiteSpace(request.PreviousResponseId)
             ? null
@@ -70,6 +72,12 @@ public async Task StreamMessage([FromBody] ChatMessageRequest request, Cancellat
         }
 
         var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
+        if (string.IsNullOrEmpty(userId))
+        {
+            Response.StatusCode = 401;
+            await Response.WriteAsJsonAsync(new { error = "Unauthorized." }, CancellationToken.None);
+            return;
+        }
 
         var previousResponseId = string.IsNullOrWhiteSpace(request.PreviousResponseId)
             ? null
@@ -88,8 +96,6 @@ public async Task StreamMessage([FromBody] ChatMessageRequest request, Cancellat
 
         try
         {
-            bool responseIdRecorded = false;
-
             await foreach (var (text, responseId) in _AiChatService.GetChatCompletionStream(
                 prompt: request.Message,
                 previousResponseId: previousResponseId,
@@ -106,13 +112,10 @@ public async Task StreamMessage([FromBody] ChatMessageRequest request, Cancellat
 
                 if (!string.IsNullOrEmpty(responseId))
                 {
-                    // Record ownership as soon as the response ID is first observed —
-                    // if the client disconnects mid-stream the ownership is still cached.
-                    if (!responseIdRecorded)
-                    {
-                        _ResponseIdValidationService.RecordResponseId(userId, responseId);
-                        responseIdRecorded = true;
-                    }
+                    // Record ownership for every responseId emitted — one per API call leg
+                    // (initial request + each tool-call continuation). This ensures all leg IDs
+                    // are bound to the authenticated user before being forwarded to the client.
+                    _ResponseIdValidationService.RecordResponseId(userId, responseId);
                     var eventData = JsonSerializer.Serialize(new { type = "responseId", data = responseId });
                     await Response.WriteAsync($"data: {eventData}\n\n", cancellationToken);
                     await Response.Body.FlushAsync(cancellationToken);