fix: handle namespace retrieval errors in AnomaliesController and add corresponding unit tests

Author: debdevops

services/api/src/ServiceHub.Api/Controllers/V1/AnomaliesController.cs

@@ -148,6 +148,12 @@ public async Task<ActionResult<AnomalyInfo>> GetById(
         // it was detected in. Return 404 (not 403) on mismatch to avoid leaking that
         // the anomaly ID exists.
         var namespaceResult = await _namespaceRepository.GetByIdAsync(result.Value.NamespaceId, cancellationToken);
+        if (namespaceResult.IsFailure
+            && namespaceResult.Error.Type != ServiceHub.Shared.Results.ErrorType.NotFound)
+        {
+            return ToActionResult<AnomalyInfo>(namespaceResult.Error);
+        }
+
         if (namespaceResult.IsFailure
             || !string.Equals(namespaceResult.Value.OwnerId, OwnerId, StringComparison.Ordinal))
         {

services/api/src/ServiceHub.Api/Middleware/EasyAuthMiddleware.cs

@@ -65,7 +65,7 @@ public EasyAuthMiddleware(
         {
             _logger.LogInformation(
                 "EasyAuth is enabled in configuration but Azure Easy Auth is not detected " +
-                "(WEBSITE_AUTH_ENABLED is not set). The X-MS-CLIENT-PRINCIPAL-ID header will be " +
+                "(WEBSITE_AUTH_ENABLED is not set to 'True'). The X-MS-CLIENT-PRINCIPAL-ID header will be " +
                 "ignored to prevent identity spoofing. If a trusted proxy strips and injects this " +
                 "header on your platform, set Security:EasyAuth:TrustClientPrincipalHeader=true.");
         }

services/api/tests/ServiceHub.UnitTests/Api/Controllers/V1/AnomaliesControllerTests.cs

@@ -224,6 +224,47 @@ public async Task GetById_NamespaceOwnedByAnotherTenant_ShouldReturnNotFound()
         result.Result.Should().BeOfType<NotFoundObjectResult>();
     }
 
+    [Fact]
+    public async Task GetById_NamespaceNotFound_ShouldReturnNotFound()
+    {
+        var anomaly = Anomaly.Create(
+            Guid.NewGuid(),
+            "test-queue",
+            AnomalyType.HighMessageVolume,
+            50,
+            "Message volume anomaly");
+
+        _aiServiceClient.Setup(a => a.GetAnomalyByIdAsync(anomaly.Id, It.IsAny<CancellationToken>()))
+            .ReturnsAsync(Result<Anomaly>.Success(anomaly));
+        _namespaceRepository.Setup(r => r.GetByIdAsync(anomaly.NamespaceId, It.IsAny<CancellationToken>()))
+            .ReturnsAsync(Result<Namespace>.Failure(Error.NotFound("NOT_FOUND", "Namespace not found")));
+
+        var result = await _controller.GetById(anomaly.Id);
+
+        result.Result.Should().BeOfType<NotFoundObjectResult>();
+    }
+
+    [Fact]
+    public async Task GetById_NamespaceLookupFails_ShouldPropagateError()
+    {
+        var anomaly = Anomaly.Create(
+            Guid.NewGuid(),
+            "test-queue",
+            AnomalyType.HighMessageVolume,
+            50,
+            "Message volume anomaly");
+
+        _aiServiceClient.Setup(a => a.GetAnomalyByIdAsync(anomaly.Id, It.IsAny<CancellationToken>()))
+            .ReturnsAsync(Result<Anomaly>.Success(anomaly));
+        _namespaceRepository.Setup(r => r.GetByIdAsync(anomaly.NamespaceId, It.IsAny<CancellationToken>()))
+            .ReturnsAsync(Result<Namespace>.Failure(Error.Internal("DB_ERR", "Database unavailable")));
+
+        var result = await _controller.GetById(anomaly.Id);
+
+        var objectResult = result.Result.Should().BeOfType<ObjectResult>().Subject;
+        objectResult.StatusCode.Should().Be(StatusCodes.Status500InternalServerError);
+    }
+
     [Fact]
     public async Task GetById_NotFound_ShouldReturnNotFound()
     {

services/api/tests/ServiceHub.UnitTests/Api/Middleware/EasyAuthMiddlewareTests.cs

@@ -76,6 +76,7 @@ public async Task InvokeAsync_BehindAzureEasyAuth_ShouldAuthenticateFromHeader()
     {
         // Azure App Service sets WEBSITE_AUTH_ENABLED=True on the worker when
         // Easy Auth is active — the only environment where the header is unforgeable.
+        var previousValue = Environment.GetEnvironmentVariable("WEBSITE_AUTH_ENABLED");
         Environment.SetEnvironmentVariable("WEBSITE_AUTH_ENABLED", "True");
         try
         {
@@ -92,7 +93,7 @@ public async Task InvokeAsync_BehindAzureEasyAuth_ShouldAuthenticateFromHeader()
         }
         finally
         {
-            Environment.SetEnvironmentVariable("WEBSITE_AUTH_ENABLED", null);
+            Environment.SetEnvironmentVariable("WEBSITE_AUTH_ENABLED", previousValue);
         }
     }