Derive OpenAPI parameters from the full binding chain, not just the endpoint signature (GH-3380) (#3418)

HttpChain's ApiDescription only knew about values bound by the endpoint method
itself (plus its [AsParameters] container). Anything bound elsewhere in the chain
could go undeclared:

- query string / header values bound only by an After/Finally postprocessor were
  omitted from the operation entirely
- route parameter types were read off resolved binding *variables*, so they
  silently degraded to the route constraint (or string) whenever the description
  was assembled before those frames were resolved — ASP.NET Core caches the first
  ApiExplorer read, which can happen long before codegen

CreateApiDescription now walks every MethodCall in the chain — the endpoint method,
middleware (compound handler Load/LoadAsync/Before, attribute- and policy-applied
middleware) and postprocessors — plus their [AsParameters] container members:

- every RoutePattern parameter is still declared as a required path parameter, with
  its type taken from a resolved route variable, then the binding chain (honoring
  [FromRoute(Name = "...")]), then the route constraint, and finally string
- [FromQuery]/[FromHeader] arguments anywhere in the chain are declared once,
  deduplicated by name + binding source

Also adds the OpenAPI shape-test coverage that was missing (and that let this class
of omission ship): openapi_shape_tests renders the real Microsoft.AspNetCore.OpenApi
document for an infrastructure-free host and asserts on the operation's parameters
and request body, and the WolverineWebApi Expect* attributes (now with
[ExpectParameterCount] and ExpectParameter.Required) cover the same shapes on the
Swashbuckle stack.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jeremydmiller

src/Http/Wolverine.Http.Tests.DifferentAssembly/OpenApiShapeEndpoints.cs

@@ -0,0 +1,136 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Wolverine.Http;
+
+namespace Wolverine.Http.Tests.DifferentAssembly.OpenApi;
+
+// Endpoint shapes used by the `openapi_shape_tests` harness, which renders the *real*
+// Microsoft.AspNetCore.OpenApi document for a host built on this assembly and asserts on the rendered
+// operation (parameters + request body). These live here — rather than in WolverineWebApi — because
+// this assembly has no database/Marten/EF dependencies, so the document can be generated from a host
+// that never touches infrastructure.
+//
+// To add a shape: add an endpoint below, then add a [Fact] to openapi_shape_tests.cs. The Swashbuckle
+// side of the same coverage lives in WolverineWebApi (see the Expect* attributes and
+// open_api_generation.verify_open_api_expectations).
+
+public record OrderLine(long OrderId, long OrderLineId);
+
+#region GH-3380: route values bound ONLY by a compound handler
+
+// The GH-3380 reproduction: both route ids are consumed by LoadAsync and never appear in the endpoint
+// method signature. They still have to be declared as required path parameters.
+public static class CompoundRouteOnlyEndpoint
+{
+    public static OrderLine LoadAsync([FromRoute] long orderId, [FromRoute] long orderLineId)
+        => new(orderId, orderLineId);
+
+    [WolverineGet("/shapes/orders/{orderId:long}/order-lines/{orderLineId:long}")]
+    public static string Get(OrderLine line) => $"{line.OrderId}:{line.OrderLineId}";
+}
+
+// Same, but the route token is UNCONSTRAINED — so the parameter type can only come from the binding
+// chain (the LoadAsync argument), not from a route constraint.
+public static class CompoundUnconstrainedRouteEndpoint
+{
+    public static OrderLine Before([FromRoute] long orderId) => new(orderId, 0);
+
+    [WolverineGet("/shapes/unconstrained/orders/{orderId}")]
+    public static string Get(OrderLine line) => line.OrderId.ToString();
+}
+
+// A route token bound by a renamed [FromRoute(Name = "order-id")] argument on the compound handler.
+public static class CompoundRenamedRouteEndpoint
+{
+    public static OrderLine Load([FromRoute(Name = "order-id")] long orderId) => new(orderId, 0);
+
+    [WolverineGet("/shapes/renamed/orders/{order-id:long}")]
+    public static string Get(OrderLine line) => line.OrderId.ToString();
+}
+
+// Query string + header values bound only by a compound handler method.
+public record RequestContext(string? Name, string? Tenant);
+
+public static class CompoundQueryAndHeaderEndpoint
+{
+    public static RequestContext Load([FromQuery] string? name, [FromHeader(Name = "x-tenant")] string? tenant)
+        => new(name, tenant);
+
+    [WolverineGet("/shapes/compound-query-header")]
+    public static string Get(RequestContext context) => $"{context.Name}:{context.Tenant}";
+}
+
+// A query string value bound only by an After/Finally postprocessor. Postprocessor arguments are part of
+// the endpoint's contract too.
+public static class PostprocessorQueryEndpoint
+{
+    [WolverineGet("/shapes/postprocessor/{orderId:long}")]
+    public static string Get() => "ok";
+
+    public static void After([FromQuery] string? audit)
+    {
+    }
+}
+
+#endregion
+
+#region baseline shapes: plain handler signature bindings
+
+public record CreateOrderLine(string Description, int Quantity);
+
+// Route + query bound the plain way, straight off the endpoint method signature.
+public static class PlainRouteAndQueryEndpoint
+{
+    [WolverineGet("/shapes/plain/orders/{orderId:long}")]
+    public static string Get([FromRoute] long orderId, [FromQuery] string? filter) => $"{orderId}:{filter}";
+}
+
+// A JSON request body alongside a route value that is bound only by the compound handler.
+public static class BodyWithCompoundRouteEndpoint
+{
+    public static OrderLine LoadAsync([FromRoute] long orderId) => new(orderId, 0);
+
+    [WolverinePost("/shapes/body/orders/{orderId:long}/order-lines")]
+    public static string Post(CreateOrderLine body, OrderLine line) => $"{line.OrderId}:{body.Description}";
+}
+
+// Nothing in the chain binds {code} at all — it still has to be declared as a required path parameter,
+// falling back to string.
+public static class UnboundRouteValueEndpoint
+{
+    [WolverineGet("/shapes/unbound/{code}")]
+    public static string Get() => "ok";
+}
+
+#endregion
+
+#region [AsParameters] shapes
+
+public record OrderLineQuery([FromRoute] long OrderId, [FromQuery] string? Filter);
+
+public static class AsParametersEndpoint
+{
+    [WolverineGet("/shapes/asparameters/orders/{orderId:long}")]
+    public static string Get([AsParameters] OrderLineQuery query) => $"{query.OrderId}:{query.Filter}";
+}
+
+// An [AsParameters] container on the endpoint whose route value is *also* bound by the compound handler.
+public static class AsParametersWithCompoundEndpoint
+{
+    public static OrderLine LoadAsync([FromRoute(Name = "order-id")] long orderId) => new(orderId, 0);
+
+    [WolverineGet("/shapes/asparameters-compound/orders/{order-id:long}")]
+    public static string Get([AsParameters] RenamedOrderQuery query, OrderLine line)
+        => $"{query.OrderId}:{line.OrderLineId}";
+}
+
+public class RenamedOrderQuery
+{
+    [FromRoute(Name = "order-id")]
+    public long OrderId { get; set; }
+
+    [FromQuery]
+    public string? Filter { get; set; }
+}
+
+#endregion

src/Http/Wolverine.Http.Tests/open_api_generation.cs

@@ -8,6 +8,18 @@
 
 namespace Wolverine.Http.Tests;
 
+/// <summary>
+/// The attribute-driven OpenAPI *shape* harness on the Swashbuckle stack: any endpoint in WolverineWebApi
+/// annotated with an <see cref="OpenApiExpectationAttribute"/> ([ExpectParameter], [ExpectParameterCount],
+/// [ExpectRequestBody], [ExpectNoRequestBody], [ExpectProduces], [ExpectStatusCodes], [ExpectMatch]) is fed
+/// through <see cref="verify_open_api_expectations"/>, which resolves the *rendered* OpenAPI document and
+/// validates the expectations against the real operation.
+///
+/// TO ADD A SHAPE: annotate an endpoint method in WolverineWebApi with the Expect* attributes describing
+/// what the operation must look like. No test code required — this theory picks it up automatically.
+///
+/// The Microsoft.AspNetCore.OpenApi half of the shape coverage lives in openapi_shape_tests.cs.
+/// </summary>
 public class open_api_generation : IntegrationContext
 {
     public open_api_generation(AppFixture fixture) : base(fixture)