[DRK-135] Remove hardcoded R2 credentials from S3 blob-storage test fixture

[baoduy]

[DRK-135] Remove hardcoded R2 credentials from S3 blob-storage test fixture, wire to Minio testcontainer

The S3 blob-storage test fixture hardcoded live-looking Cloudflare R2 credentials (endpoint, access key, secret) in this public repo, and the MinioContainer it started was never actually wired up. This removes the leaked secret entirely and points the fixture at the Minio container instead, so the whole Svc.BlobStorage.Tests S3 suite runs fully offline with zero external credentials.

Changes

• S3BlobServiceFixture.cs — config now sourced from _minioContainer.GetConnectionString()/GetAccessKey()/GetSecretKey() instead of hardcoded R2 values; ForcePathStyle: true added (required for Minio's non-DNS endpoint); exposes its S3Options for direct-construction tests.
• S3BlobService.cs — strips the leading / from GetBlobLocation(blob) at all 6 call sites before using it as the S3 key (path-style + leading slash was producing SignatureDoesNotMatch against Minio); DeleteFolderAsync rewritten from a single batch DeleteObjectsAsync to one DeleteObjectAsync per key (Minio's checksum-header requirement on batch delete) — flagged inline with a ponytail: comment on the trade-off (N round-trips vs. one per 1000-key page). The shared GetBlobLocation() base (IBlobService.cs) and its locked contract test are untouched.
• BlobServiceSaveAsyncTests.cs — 4 hardcoded copies of the leaked secret/endpoint replaced with fake placeholders; one test (S3_SaveAsync_DefaultOptions_ShouldSucceed) rewired off the now-fake endpoint onto the Minio-backed fixture (it wasn't actually inert — it depended on the live R2 creds to pass); one stale leading-slash assertion updated to match the new key format.
• S3BlobServiceTest.cs — 3 new regression tests: multi-key folder delete, empty-folder delete (covering the DeleteFolderAsync rewrite), and Dispose() idempotency (previously uncovered, the main driver of the class's coverage gap).

Verification

• Full Svc.BlobStorage.Tests suite: 120/120 passing, 0 warnings.
• S3BlobService.cs line coverage: 52.94% → 94.83%.
• dotnet pack clean on touched projects; no new NuGet package.
• No R2 secret/endpoint literal remains in src/ (one pre-existing non-secret placeholder in AwsS3/README.md is untouched).
• Key rotation/revocation in Cloudflare and purging the secret from git history are tracked separately on the parent issue (DRK-135) — out of scope here (need Cloudflare/human access).

[github-actions]

📊 Code Coverage Report

| Metric | Coverage |
|--------|----------|
| **Line Coverage** | 82.2% |
| **Branch Coverage** | 80.7% |
| **Method Coverage** | 84.3% |

**Lines:** 3408/undefined covered
**Branches:** 1283/undefined covered

📈 [View Full Coverage Report](https://github.com/baoduy/DKNet/actions/runs/30971117113)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.04%. Comparing base (69af3ae) to head (080b396).
⚠️ Report is 12 commits behind head on dev.

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #339      +/-   ##
==========================================
+ Coverage   78.57%   79.04%   +0.46%     
==========================================
  Files         169      169              
  Lines        4159     4142      -17     
  Branches      611      608       -3     
==========================================
+ Hits         3268     3274       +6     
+ Misses        707      688      -19     
+ Partials      184      180       -4     

Flag	Coverage Δ
unittests	79.04% <100.00%> (+0.46%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[baoduy]

PR Review Gate — Score: 9.4 / 10 → APPROVED

PR: #339 — Remove hardcoded R2 credentials from S3 blob-storage test fixture
Base: dev ← feature/drk-135-minio-s3-fixture
Files: 4 changed (+100/−44)
CI: 6/6 passing

A clean, well-executed security fix. The hardcoded R2 credentials are fully removed, the fixture is properly wired to the Minio testcontainer, and the S3 key normalization (.TrimStart('/')) is applied consistently at all call sites. The 3 new tests cover the DeleteFolderAsync rewrite and Dispose() idempotency. The scope creep into S3BlobServiceTest.cs for new tests was explicitly approved by dev-qc's verify stage for coverage — it is spec-conformant.

Score breakdown

Category	Score	Weight
Correctness & logic	9	25%
Security	10	20%
Testing & coverage	10	20%
Maintainability & design	8	15%
Spec conformance	9	10%
Style & conventions	10	5%
AI-slop gate	10	5%

Weighted: 9.35 → rounded 9.4
Hard caps: none apply (no blocking findings, tests present, CI green, coverage ≥90%)

Auto-merge preconditions

Precondition	Status
No blocking/critical findings	✔️
No secrets in diff	✔️
CI passing	✔️ (6/6)
No protected paths	✔️
Not draft, base = dev	✔️
Coverage ≥ 90%	✔️ (94.83%)
No new external sources	✔️

Findings

praise

1. src/Services/Svc.BlobStorage.Tests/Fixtures/S3BlobServiceFixture.cs:28-31 — Hardcoded R2 credentials fully removed, fixture now sources all config from the Minio container. The Options property is a clean design choice enabling direct-service tests.

important

1. src/Services/DKNet.Svc.BlobStorage.AwsS3/S3BlobService.cs:134 — Task.WhenAll for per-key delete fires up to 1000 concurrent DeleteObjectAsync calls per page. The ponytail: comment correctly documents the ceiling and upgrade path. Acceptable for a test-only Minio backend; production S3 has the batch API available.

nit

1. src/Services/DKNet.Svc.BlobStorage.AwsS3/S3BlobService.cs:45,83,169,208,278,325 — .TrimStart('/') repeated at 6 call sites. The spec explicitly approved this over a shared helper. Precedent exists in AzureStorageBlobService which also does per-call-site normalization with RemoveHeadingSlash().

suggestion

1. src/Services/Svc.BlobStorage.Tests/Fixtures/S3BlobServiceFixture.cs:41-42 — DisablePayloadSigning appears both as the S3Options property (false on line 29) and as the in-memory config string "false" on line 41. These are functionally identical; consider using Options.DisablePayloadSigning.ToString().ToLowerInvariant() to single-source it.

Out-of-scope (pre-existing, tracked in follow-up)

1. src/Services/DKNet.Svc.BlobStorage.AwsS3/S3BlobService.cs:115-136 — DeleteFolderAsync's do-while loop never sets ContinuationToken on the ListObjectsV2Request. Folders with >1000 keys would only delete the first page. This exists in the pre-PR code and is not introduced by this change.