From 967589e585e4c69618a4180b9f9c33668eaa66dd Mon Sep 17 00:00:00 2001
From: Proudlock <270015376@geaerospace.com>
Date: Mon, 14 Sep 2026 15:31:11 -0400
Subject: [PATCH] Fix agent build errors for .NET 8 (File.GetAccessControl
 moved to FileInfo)

Build Fix: .NET 8 API changes

Problem:
- Agent failed to compile with .NET 8.0.424
- Error: 'File' does not contain a definition for 'GetAccessControl'
- Error: 'File' does not contain a definition for 'SetAccessControl'

Root Cause:
- File.GetAccessControl() and File.SetAccessControl() removed in .NET 5+
- Moved to System.IO.FileSystem.AccessControl package as extension methods
- Methods now on FileInfo/DirectoryInfo classes, not File static class

Solution:
1. Added package reference:
   - System.IO.FileSystem.AccessControl v5.0.0 (ShopDbEndpointAgent.Core.csproj)

2. Added using directive:
   - using System.Security.AccessControl; (CertificateRenewal.cs)

3. Changed API usage (CertificateRenewal.cs:290-298):
   Before:
     var acl = File.GetAccessControl(keyFile);
     File.SetAccessControl(keyFile, acl);

   After:
     var fileInfo = new FileInfo(keyFile);
     var acl = fileInfo.GetAccessControl();
     fileInfo.SetAccessControl(acl);

Build Results:
- ShopDbEndpointAgent.Core: SUCCESS (1 warning, 0 errors)
- ShopDbEndpointAgent: SUCCESS (0 warnings, 0 errors)
- ShopDbEndpointAgent.Tray: SUCCESS (0 warnings, 0 errors)
- Published to agent/publish/agent/ and agent/publish/tray/

Context:
- Private key ACL grants required for tray app access (CertificateRenewal.cs:290)
- BUILTIN\Users group needs Read+ReadAndExecute on private key file
- Enables certificate renewal from both service and tray contexts

Related Changes:
- CertificateExpiryMonitor.cs (periodic monitoring, commit bb301c6)
- CertificateRenewal.cs (server cert validation, commit 702eeb3)
- All security fixes operational after this build

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .../ShopDbEndpointAgent.Core/CertificateRenewal.cs  | 13 +++++++------
 .../ShopDbEndpointAgent.Core.csproj                 |  3 +++
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/agent/ShopDbEndpointAgent.Core/CertificateRenewal.cs b/agent/ShopDbEndpointAgent.Core/CertificateRenewal.cs
index a01329e3..c5c8a2f9 100644
--- a/agent/ShopDbEndpointAgent.Core/CertificateRenewal.cs
+++ b/agent/ShopDbEndpointAgent.Core/CertificateRenewal.cs
@@ -1,6 +1,7 @@
 using System;
 using System.IO;
 using System.Net.Http;
+using System.Security.AccessControl;
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
 using System.Text.Json;
@@ -287,14 +288,14 @@ public class CertificateRenewal
                     var keyFile = Path.Combine(searchPath, keyPath);
                     if (File.Exists(keyFile))
                     {
-                        var acl = File.GetAccessControl(keyFile);
-                        var rule = new System.Security.AccessControl.FileSystemAccessRule(
+                        var fileInfo = new FileInfo(keyFile);
+                        var acl = fileInfo.GetAccessControl();
+                        var rule = new FileSystemAccessRule(
                             "BUILTIN\\Users",
-                            System.Security.AccessControl.FileSystemRights.Read |
-                            System.Security.AccessControl.FileSystemRights.ReadAndExecute,
-                            System.Security.AccessControl.AccessControlType.Allow);
+                            FileSystemRights.Read | FileSystemRights.ReadAndExecute,
+                            AccessControlType.Allow);
                         acl.AddAccessRule(rule);
-                        File.SetAccessControl(keyFile, acl);
+                        fileInfo.SetAccessControl(acl);
 
                         logger.LogInformation("Granted Users group access to private key at {KeyFile}", keyFile);
                         return;
diff --git a/agent/ShopDbEndpointAgent.Core/ShopDbEndpointAgent.Core.csproj b/agent/ShopDbEndpointAgent.Core/ShopDbEndpointAgent.Core.csproj
index ee711845..1a248310 100644
--- a/agent/ShopDbEndpointAgent.Core/ShopDbEndpointAgent.Core.csproj
+++ b/agent/ShopDbEndpointAgent.Core/ShopDbEndpointAgent.Core.csproj
@@ -21,6 +21,9 @@
 		 explicit DACL. The service creates it as LocalSystem, and without a
 		 granted ACE the unelevated tray cannot open it. -->
 	<PackageReference Include="System.Threading.AccessControl" Version="8.0.0" />
+	<!-- FileSystem.AccessControl: setting ACLs on private key files for certificate
+		 renewal (File.GetAccessControl/SetAccessControl moved to this package in .NET 8+) -->
+	<PackageReference Include="System.IO.FileSystem.AccessControl" Version="5.0.0" />
   </ItemGroup>
 
 </Project>