ApiExplorer doesn't propagate non-success Results types

[klinki]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I originally submitted this bug report to domaindrivendev/Swashbuckle.AspNetCore#3775 but they pointed out that this is a bug in ApiExporter.

I tried to use Results<Ok<WeatherForecast[]>, UnauthorizedHttpResult, ProblemHttpResult> as controller response type. It seems ApiExporter exports only a success response type and doesn't contain description for non-success responses.

I expected it to contain at least 401 for the UnauthorizedHttpResult in responses object.

Expected Behavior

All types from Results should be included as possible response types.

Steps To Reproduce

C# Code

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Http.HttpResults;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddControllers();
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.MapControllers();

app.Run();

public record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)
{
    public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);
}

[ApiController]
[Route("[controller]")]
public class WeatherForecastController : ControllerBase
{
    private static readonly string[] Summaries = new[]
    {
        "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
    };

    [HttpGet]
    public Results<Ok<WeatherForecast[]>, UnauthorizedHttpResult, ProblemHttpResult> Get()
    {
        try
        {
            var result = Random.Shared.Next(3);
            if (result == 1)
            {
                return TypedResults.Unauthorized();
            }

            if (result == 2)
            {
                throw new InvalidOperationException("Failed to get the weather forecast");
            }

            var forecast = Enumerable.Range(1, 5).Select(index =>
                new WeatherForecast
                (
                    DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
                    Random.Shared.Next(-20, 55),
                    Summaries[Random.Shared.Next(Summaries.Length)]
                ))
                .ToArray();

            return TypedResults.Ok(forecast);
        }
        catch (Exception ex)
        {
            return TypedResults.Problem(ex.Message);
        }
    }
}

Exceptions (if any)

No response

.NET Version

10.0.102

Anything else?

No response

[MihuBot]

I'm a bot. Here are possible duplicate issues (I may be wrong):

• [dotnet-sdk-9.0.100-rc.1.24409.1] No "400 - bad" ErrorResponse shows in CleanArchitecture app #57343
• ApiDescriptionProvider does not return SupportedResponseTypes when using controllers with Results<T> #56763
• TypedResults metadata are not inferred for API Controllers #44988

[martincostello]

I had Copilot investigate this with the view towards fixing it, and it's flushed out why it doesn't work and a partial fix for this specific scenario.

Neither UnauthorizedHttpResult nor ProblemHttpResult implement the IEndpointMetadataProvider interface, which is why those types don't contribute to the endpoint metadata, unlike Ok<T> which does:

aspnetcore/src/Http/Http.Results/src/OkOfT.cs

Lines 61 to 69 in e742462

	/// <inheritdoc/>
	static void IEndpointMetadataProvider.PopulateMetadata(MethodInfo method, EndpointBuilder builder)
	{
	ArgumentNullException.ThrowIfNull(method);
	ArgumentNullException.ThrowIfNull(builder);
	builder.Metadata.Add(ProducesResponseTypeMetadata.CreateUnvalidated(typeof(TValue), StatusCodes.Status200OK, ContentTypeConstants.ApplicationJsonContentTypes));
	builder.Metadata.Add(DisableCookieRedirectMetadata.Instance);
	}

This can be added quite easily for UnauthorizedHttpResult as it just returns a status code and no content (#45535 (comment)), but for ProblemHttpResult that's not possible to do statically as the HTTP status can be changed at runtime. This was discussed previously in #52424 (comment).

I'll open an API proposal for UnauthorizedHttpResult shortly.

[martincostello]

#65491