Forward the client's refspec on cached lock walks and probes

[matt-edmondson]

Fixes #47

What was wrong

Lock snapshots are cached per ?refspec= because the locking API treats the ref as an authentication input. The upstream requests behind a snapshot never sent that ref, though. UpstreamRequests.BuildLockListRequest had no refspec parameter, so two requests asked upstream the unscoped question:

• LockListRefresher.RefreshAsync, the page walk that fills the snapshot.
• LockListRefresher.ProbeAsync, the one-page check that admits a caller to the snapshot.

With the cache warm, a ref-scoped listing got the no-ref answer. A credential that upstream would refuse for that ref was admitted anyway.

Change

• BuildLockListRequest takes a refspec and sends it as an escaped refspec= query parameter when it is not null.
• RefreshAsync and ProbeAsync both pass key.Ref.
• Credential admission: the issue asked whether CredentialAdmission should key on the ref. I made it do so: ICredentialAdmission.IsAdmitted and Admit take the ref, and LockListService passes key.Ref. Without this, a probe that succeeded under one ref would let the same credential read another ref's snapshot without a probe of its own. That would undo the point of forwarding the ref on the probe.
• Admission key format: the ref goes last in the admission key, with a length prefix, because it comes straight from a query string and could contain the separator. A missing ref and an empty ref produce different keys.

Tests

• Integration: LockListCachingTests.CachedListing_ForwardsTheClientsRefspecOnTheWalkAndTheProbe records upstream query strings through a new RecordedRequest.Query on StubUpstream.
  • A cached GET /locks?refspec=refs/heads/main produces a walk and a probe that both carry refspec=refs%2Fheads%2Fmain.
  • A request with no refspec produces upstream requests without one.
• Admission: CredentialAdmissionTests.IsAdmitted_ADifferentRef_IsNotAdmitted checks that an admission under refs/heads/main does not carry over to another ref, to no ref, or to an empty ref. The existing admission tests now pass a null ref.

Checked both directions:

• With key.Ref swapped for null in the refresher and the service, the refspec case of the integration test fails. The no-refspec case is a control and passes either way.
• With the admission key ignoring the ref, all three admission cases fail.
• With the fix, the full suite passes: 331/331.

🤖 Generated with Claude Code

https://claude.ai/code/session_016wsoxnwaqMuAzvkm2xnzYh

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud