case 4690 - remove MiniProfiler (never used): packages, wiring, profiler auth workaround, credits entry

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

devdocs/modernization/NET10-PORT.md

@@ -96,7 +96,7 @@ them. Items touching those three areas carry more weight here than they did in S
   - AppArmor restricts unprivileged user namespaces on Ubuntu 24.04+, which affects the Chrome sandbox
 - [ ] Remaining packages to current releases. MailKit 4.5.0 carried a moderate advisory (NU1902); on `net10.0` the audit also reported high-severity NU1903 for `MimeKit` 4.5.0 and transitive `System.Security.Cryptography.Pkcs` 8.0.0. **Mail done:** MailKit/MimeKit 4.18.1, BouncyCastle 2.7.0, and `System.Security.Cryptography.Pkcs` 10.0.13 pinned directly (MimeKit only requires 10.0.0, which has advisories). `dotnet list package --vulnerable --include-transitive`: none. After the upgrade, check what still pulls in `System.Text.Json` 5.0.2
 - [ ] Warnings: CA2022 → `ReadExactly` at `FileUtil.cs:875` (**licence build-date path**: covered by the licence gate); ASP0019 → header indexer instead of `Headers.Append` at `Startup.cs:514`
-- [ ] **MiniProfiler. Present, not absent.** `MiniProfiler.AspNetCore.Mvc` and `.EntityFrameworkCore` 4.3.8 (`AyaNova.csproj:48-49`); `AddMiniProfiler(...).AddEntityFramework()` (`Startup.cs:62-74`); auth workaround for `/profiler/results` (`Startup.cs:393-441`); `UseMiniProfiler()` (`Startup.cs:530`); `using StackExchange.Profiling.Internal` (`ReportBiz.cs:14`). Nothing in `raven-client`. Keep and upgrade, or remove: see Open questions
+- [x] **MiniProfiler. Present, not absent. Removed** (John's decision, as in Sockeye `6dd2b09`): both packages, `AddMemoryCache`/`AddMiniProfiler`/`UseMiniProfiler`, the `/profiler/results` download-token workaround in the auth middleware, the unused `using` in `ReportBiz.cs`, three commented-out `using` lines, and the credit in `docs/.../appendix-os-credits.md`. Client: `ops-profile.vue` and its route remain, but the menu entry was already commented out (`initialize.js:785`) and the page was retired after the beta (`changelog.md:519`); John may remove them. Was: `MiniProfiler.AspNetCore.Mvc` and `.EntityFrameworkCore` 4.3.8 (`AyaNova.csproj:48-49`); `AddMiniProfiler(...).AddEntityFramework()` (`Startup.cs:62-74`); auth workaround for `/profiler/results` (`Startup.cs:393-441`); `UseMiniProfiler()` (`Startup.cs:530`); `using StackExchange.Profiling.Internal` (`ReportBiz.cs:14`). Nothing in `raven-client`. Keep and upgrade, or remove: see Open questions
 - [x] **BinaryFormatter.** n/a: not used anywhere in `server/AyaNova`
 - [x] **`System.GC.Server`.** n/a: not set, so the Web SDK default (`true`) stays. On one vCPU the runtime uses workstation GC anyway, and DATAS keeps server GC lean since .NET 9
 - [ ] **`InvariantGlobalization`.** Not set. Decide on EF Core string comparison and date-parsing grounds. Note `DataListSqlFilterCriteriaBuilder.cs:835` reads `CurrentCulture.NumberFormat`. Still open in Sockeye too
@@ -172,7 +172,7 @@ suite is waiting on (case 4653, case 4654, the contract issue).
 - Does the client need a rebuild in this pass, or can its current output be carried across? Answer: yes it will have minor changes as well as version number to 8.3.0
 - Section 3: which fixes go in this branch, which in a follow-up
 - How the .NET 10 runtime gets onto Ubuntu 24.04 hosts
-- MiniProfiler (section 1): keep it and upgrade to 4.5.x (check that `MiniProfiler.EntityFrameworkCore` supports EF Core 10), or remove it in its own commit?
+- MiniProfiler (section 1): keep it and upgrade to 4.5.x (check that `MiniProfiler.EntityFrameworkCore` supports EF Core 10), or remove it in its own commit? Answer: remove it, never used
 
 ## Deferred
 
@@ -203,3 +203,4 @@ Found during the port, out of scope. One line each.
 | 2026-10-22 | PuppeteerSharp 17 → 25.15.0; launch arguments as separate elements | Builds (only CA2022). Rendered all 24 work order and customer reports through the API (`render-job`, poll, download) for records 1 and 2: on PuppeteerSharp 17 (baseline), on 25 with default arguments, and on 25 with `AYANOVA_REPORT_RENDER_BROWSER_PARAMS="--no-sandbox  --disable-gpu"`. 24/24 ok each time, page counts identical; PDFs 5–20% smaller with Chrome 155. Integration suite = baseline. PDFs kept in the scratchpad for John's visual check |
 | 2026-10-22 | John's visual check of the PuppeteerSharp 25 PDFs; `--lang` fix | Identical apart from report 80: date month/day flipped (default locale, see section 1). Probe of Chrome 124/155 with each argument set confirmed the cause. With `--lang=<server culture>`: John confirmed report 80 shows 22/10/2026 again; 22/22 render, page counts = PuppeteerSharp 17, launch arguments logged as `--no-sandbox --lang=en-CA`. Integration suite: 95 passed, 3 failed: the two known plus `FormCustom.FormCustomUpdate`, which the server log shows was the `FormFieldReference` start-up race again (`Vendor is not valid` at the first form-field use after boot; see Deferred), not this change. **Never render reports 81 (sends real email via the server's SMTP settings) or 86 (writes to the work order) in tests**; 81 ran three times on 2026-10-22 and caused bounces |
 | 2026-10-22 | Asp.Versioning 8.1.0 → 10.2.1, explicit `.AddMvc()` | Builds; new warnings AV0015/AV0016 left (see section 1) besides CA2022. `swagger.json` identical to the Swashbuckle 10 document (315 paths, 462 operations, 137 schemas, 0 differences). `api/v8/…`, `api/v8.0/…` and `?api-version=8.0` return 200 with `api-supported-versions: 8.0`; `api/v9/…` returns 404 (8.1 response for v9 not checked). Integration suite = baseline |
+| 2026-10-22 | MiniProfiler removed | Builds (only AV0015/AV0016/CA2022). No `StackExchange.Profiling`/`MiniProfiler`/`AY_PROFILER` left in the server. `/profiler/results-index` now gets the client app's `index.html` fallback like any unknown path; unauthenticated API call still 401. Integration suite = baseline |

docs/8.0/ayanova/docs/appendix-os-credits.md

@@ -31,7 +31,6 @@ We gratefully acknowledge the following open source tools and libraries that wer
 - [jose-jwt](https://github.com/dvsekhvalnov/jose-jwt)
 - [Json.NET](https://www.newtonsoft.com/json)
 - [MailKit](https://github.com/jstedfast/MailKit)
-- [MiniProfiler](https://github.com/MiniProfiler/dotnet)
 - [NLog](https://github.com/nlog/NLog/)
 - [Npgsql](https://www.npgsql.org/)
 - [PostgreSQL](https://www.postgresql.org/)

server/AyaNova/AyaNova.csproj

@@ -46,8 +46,6 @@
 
     
     <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore" Version="10.0.13" />
-    <PackageReference Include="MiniProfiler.AspNetCore.Mvc" Version="4.3.8" />
-    <PackageReference Include="MiniProfiler.EntityFrameworkCore" Version="4.3.8" />
     <PackageReference Include="NLog" Version="6.2.2" />
     <PackageReference Include="NLog.Web.AspNetCore" Version="6.2.2" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />

server/AyaNova/Controllers/ServerMetricsController.cs

@@ -14,7 +14,6 @@ using Newtonsoft.Json.Linq;
 using AyaNova.Models;
 using AyaNova.Api.ControllerHelpers;
 using AyaNova.Biz;
-//using StackExchange.Profiling;
 
 namespace AyaNova.Api.Controllers
 {

server/AyaNova/Program.cs

@@ -11,7 +11,6 @@ using NLog.Targets;
 using NLog.Config;
 using AyaNova.Util;
 using NLog;
-//using StackExchange.Profiling;
 
 namespace AyaNova
 {

server/AyaNova/Startup.cs

@@ -21,7 +21,6 @@ using AyaNova.Util;
 using AyaNova.Generator;
 using AyaNova.Biz;
 using NLog.Extensions.Logging;
-using StackExchange.Profiling;
 
 
 namespace AyaNova
@@ -56,24 +55,6 @@ namespace AyaNova
             _newLog.LogDebug("Health");
             services.AddHealthChecks().AddDbContextCheck<AyContext>(); ;
 
-            _newLog.LogDebug("Profiler");
-            //https://dotnetthoughts.net/using-miniprofiler-in-aspnetcore-webapi/
-            services.AddMemoryCache();
-            services.AddMiniProfiler(options =>
-            {
-                options.RouteBasePath = "/profiler";
-                //in testing only ignorepaths was reliable and worked and docs say it prevents any profiling at all
-                options.IgnorePath("/auth").IgnorePath("/license").IgnorePath("/user").IgnorePath("/docs").IgnorePath("/cust").IgnorePath("/notify/hello").IgnorePath("/notify/new-count");
-                options.ResultsAuthorize = request =>
-                {
-                    if (request.HttpContext.Items["AY_PROFILER_ALLOWED"] != null)
-                        return true;
-                    return false;
-                };
-
-            }).AddEntityFramework();
-
-
             //Server state service for shutting people out of api
             _newLog.LogDebug("ServerState service");
             services.AddSingleton(new AyaNova.Api.ControllerHelpers.ApiServerState());
@@ -386,56 +367,6 @@ namespace AyaNova
             {
                 if (!context.User.Identity.IsAuthenticated)
                 {
-                    #region Profiler workaround 
-                    //Is this a profiler route?  If so we're going to use the dl token to authorize
-                    if (context.Request.Path.Value.StartsWith("/profiler/results"))
-                    {
-                        //someone is requesting the profiler
-                        //check for a dl token "t" and rehydrate user if found
-                        //Note that the profiler UI triggers it's own requests to to get the token
-                        //we need to check the referer which was the first page of profile
-
-                        string token = string.Empty;
-                        //is the token in the request?
-                        if (context.Request.Query.ContainsKey("t"))
-                        {
-                            token = context.Request.Query["t"].ToString();
-                        }
-                        else if (context.Request.Headers["Referer"].Count > 0)
-                        {//Maybe it's in the referer
-                         //try to split it on the ?
-                            string[] stuff = context.Request.Headers["Referer"].ToString().Split('?');
-                            if (stuff.Count() > 1)
-                            {
-                                var q = Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(stuff[1]);
-                                if (q.ContainsKey("t"))
-                                {
-                                    token = q["t"].ToString();
-                                }
-                            }
-                        }
-
-                        if (!string.IsNullOrWhiteSpace(token))
-                        {
-                            using (AyContext ct = ServiceProviderProvider.DBContext)
-                            {
-                                var u = ct.User.AsNoTracking().SingleOrDefault(z => z.DlKey == token.ToString() && z.Active == true);
-                                if (u != null)
-                                {
-                                    //this is necessary because they might have an expired JWT but this would just keep on working without a date check
-                                    //the default is the same timespan as the jwt so it's all good
-                                    var utcNow = new DateTimeOffset(DateTime.Now.ToUniversalTime(), TimeSpan.Zero);
-                                    if (u.DlKeyExpire > utcNow.DateTime)
-                                    {
-                                        if (AyaNova.Api.ControllerHelpers.Authorized.HasReadFullRole(u.Roles, AyaType.ServerMetrics))
-                                            context.Request.HttpContext.Items["AY_PROFILER_ALLOWED"] = true;
-                                    }
-                                }
-                            }
-                        }
-                    }
-                    #endregion profiler workaround
-
                     context.Request.HttpContext.Items["AY_ROLES"] = 0;
                     await next.Invoke();
                 }
@@ -522,11 +453,6 @@ namespace AyaNova
             #endregion
 
 
-            _newLog.LogDebug("Profiler");
-            app.UseMiniProfiler();
-
-
-
             _newLog.LogDebug("Endpoints pipeline");
             app.UseEndpoints(endpoints =>
             {

server/AyaNova/biz/ReportBiz.cs

@@ -11,7 +11,6 @@ using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json.Linq;
 using PuppeteerSharp;
-using StackExchange.Profiling.Internal;
 
 namespace AyaNova.Biz
 {

server/AyaNova/generator/CoreJobMetricsSnapshot.cs

@@ -5,7 +5,6 @@ using Microsoft.Extensions.Logging;
 using AyaNova.Util;
 using AyaNova.Models;
 using Microsoft.EntityFrameworkCore;
-//using StackExchange.Profiling;
 
 
 namespace AyaNova.Biz