From 3dd279f34e6f5edc7390c1bb9d6cdf6465a3c64d Mon Sep 17 00:00:00 2001
From: ahall <ahall@cloudflare.com>
Date: Mon, 6 Jul 2026 09:13:37 +0100
Subject: [PATCH] docs: document secure UnsafeEntityLogging default in
 datasync-server sample (#477)

- Explicitly set UnsafeEntityLogging = false in TodoItemController and
  TodoListController with a comment explaining the sample keeps entity
  logging disabled to avoid writing TodoItem/TodoList contents to logs.
- Bump Microsoft.AspNetCore.OpenApi, Microsoft.EntityFrameworkCore.SqlServer
  and Microsoft.EntityFrameworkCore.Tools to 10.0.9 to resolve a package
  downgrade error against the repo's centrally-managed dotnet 10 version.
- Pin Microsoft.OData.Core/Edm to 8.4.3 to resolve a resulting assembly
  version conflict, matching CommunityToolkit.Datasync.Server.Abstractions'
  existing Microsoft.Spatial pin.
---
 .../Controllers/TodoItemController.cs             |  4 ++++
 .../Controllers/TodoListController.cs             |  5 ++++-
 .../Sample.Datasync.Server.csproj                 | 15 ++++++++++++---
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoItemController.cs b/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoItemController.cs
index 6a6badba..c91a77e6 100644
--- a/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoItemController.cs
+++ b/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoItemController.cs
@@ -16,5 +16,9 @@ public class TodoItemController : TableController<TodoItem>
     public TodoItemController(AppDbContext context) 
         : base(new EntityTableRepository<TodoItem>(context))
     {
+        // UnsafeEntityLogging is intentionally left at its secure default (false).
+        // This sample stores user-supplied TodoItem content (Title), so only the
+        // entity ID is logged; the full serialized entity is never written to the logs.
+        Options = new TableControllerOptions { UnsafeEntityLogging = false };
     }
 }
\ No newline at end of file
diff --git a/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoListController.cs b/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoListController.cs
index 830eeaa3..084333a5 100644
--- a/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoListController.cs
+++ b/samples/datasync-server/src/Sample.Datasync.Server/Controllers/TodoListController.cs
@@ -15,6 +15,9 @@ public class TodoListController : TableController<TodoList>
 {
     public TodoListController(AppDbContext context) : base(new EntityTableRepository<TodoList>(context))
     {
-        Options = new TableControllerOptions { EnableSoftDelete = true };
+        // UnsafeEntityLogging is intentionally left at its secure default (false).
+        // This sample stores user-supplied TodoList content (Title), so only the
+        // entity ID is logged; the full serialized entity is never written to the logs.
+        Options = new TableControllerOptions { EnableSoftDelete = true, UnsafeEntityLogging = false };
     }
 }
\ No newline at end of file
diff --git a/samples/datasync-server/src/Sample.Datasync.Server/Sample.Datasync.Server.csproj b/samples/datasync-server/src/Sample.Datasync.Server/Sample.Datasync.Server.csproj
index b15c196e..dc0d0f1e 100644
--- a/samples/datasync-server/src/Sample.Datasync.Server/Sample.Datasync.Server.csproj
+++ b/samples/datasync-server/src/Sample.Datasync.Server/Sample.Datasync.Server.csproj
@@ -7,12 +7,21 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.3" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.3" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.3">
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.9">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
+
+    <!--
+      Microsoft.AspNetCore.OData (a transitive dependency via CommunityToolkit.Datasync.Server) floats
+      Microsoft.OData.Edm to a lower version than the one CommunityToolkit.Datasync.Server.Abstractions
+      already pins Microsoft.Spatial to. Pin it explicitly here to keep the resolved assembly versions
+      consistent, matching the src/Directory.Packages.props ODataVersion.
+    -->
+    <PackageReference Include="Microsoft.OData.Core" Version="8.4.3" />
+    <PackageReference Include="Microsoft.OData.Edm" Version="8.4.3" />
   </ItemGroup>
 
   <ItemGroup>