[davidnmbond]

Adds IsReadOnly (default false) to OpenProjectClientOptions (HTTP-02). Enforced per request in AuthenticatedHttpClientHandler: when set, anything other than GET/HEAD/OPTIONS throws InvalidOperationException before sending (Refit wraps it in an ApiRequestException with the InvalidOperationException as inner exception). No read-only POSTs exist in this API (every POST is a create), so there is no allow-list.

Note: the OpenProjectClient(HttpClient) constructor bypasses the handler, so the option only applies to clients built from options.

Tests: Tests/ReadOnlyOptionTests.cs (4, credential-free; the read case targets an unreachable loopback port and asserts the failure is not the read-only refusal).

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 13 complexity · 2 duplication

Metric	Results
Complexity	13
Duplication	2

View in Codacy

🟢 Coverage ∅ diff coverage · +41.82% coverage variation

Metric	Results
Coverage variation	✅ +41.82% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (028ba21)	Report Missing	Report Missing	Report Missing
Head commit (c30b241)	165 (+0)	96 (+69)	58.18% (+41.82%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#57)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

✅ No blocking issues noticed

No blocking findings were identified. The authenticated handler has elevated complexity and relatively low coverage, increasing regression risk around request-policy enforcement. Tests are also missing for HEAD/OPTIONS requests and for the distinction between options-based and HttpClient-based construction.

Test suggestions

• Verify IsReadOnly defaults to false.
• Verify a POST/write request is rejected in read-only mode.
• Verify a write request is attempted when read-only mode is disabled.
• Verify GET requests are not rejected in read-only mode.
• Verify HEAD and OPTIONS requests are also permitted in read-only mode.
• Verify the option applies only to clients constructed from OpenProjectClientOptions.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify HEAD and OPTIONS requests are also permitted in read-only mode.
2. Verify the option applies only to clients constructed from OpenProjectClientOptions.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Suggestion: Consider extracting the read-only method check into a focused helper and separating other cohesive concerns in SendAsync to reduce complexity and improve testability. Add focused coverage for the extracted behavior.

See Issue in Codacy

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}