[davidnmbond]

• Adds IWorkPackages.UpdateAsync (PATCH /work_packages/{id}) using the existing, previously unused WorkPackageUpdate model. Relates to Missing methods #1.
• AuthenticatedHttpClientHandler.SendAsync (Lizard complexity 17, CQ-05/CQ-06): the read-method check and the request/response debug logging move into IsRead, LogRequestAsync and LogResponseAsync; behaviour unchanged.
• ReadOnlyOptionTests (12% duplication): cases share WasRefusedAsync, and a case covers UpdateAsync being refused while read-only.
• SortByTests: renders field/direction pairs and an empty sort.

Local run with CI's filter (Category!=Integration): 8 passed; line coverage 58.2% to 68.7% (TST-10 needs 60%).

Not changed, noted for review: FilterOperatorExtensions maps FilterOperator.NotEqualsOneOf to gt; OpenProject's not-equal operator is !.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 5 complexity · -2 duplication

Metric	Results
Complexity	5
Duplication	-2

View in Codacy

🟢 Coverage 100.00% diff coverage · +10.49% coverage variation

Metric	Results
Coverage variation	✅ +10.49% coverage variation (-1.00%)
Diff coverage	✅ 100.00% diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (d206234)	165	96	58.18%
Head commit (ada3c93)	166 (+1)	114 (+18)	68.67% (+10.49%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#58)	1	1	100.00%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

⚠️ Resolve issues before merging

The response logging condition in AuthenticatedHttpClientHandler can prevent response bodies from being logged for ordinary requests. This should be corrected before merging.

Additional tests are missing for successful updates, HEAD/OPTIONS handling, and extracted logging behavior.

Test suggestions

• Read-only UpdateAsync is rejected before an HTTP request is sent
• UpdateAsync successfully issues a PATCH request with the expected path and body
• Read-only GET requests remain allowed and non-read-only write requests are attempted
• Read-only HEAD and OPTIONS requests remain allowed
• Request and response debug logging continues to work after extraction
• SortBy renders populated and empty values

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. UpdateAsync successfully issues a PATCH request with the expected path and body
2. Read-only HEAD and OPTIONS requests remain allowed
3. Request and response debug logging continues to work after extraction

_{TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Check response.Content before reading and logging the response body. Using request.Content here prevents response bodies from being logged for typical GET requests.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}