Enforce middleware accessibility rules: private rejected, internal scoped to assembly

[Copilot]

Private middleware cannot be used and must either be made internal/public or marked [FoundatioIgnore]. Internal middleware is only accessible within its defining assembly.

Changes

Diagnostic FMED006 - Emitted when private middleware is detected without [FoundatioIgnore]:

// Error: FMED006
private class MyMiddleware 
{
    public static void Before(object message) { }
}

// OK: Explicitly ignored
[FoundatioIgnore]
private class MyMiddleware { }

// OK: Internal middleware usable in same assembly
internal static class MyMiddleware { }

Cross-assembly filtering - MetadataMiddlewareScanner now excludes non-public middleware when scanning referenced assemblies marked with [assembly: FoundatioModule]. Only public middleware is discovered cross-assembly.

MiddlewareInfo tracking - Added DeclaredAccessibility and AssemblyName properties to enable proper visibility enforcement.

Tests Added

• Private middleware without ignore → FMED006 error
• Private middleware with [FoundatioIgnore] → no error
• Internal middleware same-assembly → works
• Internal/private middleware cross-assembly → filtered out

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Non-public middleware should be only used where appropriate</issue_title>
<issue_description>In internal middleware class should only be used within the same project. A private middleware class should not be used and should create a build error if it's not marked as ignored.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Non-public middleware should be only used where appropriate #17

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ ejsmith
❌ Copilot
_{You have signed the CLA already but the status is still pending? Let us recheck it.}