Fix CMS 13 / Optimizely Identity picker & editor issues (#56)

[ivanmarkovic1402]

Issues reported here #56

[mariajemaria]

Code review — 1 substantive gap (search is not filtered by [AllowedTypes]) plus a few minor/cosmetic notes, left inline. Nice, well-tested fix set overall; strengths posted as a separate comment.

[mariajemaria]

👍 What's strong in this PR

• App-part registration is robust — the OfType<AssemblyPart>().Any(...) guard plus the dedicated DoesNotDuplicateApplicationPart_WhenAssemblyAlreadyRegistered test correctly prevents ambiguous-route double registration.
• Auth policy wiring is correct — AddOptions<AuthorizationOptions>().Configure<IOptions<CategoriesOptions>>(...) resolves the options lazily so it picks up both the setup delegate and config binding; scheme splitting uses TrimEntries | RemoveEmptyEntries; and the controller-level [Authorize(Policy = ...)] covers the new Selectable action too.
• Draft fallback is well-scoped — catches only ValidationException and re-saves the same instance with SaveAction.Save, letting other failures propagate.
• getSelectable batching — one request per tree level / search, and failures leave everything selectable so a failed lookup never blocks selection.
• MSBuild move is sound — buildTransitive/net10.0/ keeps CopyZipFiles.targets two levels below the package root so its ..\..\contentFiles path stays valid, and the <PackageId>.targets name preserves auto-import.
• Test coverage is thorough — validation-failure draft fallback, unknown/unparsable ids defaulting to selectable, no-default-scheme case, and ResolveAllowedTypes never widening to arbitrary content are all exercised. The ResolveAllowedTypes non-category guard is a nice defensive touch.

Clear, issue-referenced comments throughout make the intent of each change easy to follow. 🙌

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mariajemaria]

Approve with comments

Well-scoped, cohesive fix for the #56 integration issues on CMS 13 / OptimizelyIdentity. Excellent commenting discipline (each block cites its issue point and the why) and real server-side test coverage. Nothing blocking below — two items worth a follow-up.

Worth addressing

• Client ignores the new Published flag. categoryApi.create returns only { id, name } and the picker optimistically selects the new category. When the server saved a draft (required-fields fallback, point 5), the user ends up referencing an incomplete unpublished draft with no cue. The server plumbing (published) is in place and tested but currently unused on the client — consider surfacing a "saved as draft, complete required fields" hint.
• ResolveShellBasePath assumes the client-resource base == shell-stores base. Fix #3 derives the base from Paths.ToClientResource(...) and reuses it for cms/Stores/… and shell/Stores/…. Correct for default CMS and (per the issue) /ui/ under OptimizelyIdentity, but the module client-resource root and the shell-store root are conceptually distinct. A comment recording this as an observed assumption (link the discovery notes) would help future readers.

Minor

• Selectable is an N+1 (TryGet per id). Usually small batches, but IContentRepository.GetItems(...) would collapse it into one call.
• Search can trap an already-selected, now-non-selectable category — applySearchSelectability disables the checkbox unconditionally, unlike the tree path which notes existing selections are removed via chips. Confirm this is intended.
• Assembly dedup is guarded in code and tested for the AddApplicationPart case; module.config still lists <assemblies>. Confirm the module-loader path produces an AssemblyPart with the same Assembly instance so the part.Assembly == assembly check can't miss and double-register the route.
• Async selectability race: a user can tick a non-selectable box in the brief window before getSelectable resolves; it then becomes disabled but stays checked. Low impact.

Security

Authorization preserved and improved — class-level policy covers both Create and Selectable, same roles, and scheme pinning fixes the 500 when no default challenge scheme exists. SkipValidation is scoped to unpublished Save, so invalid content can't go live. Good.