feat: dab init defaults runtime.rest.request-body-strict to false

[Copilot]

Why make this change?

dab init generated configs with request-body-strict: true, causing REST endpoints to reject requests with extra/unmapped fields by default. This added friction for new users and modern scenarios where flexible request bodies are preferred.

What is this change?

• ConfigGenerator.cs: Changed the RestRequestBodyStrict defaulting logic from CliBool.False ? false : true to CliBool.True ? true : false — when --rest.request-body-strict is omitted, the generated config now writes false
• RestRuntimeOptions.cs: The record default (RequestBodyStrict = true) is preserved for backward compatibility — existing configs that omit this field continue to behave as before
• InitOptions.cs: Updated help text to reflect (Default: false)
• Snapshot files and hardcoded expected JSON in ConfigGeneratorTests updated to reflect the new generated default

# Before: generated config contained "request-body-strict": true
# After:
dab init --database-type mssql --connection-string "..."
# Generated config now contains: "request-body-strict": false

How was this tested?

• Integration Tests
• Unit Tests
  • TestRestRequestBodyStrictMode — updated DataRow for the no-flag case to assert false
  • ConfigGeneratorTests.TestSpecialCharactersInConnectionString — updated expected JSON
  • All 30 InitTests snapshots and 7 EndToEndTests snapshots (those that invoke dab init without the flag) updated to RequestBodyStrict: false
  • AddEntityTests and UpdateEntityTests snapshots intentionally unchanged — those use pre-built config strings, not dab init, and correctly reflect the record default of true

Sample Request(s)

dab init --database-type mssql --connection-string "@env('conn')"

Generated dab-config.json runtime section:

"rest": {
  "enabled": true,
  "path": "/api",
  "request-body-strict": false
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• azuread
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/Cli.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/Cli.Tests.deps.json /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/testhost.dll --port 36463 --endpoint 127.0.0.1:036463 --role client --parentprocessid 4967 --telemetryoptedin false (dns block)
• custom
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/Cli.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/Cli.Tests.deps.json /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/testhost.dll --port 36463 --endpoint 127.0.0.1:036463 --role client --parentprocessid 4967 --telemetryoptedin false (dns block)
• entraid
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/Cli.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/Cli.Tests.deps.json /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/testhost.dll --port 36463 --endpoint 127.0.0.1:036463 --role client --parentprocessid 4967 --telemetryoptedin false (dns block)
• xxxxx
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/Cli.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/Cli.Tests.deps.json /home/REDACTED/work/data-api-builder/data-api-builder/src/out/tests/net8.0/testhost.dll --port 36463 --endpoint 127.0.0.1:036463 --role client --parentprocessid 4967 --telemetryoptedin false (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>dab init to default runtime.rest.request-body-strict to false </issue_title>
<issue_description>## What?

When dab init is run, update its behavior to default runtime.rest.request-body-strict to false in the generated config. This will allow REST request bodies to accept and ignore additional fields by default, making development smoother and reducing unexpected errors.

Why?

Currently, dab init in the CLI generates a dab-config.json where the runtime.rest.request-body-strict option defaults to true (strict mode). This means all extraneous/unmapped fields in REST request bodies are rejected by default, including keys. This can cause confusion for new users and adds friction for modern scenarios where flexible request bodies are preferred, especially with C# developers.</issue_description>

<agent_instructions>Introduce as little change as possible</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes dab init to default runtime.rest.request-body-strict to false  #3165

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

Updates dab init config generation so newly generated configs default runtime.rest.request-body-strict to false (non-strict REST request bodies), while preserving the runtime object-model default of true for backward compatibility with existing configs that omit the field.

Changes:

• Adjusted ConfigGenerator to emit request-body-strict: false when the init flag is omitted.
• Updated InitOptions help text and updated snapshots/CLI tests to reflect the new generated default.
• Clarified RestRuntimeOptions documentation around differing defaults (existing configs vs newly generated configs).

Reviewed changes

Copilot reviewed 42 out of 42 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/Config/ObjectModel/RestRuntimeOptions.cs	Updates XML docs describing RequestBodyStrict defaults/behavior.
src/Cli/ConfigGenerator.cs	Changes init-time defaulting to emit request-body-strict: false when omitted.
src/Cli/Commands/InitOptions.cs	Updates CLI help text for --rest.request-body-strict.
src/Cli.Tests/EndToEndTests.cs	Updates expectation for the no-flag init case to be non-strict.
src/Cli.Tests/ConfigGeneratorTests.cs	Updates expected generated JSON for init output.
src/Cli.Tests/Snapshots/*	Updates snapshots affected by init-generated default change.

[Copilot]

The CLI help text for --rest.request-body-strict is misleading given the option name/behavior: when request-body-strict is true, DAB rejects unexpected/extraneous fields (strict mode), and when false it allows them. Consider updating the HelpText (and the preceding comment) to explicitly describe the true/false semantics so users don’t interpret it as "allow" when set to true.

[Copilot]

The RequestBodyStrict XML doc is internally inconsistent: it says the property indicates whether extraneous fields are allowed, but then describes true as "we don't allow extraneous fields". Please reword to reflect the actual behavior (e.g., strict=true rejects extraneous/unmapped fields; strict=false ignores them) to avoid confusing readers and downstream doc generation.