Track Viewer and SecurityCode hardening follow-ups

[versile2]

Summary

Track three non-blocking follow-ups identified during final verification of #65 at acf7c8ad9c2d5ddd4741b3f91e7732c8519a68dd.

No regression was reproduced in the PR's intended SecurityCode completion paths. These items are existing tooling or hardening debt and can be addressed independently from #65.

Follow-ups

1. Align the UnitTests Viewer development server with its target framework

tests/MudX.UnitTests.Viewer/MudX.UnitTests.Viewer.csproj targets net10.0 but currently references Microsoft.AspNetCore.Components.WebAssembly and Microsoft.AspNetCore.Components.WebAssembly.DevServer 9.0.10.

Example:

dotnet run --project tests/MudX.UnitTests.Viewer/MudX.UnitTests.Viewer.csproj --no-restore

The process starts, but requests fail with HTTP 500 before Blazor loads:

System.InvalidOperationException: ETag header not found.
  at Microsoft.AspNetCore.Builder.StaticAssetDescriptorExtensions.GetWeakETag(...)
  at Microsoft.AspNetCore.Builder.StaticAssetDevelopmentRuntimeHandler.AttachRuntimePatching(...)

Publishing the Viewer and serving its static wwwroot succeeds, so browser verification remains possible, but the documented development-server workflow is broken.

Acceptance criteria:

• Align the Viewer WebAssembly and DevServer packages with the net10.0 target/runtime.
• dotnet run serves the Viewer without HTTP 500.
• A real-browser smoke test loads a Viewer component and reports no page errors.

2. Bound SecurityCode clipboard input before JS interop and allocation

mudxSecurityCode.js currently reads the full clipboard text and sends it to ClipboardPasteEvent. The .NET handler then materializes the full string with ToCharArray() even though only the remaining pattern positions can be consumed.

Example:

Pattern: ####
Action: paste a multi-megabyte string into the first input
Current behavior: the complete payload crosses JS interop and is allocated in .NET; at most four matching characters are useful

Acceptance criteria:

• Bound clipboard work to a documented, reasonable maximum before expensive copying/processing.
• Preserve partial and complete paste behavior for supported patterns.
• Preserve invalid-paste and identical-paste suppression so an existing completed code is not resubmitted.
• Add focused tests for oversized, invalid, identical, partial, and complete paste.

3. Match sequential-focus eligibility for inert and visibility: hidden

focusNextElement filters disabled, tabindex="-1", and zero-sized elements. An element with visibility: hidden can retain non-zero dimensions, and a focusable descendant of an inert subtree can still match the selector. Attempting to focus either candidate can leave focus unchanged instead of advancing to the next eligible control.

Examples:

<MudXSecurityCode Pattern="####" />
<button style="visibility: hidden">Hidden candidate</button>
<button id="expected-target">Visible target</button>

<MudXSecurityCode Pattern="####" />
<div inert>
  <button>Inert candidate</button>
</div>
<button id="expected-target">Visible target</button>

Acceptance criteria:

• Skip visibility: hidden candidates and focusable descendants of inert subtrees.
• Preserve current empty, disabled-only, hidden-by-layout, normal-next, and deferred-newer-focus behavior.
• Exercise both the source and generated modules in a real browser harness.

-- Reviewed by Codebringer / AI
-- Codebringer for versile2
-- versile2 requested tracking