Health Checks

AddPortaHealthChecks() registers opt-in health checks for the dependencies only Porta can check correctly: the IdP (authority auto-resolved from Porta's auth options), the distributed cache backing sessions/locks/revocation, and the Data Protection key ring + key store. It uses the standard Microsoft.Extensions.Diagnostics.HealthChecks framework from the shared framework - no extra packages.

Registration only. The library never calls MapHealthChecks() and adds no middleware: you decide whether and where to expose health endpoints. Every check auto-skips (reports Healthy with a "skipped" description) when its dependency isn't configured, so the one-liner is safe in every deployment shape.

Quick start

builder.Services.AddPortaHealthChecks();

var app = builder.Build();

app.MapHealthChecks("/healthz/ready", new HealthCheckOptions
{
    // Filter on "ready" so any other ready-tagged checks the host registers are included too.
    // Use "porta" instead to scope the endpoint to Porta's checks only.
    Predicate = r => r.Tags.Contains("ready"),
});
app.MapHealthChecks("/healthz/live", new HealthCheckOptions
{
    Predicate = _ => false,   // liveness = process is up; no dependency checks (see below)
});

AddPortaHealthChecks returns the IHealthChecksBuilder, so you can chain your own checks. Call it once; a second call throws.

The checks

All checks are tagged ["porta", "ready"].

Why the IdP probe goes over the network instead of asking IDiscoveryService: the discovery document is cached by ConfigurationManager, so the cached copy stays green throughout an IdP outage. The probe requires a direct 2xx; redirects fail the check (and name the redirect target) because a redirecting authority breaks the OIDC handshake even when the target answers 200.

Configuration

Defaults need no options. To override:

builder.Services.AddPortaHealthChecks(o =>
{
    o.ProbeTimeout = TimeSpan.FromSeconds(2);        // per-check probe budget (default 5s)
    o.IdpProbeUrl = "https://idp.internal/health";   // probe this instead of {authority}/.well-known/...
    o.IdpProbeMethod = "HEAD";                       // GET (default) or HEAD
    o.CheckDistributedCache = false;                 // never register this check
    o.CheckDataProtection = true;                    // missing dependency = failure, not skip
    o.IdpFailureStatus = HealthStatus.Unhealthy;     // override a failure status
});

Each Check* switch is tri-state:

• null (default) - auto: probe iff the dependency is configured/resolvable at execution

time, otherwise report Healthy with a "skipped" description.

• true - required: a missing dependency is reported with the check's failure status.
• false - the check is not registered at all.

Probes carry no credentials, follow no redirects, and record only status code, duration, and host+path - never query strings or response bodies.

Readiness vs. liveness (Kubernetes)

Wire the Porta checks into readiness only and keep liveness dependency-free:

readinessProbe:
  httpGet: { path: /healthz/ready, port: 8080 }
  periodSeconds: 10
livenessProbe:
  httpGet: { path: /healthz/live, port: 8080 }
  periodSeconds: 10

A readiness failure only removes the pod from rotation - reversible, and the correct response to a dependency outage. A liveness failure restarts the container, and restarting never fixes an unreachable cache, database, or IdP - it causes restart loops for the whole outage instead. That's why the quick start maps /healthz/live with Predicate = _ => false: it returns 200 as long as the process serves requests, nothing more.