From cb218146cf5b033e4938dc72b54ca7efba891751 Mon Sep 17 00:00:00 2001
From: Thorsten Sommer <SommerEngineering@users.noreply.github.com>
Date: Sun, 1 Nov 2026 19:34:17 +0100
Subject: [PATCH] Kept the antiforgery token readable in trimmed builds, which
 Blazor needs since .NET 10

---
 app/TrimSmokeTest/JsonRoundTrips.cs | 21 +++++++++++++++++++++
 app/Trimming.props                  | 11 +++++++++++
 2 files changed, 32 insertions(+)

diff --git a/app/TrimSmokeTest/JsonRoundTrips.cs b/app/TrimSmokeTest/JsonRoundTrips.cs
index 43cca4479..65847c9cf 100644
--- a/app/TrimSmokeTest/JsonRoundTrips.cs
+++ b/app/TrimSmokeTest/JsonRoundTrips.cs
@@ -6,16 +6,32 @@ using AIStudio.Settings;
 using AIStudio.Settings.DataModel;
 using AIStudio.Tools;
 
+using Microsoft.AspNetCore.Components.Forms;
+
 namespace AIStudio.TrimSmokeTest;
 
 /// <summary>
 /// Writes and reads filled values of the roots which matter most, since some parts of a contract only come
 /// into play once there is a value, e.g., the factory which builds an immutable collection.
 /// </summary>
+/// <remarks>
+/// Blazor writes some state of its own as JSON, too: it puts it into the page and reads it again when the
+/// circuit starts. When that fails, the circuit closes at once, and the window of AI Studio stays empty.
+/// </remarks>
 public static class JsonRoundTrips
 {
     private const string TEXT_WITH_WEB_ADDRESS = "The details are on https://example.org/chosen.";
 
+    /// <summary>
+    /// The options with which Blazor writes and reads its state, as JsonSerializerOptionsProvider in ASP.NET Core sets them.
+    /// </summary>
+    private static readonly JsonSerializerOptions BLAZOR_STATE_OPTIONS = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        PropertyNameCaseInsensitive = true,
+        IncludeFields = true,
+    };
+
     /// <summary>
     /// Returns a description of every value which does not survive being written and read again.
     /// </summary>
@@ -44,6 +60,11 @@ public static class JsonRoundTrips
         AddLoss(chat, WorkspaceBehaviour.JSON_OPTIONS, failures);
         AddLoss(new Data(), SettingsManager.JSON_OPTIONS, failures);
         AddLoss(new VisualBriefingManifest { Name = "Trim smoke test", Restrictions = restrictions }, VisualBriefingJson.Persistence, failures);
+
+        //
+        // Since .NET 10, Blazor carries the antiforgery token from the page into the circuit:
+        //
+        AddLoss(new AntiforgeryRequestToken("Trim smoke test", "__RequestVerificationToken"), BLAZOR_STATE_OPTIONS, failures);
         return failures;
     }
 
diff --git a/app/Trimming.props b/app/Trimming.props
index 3989a339a..a8cc4a7c7 100644
--- a/app/Trimming.props
+++ b/app/Trimming.props
@@ -24,4 +24,15 @@
         <TrimmerRootAssembly Include="System.Collections.Immutable" />
     </ItemGroup>
 
+    <!--
+        Since .NET 10, Blazor carries some state of its own from the page into the circuit as JSON, the antiforgery
+        token among it. It reads that state by reflection, too, and the trimmer removes the properties of the token,
+        since nothing else reads them. The circuit then closes right after it started, and the window stays empty.
+        Microsoft keeps these properties for Blazor WebAssembly only (dotnet/aspnetcore#64819), since it does not
+        support trimming a Blazor Server app. Hence, we keep the whole assembly which holds the token.
+    -->
+    <ItemGroup>
+        <TrimmerRootAssembly Include="Microsoft.AspNetCore.Components.Web" />
+    </ItemGroup>
+
 </Project>
\ No newline at end of file