Ensure that internal code is never exposed through InternalsVisibleTo

[dennisdoomen]

Ports dennisdoomen/pathy#54 to Reflectify.

The problem

Reflectify is a source-only package, so its types are compiled straight into the consuming assembly as plain internal types. Anything the consumer lists in InternalsVisibleTo can therefore see and use Reflectify.MemberKind, Reflectify.Reflector, and all the extension classes. Reflectify silently becomes part of the consumer's internal API surface, and consumers can start depending on it across assembly boundaries without ever asking for it.

I proved this against main with a throwaway two-project solution: a ConsumerLib that compiles Reflectify's sources and grants InternalsVisibleTo("Friend"), plus a Friend project that references it. On main, Friend compiles fine while referencing Reflectify.MemberKind.

The fix

Every top-level type now gets a conditional declaration:

#if REFLECTIFY_COMPILE
public static class TypeExtensions
#else
[global::Microsoft.CodeAnalysis.Embedded]
[global::System.Diagnostics.DebuggerNonUserCode]
internal static class TypeExtensions
#endif

Roslyn hides types marked [Microsoft.CodeAnalysis.Embedded] from every other assembly, friend assemblies included. EmbeddedAttribute.cs declares the attribute itself and is picked up by the package automatically, since the .nuspec globs *.cs.

REFLECTIFY_COMPILE is only defined in Reflectify.csproj, so inside our own build the types are public instead. That lets Reflectify.Specs keep its plain ProjectReference and let me remove the InternalsVisibleTo entry entirely — which is the whole point of the change. Making the types public is safe because the Reflectify assembly is never shipped; the .nuspec publishes only contentFiles and Reflectify.props, no lib/.

Coexisting with Pathy

Pathy is a source-only package too, and it declares the same Microsoft.CodeAnalysis.EmbeddedAttribute. A consumer using both — FluentAssertions already consumes Reflectify, so this is realistic — compiles two copies into one assembly and gets CS0101 plus two CS0579.

The attribute is declared partial, so the two declarations merge into a single type rather than colliding. Roslyn matches the attribute by name and doesn't care how many parts it came from. Nothing is required of the consumer, and Pathy only has to add partial to its own copy for the pair to work together.

The one constraint is that a type-level attribute cannot be repeated across parts, so [AttributeUsage] and [ExcludeFromCodeCoverage] had to go. Dropping [AttributeUsage] is free: AttributeTargets.All is already the default. Three analyzers (RCS1203, MA0010, CA1018) ask for it back, so they're suppressed on that declaration with the reason inline.

Verification

Built a harness that compiles Reflectify's sources the way a consumer does, alongside a second file mimicking Pathy's attribute, plus a friend assembly:

	main	this branch
Consumer compiles	yes	yes
Consumer compiles with Pathy's attribute present	yes	yes
Friend sees the consumer's own internals	yes	yes
Friend sees Reflectify.MemberKind	yes	no (CS0234)

dotnet test passes: 187 on net6.0, 187 on net8.0, 182 on net472. (The netcoreapp3.0 run aborts on my machine because that runtime isn't installed — unrelated to this change.)

Two other things worth knowing

[DebuggerNonUserCode] is not valid on an enum. MemberKind gets [Embedded] only. This one is easy to miss: the error (CS0592) never shows up in Reflectify's own build, where the enum is public and neither attribute is applied. It only appears when you compile the sources the way a consumer does.

CA1852. Sealing the nested OrderedPropertyCollection inside Reflector. The analyzer only fires once Reflector itself becomes externally visible.

<NoWarn>1591;1573</NoWarn> in Reflectify.csproj, since the now-public types would otherwise want XML doc comments. Same as Pathy does.

[github-actions]

Test Results

  4 files  ±0    4 suites  ±0   4m 3s ⏱️ +39s
187 tests ±0  187 ✅ ±0  0 💤 ±0  0 ❌ ±0 
743 runs  ±0  743 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 8e46954. ± Comparison against base commit d63731a.

♻️ This comment has been updated with latest results.