The AspNetCorePlugin.Configure method was casting IApplicationBuilder to WebApplication, which throws if the builder isn't a WebApplication instance. While IApplicationBuilder is typically a WebApplication in standard ASP.NET Core apps, the interface contract doesn't guarantee this.

Problem

The original implementation had two issues:

1. Unsafe cast from IApplicationBuilder to WebApplication
2. Incorrect middleware ordering when attempting to register endpoints in the plugin's Configure method

Solution

Moved endpoint registration from AspNetCorePlugin.Configure to the UseTeams extension method in ApplicationBuilder.cs, where proper ASP.NET Core middleware ordering is maintained.

Changes

AspNetCorePlugin.cs:

• Configure method now simply returns the builder without modification
• Removed unsafe cast to WebApplication

ApplicationBuilder.cs:

• Added endpoint registration for AspNetCorePlugin in the UseEndpoints call
• Ensures correct middleware ordering: UseRouting → UseAuthorization → UseEndpoints
• Plugin lookup is performed once during setup (not on every request)
• Endpoint is registered alongside MapControllers with correct authorization requirement

Before:

public IApplicationBuilder Configure(IApplicationBuilder builder)
{
    WebApplication? webApp = builder as WebApplication;
    ArgumentNullException.ThrowIfNull(webApp, nameof(builder));
    webApp.MapPost("/api/messages", /*...*/);
    return builder;
}

After:

// AspNetCorePlugin.cs
public IApplicationBuilder Configure(IApplicationBuilder builder)
{
    return builder;
}

// ApplicationBuilder.cs - UseTeams method
builder.UseRouting();
builder.UseAuthorization();
var aspNetCorePlugin = plugins.OfType<AspNetCorePlugin>().FirstOrDefault();
builder.UseEndpoints(endpoints =>
{
    if (aspNetCorePlugin is not null)
    {
        endpoints.MapPost("/api/messages", /*...*/);
    }
    endpoints.MapControllers();
});

This approach:

• Eliminates the unsafe cast
• Maintains proper ASP.NET Core middleware ordering
• Works with any IApplicationBuilder implementation
• Ensures authorization middleware is active when endpoints are registered

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.