Fix Bundle authorization with RequestContext

[adithipo]

Description

Pass internal Bundle context through FhirRequestContext.Properties instead of HTTP headers, preventing forged metadata from changing authorization behavior.
Add regression tests for ignored headers and isolated contexts during sequential and parallel Bundle execution.

Related issues

Addresses BUG 206795

Testing

Additional tests and existing tests run locally.

FHIR Team Checklist

• Update the title of the PR to be succinct and less than 65 characters
• Add a milestone to the PR for the sprint that it is merged (i.e. add S47)
• Tag the PR with the type of update: Bug, Build, Dependencies, Enhancement, New-Feature or Documentation
• Tag the PR with Open source, Azure API for FHIR (CosmosDB or common code) or Azure Healthcare APIs (SQL or common code) to specify where this change is intended to be released.
• Tag the PR with Schema Version backward compatible or Schema Version backward incompatible or Schema Version unchanged if this adds or updates Sql script which is/is not backward compatible with the code.
• When changing or adding behavior, if your code modifies the system design or changes design assumptions, please create and include an ADR.
• CI is green before merge
• Review squash-merge requirements

Server Change (docs)

Patch|Skip|Feature|Breaking (reason)

[adithipo]

@microsoft-github-policy-service agree company="Microsoft"

[Copilot]

🟢 Approval recommended

No unresolved issues were identified that would block approval.

Pull request overview

Fixes Bundle authorization bypass by storing internal execution context in server-side request properties instead of forgeable HTTP headers.

Changes:

• Updated Bundle context propagation and retrieval.
• Added sequential/parallel isolation regression tests.
• Added controller tests confirming headers are ignored.

File summaries

File	Description
src/Microsoft.Health.Fhir.Shared.Api/Features/Resources/Bundle/BundleHandler.cs	Updated as part of this pull request.
src/Microsoft.Health.Fhir.Shared.Api/Controllers/FhirController.cs	Updated as part of this pull request.
src/Microsoft.Health.Fhir.Shared.Api.UnitTests/Features/Resources/Bundle/BundleHandlerTests.cs	Updated as part of this pull request.
src/Microsoft.Health.Fhir.Shared.Api.UnitTests/Controllers/FhirControllerTests.cs	Updated as part of this pull request.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.66%. Comparing base (66654af) to head (3ae5a34).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5827      +/-   ##
==========================================
+ Coverage   78.16%   78.66%   +0.50%     
==========================================
  Files        1017     1017              
  Lines       36996    36995       -1     
  Branches     5644     5643       -1     
==========================================
+ Hits        28917    29103     +186     
+ Misses       6686     6475     -211     
- Partials     1393     1417      +24     

see 23 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.