Add rule to seal internal and private types

.editorconfig

@@ -178,6 +178,9 @@ dotnet_diagnostic.CA1846.severity = warning
 # CA1847: Use string.Contains(char) instead of string.Contains(string) with single characters
 dotnet_diagnostic.CA1847.severity = warning
 
+# CA1852: Seal internal types
+dotnet_diagnostic.CA1852.severity = warning
+
 # CA2007: Consider calling ConfigureAwait on the awaited task
 dotnet_diagnostic.CA2007.severity = warning
 
@@ -302,6 +305,8 @@ dotnet_diagnostic.CA1845.severity = suggestion
 dotnet_diagnostic.CA1846.severity = suggestion
 # CA1847: Use string.Contains(char) instead of string.Contains(string) with single characters
 dotnet_diagnostic.CA1847.severity = suggestion
+# CA1852: Seal internal types
+dotnet_diagnostic.CA1852.severity = suggestion
 # CA2007: Consider calling ConfigureAwait on the awaited task
 dotnet_diagnostic.CA2007.severity = suggestion
 # CA2008: Do not create tasks without passing a TaskScheduler

src/Analyzers/Analyzers/src/BuildServiceProviderAnalyzer.cs

@@ -7,7 +7,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class BuildServiceProviderAnalyzer
+internal sealed class BuildServiceProviderAnalyzer
 {
     private readonly StartupAnalysis _context;
 

src/Analyzers/Analyzers/src/ConfigureMethodVisitor.cs

@@ -6,7 +6,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class ConfigureMethodVisitor : SymbolVisitor
+internal sealed class ConfigureMethodVisitor : SymbolVisitor
 {
     public static List<IMethodSymbol> FindConfigureMethods(StartupSymbols symbols, IAssemblySymbol assembly)
     {

src/Analyzers/Analyzers/src/MiddlewareAnalysis.cs

@@ -6,7 +6,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class MiddlewareAnalysis
+internal sealed class MiddlewareAnalysis
 {
     public MiddlewareAnalysis(IMethodSymbol configureMethod, ImmutableArray<MiddlewareItem> middleware)
     {

src/Analyzers/Analyzers/src/MiddlewareAnalyzer.cs

@@ -8,7 +8,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class MiddlewareAnalyzer
+internal sealed class MiddlewareAnalyzer
 {
     private readonly StartupAnalysisBuilder _context;
 

src/Analyzers/Analyzers/src/MiddlewareItem.cs

@@ -6,7 +6,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class MiddlewareItem
+internal sealed class MiddlewareItem
 {
     public MiddlewareItem(IInvocationOperation operation)
     {

src/Analyzers/Analyzers/src/OptionsAnalysis.cs

@@ -6,7 +6,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class OptionsAnalysis
+internal sealed class OptionsAnalysis
 {
     public OptionsAnalysis(IMethodSymbol configureServicesMethod, ImmutableArray<OptionsItem> options)
     {

src/Analyzers/Analyzers/src/OptionsAnalyzer.cs

@@ -9,7 +9,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class OptionsAnalyzer
+internal sealed class OptionsAnalyzer
 {
     private readonly StartupAnalysisBuilder _context;
 

src/Analyzers/Analyzers/src/OptionsItem.cs

@@ -5,7 +5,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class OptionsItem
+internal sealed class OptionsItem
 {
     public OptionsItem(IPropertySymbol property, object constantValue)
     {

src/Analyzers/Analyzers/src/ServicesAnalysis.cs

@@ -6,7 +6,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class ServicesAnalysis
+internal sealed class ServicesAnalysis
 {
     public ServicesAnalysis(IMethodSymbol configureServicesMethod, ImmutableArray<ServicesItem> services)
     {

src/Analyzers/Analyzers/src/ServicesAnalyzer.cs

@@ -8,7 +8,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class ServicesAnalyzer
+internal sealed class ServicesAnalyzer
 {
     private readonly StartupAnalysisBuilder _context;
 

src/Analyzers/Analyzers/src/ServicesItem.cs

@@ -6,7 +6,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class ServicesItem
+internal sealed class ServicesItem
 {
     public ServicesItem(IInvocationOperation operation)
     {

src/Analyzers/Analyzers/src/StartupAnalysis.cs

@@ -6,7 +6,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class StartupAnalysis
+internal sealed class StartupAnalysis
 {
     private readonly ImmutableDictionary<INamedTypeSymbol, ImmutableArray<object>> _analysesByType;
 

src/Analyzers/Analyzers/src/StartupAnalysisBuilder.cs

@@ -7,7 +7,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class StartupAnalysisBuilder
+internal sealed class StartupAnalysisBuilder
 {
     private readonly Dictionary<INamedTypeSymbol, List<object>> _analysesByType;
     private readonly StartupAnalyzer _analyzer;

src/Analyzers/Analyzers/src/StartupSymbols.cs

@@ -5,7 +5,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class StartupSymbols
+internal sealed class StartupSymbols
 {
     public StartupSymbols(Compilation compilation)
     {

src/Analyzers/Analyzers/src/UseAuthorizationAnalyzer.cs

@@ -8,7 +8,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class UseAuthorizationAnalyzer
+internal sealed class UseAuthorizationAnalyzer
 {
     private readonly StartupAnalysis _context;
 

src/Analyzers/Analyzers/src/UseMvcAnalyzer.cs

@@ -7,7 +7,7 @@
 
 namespace Microsoft.AspNetCore.Analyzers;
 
-internal class UseMvcAnalyzer
+internal sealed class UseMvcAnalyzer
 {
     private readonly StartupAnalysis _context;
 

src/Analyzers/Microsoft.AspNetCore.Analyzer.Testing/src/Assert.cs

@@ -38,7 +38,7 @@ public static void DiagnosticLocation(DiagnosticLocation expected, Location actu
         }
     }
 
-    private class DiagnosticLocationAssertException : EqualException
+    private sealed class DiagnosticLocationAssertException : EqualException
     {
         public DiagnosticLocationAssertException(
             DiagnosticLocation expected,

src/Analyzers/Microsoft.AspNetCore.Analyzer.Testing/src/DiagnosticVerifier.cs

@@ -185,7 +185,7 @@ protected Project CreateProject(params string[] sources)
     }
 
     // Required to resolve compilation assemblies inside unit tests
-    private class AppLocalResolver : ICompilationAssemblyResolver
+    private sealed class AppLocalResolver : ICompilationAssemblyResolver
     {
         public bool TryResolveAssemblyPaths(CompilationLibrary library, List<string> assemblies)
         {

src/Antiforgery/src/Internal/AntiforgeryFeature.cs

@@ -6,7 +6,7 @@ namespace Microsoft.AspNetCore.Antiforgery;
 /// <summary>
 /// Used to hold per-request state.
 /// </summary>
-internal class AntiforgeryFeature : IAntiforgeryFeature
+internal sealed class AntiforgeryFeature : IAntiforgeryFeature
 {
     public bool HaveDeserializedCookieToken { get; set; }
 

src/Antiforgery/src/Internal/AntiforgeryOptionsSetup.cs

@@ -9,7 +9,7 @@
 
 namespace Microsoft.AspNetCore.Antiforgery;
 
-internal class AntiforgeryOptionsSetup : IConfigureOptions<AntiforgeryOptions>
+internal sealed class AntiforgeryOptionsSetup : IConfigureOptions<AntiforgeryOptions>
 {
     private readonly DataProtectionOptions _dataProtectionOptions;
 

src/Antiforgery/src/Internal/AntiforgerySerializationContext.cs

@@ -5,7 +5,7 @@
 
 namespace Microsoft.AspNetCore.Antiforgery;
 
-internal class AntiforgerySerializationContext
+internal sealed class AntiforgerySerializationContext
 {
     // Avoid allocating 256 bytes (the default) and using 18 (the AntiforgeryToken minimum). 64 bytes is enough for
     // a short username or claim UID and some additional data. MemoryStream bumps capacity to 256 if exceeded.

src/Antiforgery/src/Internal/AntiforgerySerializationContextPooledObjectPolicy.cs

@@ -5,7 +5,7 @@
 
 namespace Microsoft.AspNetCore.Antiforgery;
 
-internal class AntiforgerySerializationContextPooledObjectPolicy : IPooledObjectPolicy<AntiforgerySerializationContext>
+internal sealed class AntiforgerySerializationContextPooledObjectPolicy : IPooledObjectPolicy<AntiforgerySerializationContext>
 {
     public AntiforgerySerializationContext Create()
     {

src/Antiforgery/src/Internal/DefaultAntiforgery.cs

@@ -14,7 +14,7 @@ namespace Microsoft.AspNetCore.Antiforgery;
 /// Provides access to the antiforgery system, which provides protection against
 /// Cross-site Request Forgery (XSRF, also called CSRF) attacks.
 /// </summary>
-internal class DefaultAntiforgery : IAntiforgery
+internal sealed class DefaultAntiforgery : IAntiforgery
 {
     private readonly AntiforgeryOptions _options;
     private readonly IAntiforgeryTokenGenerator _tokenGenerator;
@@ -373,7 +373,7 @@ private IAntiforgeryFeature GetTokensInternal(HttpContext httpContext)
     /// Sets the 'Cache-Control' header to 'no-cache, no-store' and 'Pragma' header to 'no-cache' overriding any user set value.
     /// </summary>
     /// <param name="httpContext">The <see cref="HttpContext"/>.</param>
-    protected virtual void SetDoNotCacheHeaders(HttpContext httpContext)
+    private void SetDoNotCacheHeaders(HttpContext httpContext)
     {
         var logWarning = false;
         var responseHeaders = httpContext.Response.Headers;

src/Antiforgery/src/Internal/DefaultAntiforgeryAdditionalDataProvider.cs

@@ -8,7 +8,7 @@ namespace Microsoft.AspNetCore.Antiforgery;
 /// <summary>
 /// A default <see cref="IAntiforgeryAdditionalDataProvider"/> implementation.
 /// </summary>
-internal class DefaultAntiforgeryAdditionalDataProvider : IAntiforgeryAdditionalDataProvider
+internal sealed class DefaultAntiforgeryAdditionalDataProvider : IAntiforgeryAdditionalDataProvider
 {
     /// <inheritdoc />
     public string GetAdditionalData(HttpContext context)

src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs

@@ -8,7 +8,7 @@
 
 namespace Microsoft.AspNetCore.Antiforgery;
 
-internal class DefaultAntiforgeryTokenGenerator : IAntiforgeryTokenGenerator
+internal sealed class DefaultAntiforgeryTokenGenerator : IAntiforgeryTokenGenerator
 {
     private readonly IClaimUidExtractor _claimUidExtractor;
     private readonly IAntiforgeryAdditionalDataProvider _additionalDataProvider;

src/Antiforgery/src/Internal/DefaultAntiforgeryTokenSerializer.cs

@@ -7,7 +7,7 @@
 
 namespace Microsoft.AspNetCore.Antiforgery;
 
-internal class DefaultAntiforgeryTokenSerializer : IAntiforgeryTokenSerializer
+internal sealed class DefaultAntiforgeryTokenSerializer : IAntiforgeryTokenSerializer
 {
     private const string Purpose = "Microsoft.AspNetCore.Antiforgery.AntiforgeryToken.v1";
     private const byte TokenVersion = 0x01;

src/Antiforgery/src/Internal/DefaultAntiforgeryTokenStore.cs

@@ -8,7 +8,7 @@
 
 namespace Microsoft.AspNetCore.Antiforgery;
 
-internal class DefaultAntiforgeryTokenStore : IAntiforgeryTokenStore
+internal sealed class DefaultAntiforgeryTokenStore : IAntiforgeryTokenStore
 {
     private readonly AntiforgeryOptions _options;
 

src/Antiforgery/src/Internal/DefaultClaimUidExtractor.cs

@@ -11,7 +11,7 @@ namespace Microsoft.AspNetCore.Antiforgery;
 /// <summary>
 /// Default implementation of <see cref="IClaimUidExtractor"/>.
 /// </summary>
-internal class DefaultClaimUidExtractor : IClaimUidExtractor
+internal sealed class DefaultClaimUidExtractor : IClaimUidExtractor
 {
     private readonly ObjectPool<AntiforgerySerializationContext> _pool;
 

src/Azure/AzureAD/Authentication.AzureAD.UI/src/Areas/AzureAD/Controllers/AccountController.cs

@@ -12,7 +12,7 @@ namespace Microsoft.AspNetCore.Authentication.AzureAD.UI.AzureAD.Controllers.Int
 [Area("AzureAD")]
 [Route("[area]/[controller]/[action]")]
 [Obsolete("This is obsolete and will be removed in a future version. Use Microsoft.Identity.Web instead. See https://aka.ms/ms-identity-web.")]
-internal class AccountController : Controller
+internal sealed class AccountController : Controller
 {
     public AccountController(IOptionsMonitor<AzureADOptions> options)
     {

src/Azure/AzureAD/Authentication.AzureAD.UI/src/AzureADAccountControllerFeatureProvider.cs

@@ -9,7 +9,7 @@
 namespace Microsoft.AspNetCore.Authentication.AzureAD.UI;
 
 [Obsolete("This is obsolete and will be removed in a future version. Use Microsoft.Identity.Web instead. See https://aka.ms/ms-identity-web.")]
-internal class AzureADAccountControllerFeatureProvider : IApplicationFeatureProvider<ControllerFeature>, IApplicationFeatureProvider
+internal sealed class AzureADAccountControllerFeatureProvider : IApplicationFeatureProvider<ControllerFeature>, IApplicationFeatureProvider
 {
     public void PopulateFeature(IEnumerable<ApplicationPart> parts, ControllerFeature feature)
     {

src/Azure/AzureAD/Authentication.AzureAD.UI/src/AzureADCookieOptionsConfiguration.cs

@@ -8,7 +8,7 @@
 namespace Microsoft.AspNetCore.Authentication.AzureAD.UI;
 
 [Obsolete("This is obsolete and will be removed in a future version. Use Microsoft.Identity.Web instead. See https://aka.ms/ms-identity-web.")]
-internal class AzureADCookieOptionsConfiguration : IConfigureNamedOptions<CookieAuthenticationOptions>
+internal sealed class AzureADCookieOptionsConfiguration : IConfigureNamedOptions<CookieAuthenticationOptions>
 {
     private readonly IOptions<AzureADSchemeOptions> _schemeOptions;
     private readonly IOptionsMonitor<AzureADOptions> _AzureADOptions;

src/Azure/AzureAD/Authentication.AzureAD.UI/src/AzureADJwtBearerOptionsConfiguration.cs

@@ -8,7 +8,7 @@
 namespace Microsoft.AspNetCore.Authentication;
 
 [Obsolete("This is obsolete and will be removed in a future version. Use Microsoft.Identity.Web instead. See https://aka.ms/ms-identity-web.")]
-internal class AzureADJwtBearerOptionsConfiguration : IConfigureNamedOptions<JwtBearerOptions>
+internal sealed class AzureADJwtBearerOptionsConfiguration : IConfigureNamedOptions<JwtBearerOptions>
 {
     private readonly IOptions<AzureADSchemeOptions> _schemeOptions;
     private readonly IOptionsMonitor<AzureADOptions> _azureADOptions;

src/Azure/AzureAD/Authentication.AzureAD.UI/src/AzureADOpenIdConnectOptionsConfiguration.cs

@@ -7,7 +7,7 @@
 namespace Microsoft.AspNetCore.Authentication.AzureAD.UI;
 
 [Obsolete("This is obsolete and will be removed in a future version. Use Microsoft.Identity.Web instead. See https://aka.ms/ms-identity-web.")]
-internal class AzureADOpenIdConnectOptionsConfiguration : IConfigureNamedOptions<OpenIdConnectOptions>
+internal sealed class AzureADOpenIdConnectOptionsConfiguration : IConfigureNamedOptions<OpenIdConnectOptions>
 {
     private readonly IOptions<AzureADSchemeOptions> _schemeOptions;
     private readonly IOptionsMonitor<AzureADOptions> _azureADOptions;

src/Azure/AzureAD/Authentication.AzureAD.UI/src/AzureADOptionsConfiguration.cs

@@ -6,7 +6,7 @@
 namespace Microsoft.AspNetCore.Authentication.AzureAD.UI;
 
 [Obsolete("This is obsolete and will be removed in a future version. Use Microsoft.Identity.Web instead. See https://aka.ms/ms-identity-web.")]
-internal class AzureADOptionsConfiguration : IConfigureNamedOptions<AzureADOptions>
+internal sealed class AzureADOptionsConfiguration : IConfigureNamedOptions<AzureADOptions>
 {
     private readonly IOptions<AzureADSchemeOptions> _schemeOptions;
 

src/Azure/AzureAD/Authentication.AzureAD.UI/src/AzureADOptionsValidation.cs

@@ -6,7 +6,7 @@
 namespace Microsoft.AspNetCore.Authentication.AzureAD.UI;
 
 [Obsolete("This is obsolete and will be removed in a future version. Use Microsoft.Identity.Web instead. See https://aka.ms/ms-identity-web.")]
-internal class AzureADOptionsValidation : IValidateOptions<AzureADOptions>
+internal sealed class AzureADOptionsValidation : IValidateOptions<AzureADOptions>
 {
     public ValidateOptionsResult Validate(string name, AzureADOptions options)
     {

src/Azure/AzureAD/Authentication.AzureAD.UI/src/AzureADSchemeOptions.cs

@@ -1,21 +1,21 @@
-// Licensed to the .NET Foundation under one or more agreements.
+// Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
 namespace Microsoft.AspNetCore.Authentication.AzureAD.UI;
 
-internal class AzureADSchemeOptions
+internal sealed class AzureADSchemeOptions
 {
     public IDictionary<string, AzureADOpenIDSchemeMapping> OpenIDMappings { get; set; } = new Dictionary<string, AzureADOpenIDSchemeMapping>();
 
     public IDictionary<string, JwtBearerSchemeMapping> JwtBearerMappings { get; set; } = new Dictionary<string, JwtBearerSchemeMapping>();
 
-    public class AzureADOpenIDSchemeMapping
+    public sealed class AzureADOpenIDSchemeMapping
     {
         public string OpenIdConnectScheme { get; set; }
         public string CookieScheme { get; set; }
     }
 
-    public class JwtBearerSchemeMapping
+    public sealed class JwtBearerSchemeMapping
     {
         public string JwtBearerScheme { get; set; }
     }

src/Azure/AzureAD/Authentication.AzureADB2C.UI/src/Areas/AzureADB2C/Controllers/AccountController.cs

@@ -12,7 +12,7 @@ namespace Microsoft.AspNetCore.Authentication.AzureADB2C.UI.AzureADB2C.Controlle
 [Area("AzureADB2C")]
 [Route("[area]/[controller]/[action]")]
 [Obsolete("This is obsolete and will be removed in a future version. Use Microsoft.Identity.Web instead. See https://aka.ms/ms-identity-web.")]
-internal class AccountController : Controller
+internal sealed class AccountController : Controller
 {
     private readonly IOptionsMonitor<AzureADB2COptions> _options;
 

src/Azure/AzureAD/Authentication.AzureADB2C.UI/src/AzureADB2CAccountControllerFeatureProvider.cs

@@ -9,7 +9,7 @@
 namespace Microsoft.AspNetCore.Authentication.AzureADB2C.UI;
 
 [Obsolete("This is obsolete and will be removed in a future version. Use Microsoft.Identity.Web instead. See https://aka.ms/ms-identity-web.")]
-internal class AzureADB2CAccountControllerFeatureProvider : IApplicationFeatureProvider<ControllerFeature>, IApplicationFeatureProvider
+internal sealed class AzureADB2CAccountControllerFeatureProvider : IApplicationFeatureProvider<ControllerFeature>, IApplicationFeatureProvider
 {
     public void PopulateFeature(IEnumerable<ApplicationPart> parts, ControllerFeature feature)
     {

src/Azure/AzureAD/Authentication.AzureADB2C.UI/src/AzureADB2CCookieOptionsConfiguration.cs

@@ -8,7 +8,7 @@
 namespace Microsoft.AspNetCore.Authentication.AzureADB2C.UI;
 
 [Obsolete("This is obsolete and will be removed in a future version. Use Microsoft.Identity.Web instead. See https://aka.ms/ms-identity-web.")]
-internal class AzureADB2CCookieOptionsConfiguration : IConfigureNamedOptions<CookieAuthenticationOptions>
+internal sealed class AzureADB2CCookieOptionsConfiguration : IConfigureNamedOptions<CookieAuthenticationOptions>
 {
     private readonly IOptions<AzureADB2CSchemeOptions> _schemeOptions;
     private readonly IOptionsMonitor<AzureADB2COptions> _azureADB2COptions;