[ajcvickers]

Fixes #32352

Castle proxies cannot override members that are not visible to DynamicProxyGenAssembly2, such as internal virtual navigations, unless the declaring assembly has [assembly: InternalsVisibleTo("DynamicProxyGenAssembly2")]. Model validation only checked that the accessor was virtual, so these navigations passed validation and were then silently never lazy-loaded or change-tracked.

Change

Model validation (ProxyBindingRewriter) now throws InvalidOperationException when:

• UseLazyLoadingProxies: the getter of a lazy-loaded navigation cannot be overridden.
• UseChangeTrackingProxies: the setter of a navigation cannot be overridden. This includes collections with { get; internal set; }.

The check uses Castle's own ProxyUtil.IsAccessible, so it follows exactly what the proxy generator can override, including the InternalsVisibleTo case. The message says whether the getter or the setter is the problem and how to fix it.

Not affected, and covered by tests:

• IgnoreNonVirtualNavigations() and EnableLazyLoading(false) still suppress the check for lazy-loading proxies, and owned navigations are still skipped.
• Lazy-loading proxies only need the getter, so { get; internal set; } keeps working.
• Entity types that are themselves inaccessible are skipped here. Castle already rejects them when a proxy is created, and reporting them would blame a property that is already public.

Tests

ProxyAccessibilityTests emits entity types at runtime so that every accessibility level (public, protected, protected internal, internal, private protected, private) can be tested with and without InternalsVisibleTo("DynamicProxyGenAssembly2"), for references and collections. It includes end-to-end tests that a visible internal accessor is really intercepted (lazy-loading loads the navigation, change-tracking detects the change), and one documenting the original symptom with validation suppressed.

test.cmd was run. The only failures were five many-to-many tests (ManyM_DB / Organisations tables missing or already existing) caused by parallel runs sharing a database; they pass when run on their own.

Breaking change

Apps with internal virtual navigations, or { get; internal set; } collections under change-tracking proxies, without the InternalsVisibleTo attribute will now get a model-validation error instead of a silently broken navigation. A docs breaking-change note is being sent to dotnet/EntityFramework.Docs.

Not in this PR

• Scalar properties on change-tracking proxies have the same gap: Change-tracking proxies silently ignore internal virtual properties #39589.
• Navigations declared on abstract base types are not validated, because the rewriter skips abstract types for all of its checks.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.