Changes backend in preparation for frontend work

src/SlpModularCms.Api/Extensions/ServiceCollectionExtensions.cs

@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.IdentityModel.Tokens;
 using SlpModularCms.Core.Availability;
@@ -12,6 +13,7 @@ using SlpModularCms.Core.Identity.Models;
 using SlpModularCms.Core.Identity.Services;
 using SlpModularCms.Api.Infrastructure;
 using System.Text;
+using System.Threading.RateLimiting;
 
 namespace SlpModularCms.Api.Extensions;
 
@@ -93,4 +95,49 @@ public static class ServiceCollectionExtensions
 
         return services;
     }
+
+    public static IServiceCollection AddCmsCors(this IServiceCollection services, IConfiguration configuration)
+    {
+        var allowedOrigins = configuration.GetSection("Cors:AllowedOrigins").Get<string[]>() ?? Array.Empty<string>();
+
+        services.AddCors(options =>
+        {
+            options.AddDefaultPolicy(builder =>
+            {
+                builder.WithOrigins(allowedOrigins)
+                    .AllowAnyHeader()
+                    .AllowAnyMethod()
+                    .AllowCredentials();
+            });
+        });
+
+        return services;
+    }
+
+    public static IServiceCollection AddCmsRateLimiting(this IServiceCollection services, IConfiguration configuration)
+    {
+        services.AddRateLimiter(options =>
+        {
+            options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
+
+            options.AddFixedWindowLimiter("login", opt =>
+            {
+                var settings = configuration.GetSection("RateLimiting:Login");
+                opt.PermitLimit = settings.GetValue<int>("PermitLimit", 5);
+                opt.Window = TimeSpan.FromSeconds(settings.GetValue<int>("WindowSeconds", 60));
+                opt.QueueLimit = 0;
+            });
+
+            options.AddSlidingWindowLimiter("refresh", opt =>
+            {
+                var settings = configuration.GetSection("RateLimiting:Refresh");
+                opt.PermitLimit = settings.GetValue<int>("PermitLimit", 20);
+                opt.Window = TimeSpan.FromSeconds(settings.GetValue<int>("WindowSeconds", 60));
+                opt.SegmentsPerWindow = 4;
+                opt.QueueLimit = 0;
+            });
+        });
+
+        return services;
+    }
 }

src/SlpModularCms.Api/Program.cs

@@ -14,6 +14,8 @@ orchestrator.DiscoverModules();
 
 // 2. Add Core Infrastructure
 builder.Services.AddCoreInfrastructure(builder.Configuration);
+builder.Services.AddCmsCors(builder.Configuration);
+builder.Services.AddCmsRateLimiting(builder.Configuration);
 
 // 3. Add Module Services
 orchestrator.RegisterModuleServices(builder.Services);
@@ -29,6 +31,8 @@ var app = builder.Build();
 // 5. Global Exception Handling
 app.UseExceptionHandler();
 
+app.UseRateLimiter();
+
 // 6. Configure Pipeline
 if (app.Environment.IsDevelopment())
 {
@@ -38,6 +42,8 @@ if (app.Environment.IsDevelopment())
 
 app.UseHttpsRedirection();
 
+app.UseCors();
+
 // 7. Use Module Middleware
 orchestrator.UseModules(app);
 

src/SlpModularCms.Api/appsettings.Development.json

@@ -18,5 +18,21 @@
   "Availability": {
     "CircuitBreakerSeconds": 30,
     "StatusCacheSeconds": 1
+  },
+  "Cors": {
+    "AllowedOrigins": [
+      "http://localhost:5173",
+      "https://localhost:5173"
+    ]
+  },
+  "RateLimiting": {
+    "Login": {
+      "PermitLimit": 100,
+      "WindowSeconds": 60
+    },
+    "Refresh": {
+      "PermitLimit": 500,
+      "WindowSeconds": 60
+    }
   }
 }

src/SlpModularCms.Api/appsettings.json

@@ -19,5 +19,18 @@
   "Availability": {
     "CircuitBreakerSeconds": 30,
     "StatusCacheSeconds": 1
+  },
+  "Cors": {
+    "AllowedOrigins": []
+  },
+  "RateLimiting": {
+    "Login": {
+      "PermitLimit": 5,
+      "WindowSeconds": 60
+    },
+    "Refresh": {
+      "PermitLimit": 20,
+      "WindowSeconds": 60
+    }
   }
 }