Finishes functional design for unit 0 (back-end changes before front-end work)

aidlc-docs/features/cms-frontend/construction/unit-0/functional-design/domain-entities.md

@@ -0,0 +1,90 @@
+# Domain Entities — Unit 0: Backend Prerequisites
+
+## Modified Entity: ApplicationUser
+
+`ApplicationUser` is extended with a new `DisplayName` property.
+
+```csharp
+public class ApplicationUser : IdentityUser<Guid>
+{
+    // Existing properties (unchanged)
+    public bool IsActive { get; set; }
+    public DateTime CreatedAt { get; set; }
+
+    // NEW: Display name shown in the frontend UI
+    // Optional — if null/empty, the frontend falls back to the user's email
+    public string? DisplayName { get; set; }
+}
+```
+
+**Migration required**: A new EF Core migration must be added to `SlpModularCms.Core/Migrations/` to add the `DisplayName` column to the `AspNetUsers` table.
+
+| Property | Type | Nullable | Max Length | Default |
+|----------|------|----------|-----------|---------|
+| `DisplayName` | `nvarchar` | Yes | 100 | NULL |
+
+---
+
+## Modified DTO: TokenResponse
+
+`TokenResponse` is extended to carry the user's display name and role for the frontend auth context.
+
+```csharp
+public record TokenResponse(
+    string AccessToken,
+    string RefreshToken,   // Kept in record for internal use; NOT returned in HTTP response body
+    DateTime ExpiresAt,
+    UserDto User
+);
+
+public record UserDto(
+    Guid Id,
+    string Email,
+    string Name,           // DisplayName ?? Email (fallback)
+    string Role,
+    bool IsActive
+);
+```
+
+> **Note**: `RefreshToken` is no longer returned in the HTTP response body. The `AuthController` reads it from the `TokenResponse` record internally to set the httpOnly cookie, then returns only `AccessToken`, `ExpiresAt`, and `User` to the client.
+
+---
+
+## Removed: RefreshTokenRequest
+
+`RefreshTokenRequest.cs` is deleted. The refresh token is now read exclusively from the httpOnly cookie.
+
+```csharp
+// DELETED — no longer needed
+// public record RefreshTokenRequest(string AccessToken, string RefreshToken);
+```
+
+---
+
+## Configuration Entity: CorsSettings
+
+New configuration section read via `IConfiguration` — no database entity.
+
+```json
+// appsettings.json (production placeholder)
+{
+  "Cors": {
+    "AllowedOrigins": []
+  }
+}
+
+// appsettings.Development.json
+{
+  "Cors": {
+    "AllowedOrigins": ["http://localhost:5173"]
+  }
+}
+```
+
+```csharp
+// Bound via IConfiguration — not a domain entity
+public class CorsSettings
+{
+    public string[] AllowedOrigins { get; set; } = [];
+}
+```