# Logical Components — Unit 0: Backend Prerequisites

The following logical components and configuration structures are defined to support the NFR implementation.

## 1. Middleware Ordering (Pipeline Design)
The order of middleware registration is critical for security and performance. The pipeline is configured in `Program.cs`.

```mermaid
graph TD
    Start((Start)) --> Exc[GlobalExceptionHandler]
    Exc --> RL[Rate Limiter]
    RL --> CORS[CORS Middleware]
    CORS --> Auth[Authentication]
    Auth --> Map[Endpoint Mapping]
    Map --> End((End))
    
    classDef infra fill:#cbd5e0,stroke:#1a202c,stroke-width:2px,color:#1a202c;
    classDef security fill:#feb2b2,stroke:#742a2a,stroke-width:2px,color:#742a2a;
    classDef core fill:#9ae6b4,stroke:#22543d,stroke-width:2px,color:#22543d;
    class Start,End,Map infra;
    class Exc,RL,CORS,Auth security;
```

Text alternative: Sequence of middleware in the ASP.NET Core pipeline (colored nodes indicate role).

## 2. Configuration Structure (appsettings.json)
Following the `dotnet-appsettings` skill pattern, the configuration for NFRs is centralized.

### CORS Configuration
```json
"Cors": {
  "AllowedOrigins": [
    "https://localhost:5173"
  ]
}
```

### Rate Limiting Configuration
```json
"RateLimiting": {
  "Login": {
    "PermitLimit": 5,
    "WindowSeconds": 60
  },
  "Refresh": {
    "PermitLimit": 20,
    "WindowSeconds": 60
  }
}
```

## 3. Extension Methods
To keep `Program.cs` clean, logical components are encapsulated in `ServiceCollectionExtensions.cs`.

| Component | Responsibility |
|-----------|----------------|
| `AddCmsCors()` | Configures the CORS policy based on settings. |
| `AddCmsRateLimiting()` | Defines the Fixed and Sliding window policies for auth. |
| `AddCmsExceptionHandling()` | Registers the `GlobalExceptionHandler` and ProblemDetails. |

## 4. ProblemDetails Integration
The `GlobalExceptionHandler` will be modified to fully replace the custom `ApiErrorResponse` with standard `ProblemDetails` as the return type. No backward compatibility for the old error format is required.