# Domain Entities — Unit 0: Backend Prerequisites

## Modified Entity: ApplicationUser

`ApplicationUser` is extended with a new `DisplayName` property.

```csharp
public class ApplicationUser : IdentityUser<Guid>
{
    // Existing properties (unchanged)
    public bool IsActive { get; set; }
    public DateTime CreatedAt { get; set; }

    // NEW: Display name shown in the frontend UI
    // Optional — if null/empty, the frontend falls back to the user's email
    public string? DisplayName { get; set; }
}
```

**Migration required**: A new EF Core migration must be added to `SlpModularCms.Core/Migrations/` to add the `DisplayName` column to the `AspNetUsers` table.

| Property | Type | Nullable | Max Length | Default |
|----------|------|----------|-----------|---------|
| `DisplayName` | `nvarchar` | Yes | 100 | NULL |

---

## Modified DTO: TokenResponse

`TokenResponse` is extended to carry the user's display name and role for the frontend auth context.

```csharp
public record TokenResponse(
    string AccessToken,
    string RefreshToken,   // Kept in record for internal use; NOT returned in HTTP response body
    DateTime ExpiresAt,
    UserDto User
);

public record UserDto(
    Guid Id,
    string Email,
    string Name,           // DisplayName ?? Email (fallback)
    string Role,
    bool IsActive
);
```

> **Note**: `RefreshToken` is no longer returned in the HTTP response body. The `AuthController` reads it from the `TokenResponse` record internally to set the httpOnly cookie, then returns only `AccessToken`, `ExpiresAt`, and `User` to the client.

---

## Removed: RefreshTokenRequest

`RefreshTokenRequest.cs` is deleted. The refresh token is now read exclusively from the httpOnly cookie.

```csharp
// DELETED — no longer needed
// public record RefreshTokenRequest(string AccessToken, string RefreshToken);
```

---

## Configuration Entity: CorsSettings

New configuration section read via `IConfiguration` — no database entity.

```json
// appsettings.json (production placeholder)
{
  "Cors": {
    "AllowedOrigins": []
  }
}

// appsettings.Development.json
{
  "Cors": {
    "AllowedOrigins": ["http://localhost:5173"]
  }
}
```

```csharp
// Bound via IConfiguration — not a domain entity
public class CorsSettings
{
    public string[] AllowedOrigins { get; set; } = [];
}
```