slp-modular-cms/aidlc-docs/features/cms-frontend/construction/unit-0/functional-design/domain-entities.md

Domain Entities — Unit 0: Backend Prerequisites

Modified Entity: ApplicationUser

ApplicationUser is extended with a new DisplayName property.

public class ApplicationUser : IdentityUser<Guid>
{
    // Existing properties (unchanged)
    public bool IsActive { get; set; }
    public DateTime CreatedAt { get; set; }

    // NEW: Display name shown in the frontend UI
    // Optional — if null/empty, the frontend falls back to the user's email
    public string? DisplayName { get; set; }
}

Migration required: A new EF Core migration must be added to SlpModularCms.Core/Migrations/ to add the DisplayName column to the AspNetUsers table.

Property	Type	Nullable	Max Length	Default
DisplayName	nvarchar	Yes	100	NULL

---

Modified DTO: TokenResponse

TokenResponse is extended to carry the user's display name and role for the frontend auth context.

public record TokenResponse(
    string AccessToken,
    string RefreshToken,   // Kept in record for internal use; NOT returned in HTTP response body
    DateTime ExpiresAt,
    UserDto User
);

public record UserDto(
    Guid Id,
    string Email,
    string Name,           // DisplayName ?? Email (fallback)
    string Role,
    bool IsActive
);

Note

: RefreshToken is no longer returned in the HTTP response body. The AuthController reads it from the TokenResponse record internally to set the httpOnly cookie, then returns only AccessToken, ExpiresAt, and User to the client.

---

Removed: RefreshTokenRequest

RefreshTokenRequest.cs is deleted. The refresh token is now read exclusively from the httpOnly cookie.

// DELETED — no longer needed
// public record RefreshTokenRequest(string AccessToken, string RefreshToken);

---

Configuration Entity: CorsSettings

New configuration section read via IConfiguration — no database entity.

// appsettings.json (production placeholder)
{
  "Cors": {
    "AllowedOrigins": []
  }
}

// appsettings.Development.json
{
  "Cors": {
    "AllowedOrigins": ["http://localhost:5173"]
  }
}

// Bound via IConfiguration — not a domain entity
public class CorsSettings
{
    public string[] AllowedOrigins { get; set; } = [];
}