refinement phase 5

server/src/API/Baya.Web.Api/Program.cs

@@ -12,6 +12,7 @@ using Baya.Infrastructure.Identity.ServiceConfiguration;
 using Baya.Infrastructure.Monitoring.Configurations;
 using Baya.Infrastructure.Persistence.ServiceConfiguration;
 using Baya.SharedKernel.Extensions;
+using Baya.Web.Api.Configuration;
 using Baya.Web.Plugins.Grpc;
 using Baya.WebFramework.Filters;
 using Baya.WebFramework.Middlewares;
@@ -29,8 +30,16 @@ builder.Host.UseSerilog(LoggingConfiguration.ConfigureLogger);
 
 var configuration = builder.Configuration;
 
+// Fail fast if a load-bearing secret (DB connection, JWE/field-encryption keys) is missing or still a
+// committed placeholder — before any service reaches for it. Skipped in the "Testing" environment.
+builder.ValidateRequiredSecrets();
+
 Activity.DefaultIdFormat = ActivityIdFormat.W3C;
 
+// HTTPS metadata is required for the token exchange in deployed environments; relaxed for local
+// Development and the Testing host, which run over plain HTTP.
+var requireHttpsMetadata = !builder.Environment.IsDevelopment() && !builder.Environment.IsEnvironment("Testing");
+
 builder
     .ConfigureHealthChecks()
     .SetupOpenTelemetry();
@@ -68,11 +77,12 @@ builder.Services.AddSwagger("v1","v1.1");
 
 
 builder.Services.AddApplicationServices()
-    .RegisterIdentityServices(identitySettings)
+    .RegisterIdentityServices(identitySettings, requireHttpsMetadata)
     .AddPersistenceServices(configuration)
     .AddCrossCuttingSeams(configuration)
     .AddWebFrameworkServices()
     .AddCorsPolicies(configuration)
+    .AddForwardedHeadersConfiguration(configuration)
     .AddRateLimitingPolicies();
 
 // Development-only: capture each OTP in-memory so GET /api/v1/dev/last_otp/{phone} can complete a login
@@ -106,12 +116,16 @@ if (!app.Environment.IsEnvironment("Testing"))
 {
     await app.ApplyMigrationsAsync();
     await app.SeedDefaultUsersAsync();
-    await app.SeedPaymentGatewaysAsync();
 
-    // Development-only: populate a demo marketplace (nurses/variants/search rows, customers/patients)
-    // so the real-path screens aren't empty. Idempotent; never runs in Production/Staging.
+    // Development-only: a sandbox payment gateway (all-zeros merchant id) and a demo marketplace
+    // (nurses/variants/search rows, customers/patients) so the real-path screens aren't empty. Neither
+    // belongs in a deployed DB — a production gateway is an admin action, so this never runs in
+    // Production/Staging. Both are idempotent.
     if (app.Environment.IsDevelopment())
+    {
+        await app.SeedPaymentGatewaysAsync();
         await app.SeedDemoWorldAsync();
+    }
 }
 
 if (app.Environment.IsDevelopment())
@@ -121,6 +135,10 @@ if (app.Environment.IsDevelopment())
 else
     app.UseExceptionHandler(_=>{});
 
+// First in the pipeline so the resolved client IP (X-Forwarded-For, from a trusted proxy) is in place
+// before anything downstream — notably the rate limiter — reads HttpContext.Connection.RemoteIpAddress.
+app.UseForwardedHeaders();
+
 app.UseSwaggerAndUi();
 
 app.UseRouting();