Program.cs

using CourseCore.Api.Modules.Access;
using CourseCore.Api.Modules.AuditLogs;
using CourseCore.Api.Modules.Auth;
using CourseCore.Api.Modules.Certificates;
using CourseCore.Api.Modules.Testimonials;
using CourseCore.Api.Modules.Courses;
using CourseCore.Api.Modules.Media;
using CourseCore.Api.Modules.Payments;
using CourseCore.Api.Modules.Progress;
using CourseCore.Api.Modules.Questions;
using CourseCore.Api.Modules.Users;
using CourseCore.Api.Modules.Visitors;
using CourseCore.Api.Shared;
using CourseCore.Api.Shared.Infrastructure.Configuration;
using CourseCore.Api.Shared.Infrastructure.Persistence.Seed;
using CourseCore.Api.Shared.Application.Validation;
using CourseCore.Api.Shared.Presentation.Health;
using CourseCore.Api.Shared.Presentation.Middleware;
using CourseCore.Api.Shared.Presentation.OpenApi;
using CourseCore.Api.Shared.Presentation.RateLimiting;
using Microsoft.AspNetCore.Diagnostics.HealthChecks;
using Microsoft.AspNetCore.HttpOverrides;
using Microsoft.Extensions.Diagnostics.HealthChecks;
using Scalar.AspNetCore;

var builder = WebApplication.CreateBuilder(args);
const string CorsPolicyName = "CourseCoreCorsPolicy";

builder.WebHost.ConfigureKestrel(options =>
{
    options.Limits.MaxRequestBodySize = ApplicationValidationLimits.MaxRequestBodySizeBytes;
});

if (builder.Environment.IsProduction())
{
    builder.Configuration.ValidateProductionConfiguration();
}

// Add services to the container.

builder.Services.AddControllers();
builder.Services.AddCors(options =>
{
    options.AddPolicy(CorsPolicyName, policy =>
    {
        var allowedOrigins = builder.Configuration
            .GetSection("Cors:AllowedOrigins")
            .Get<string[]>() ?? [];

        if (builder.Environment.IsDevelopment() && allowedOrigins.Length == 0)
        {
            allowedOrigins =
            [
                "http://localhost:3000",
                "https://localhost:3000"
            ];
        }

        policy
            .WithOrigins(allowedOrigins)
            .AllowAnyHeader()
            .AllowAnyMethod()
            .AllowCredentials();
    });
});
builder.Services
    .AddHealthChecks()
    .AddCheck("self", () => HealthCheckResult.Healthy(), tags: ["live"])
    .AddCheck<CourseCoreDbContextHealthCheck>("database", tags: ["ready", "database"]);
// Learn more about configuring OpenAPI at https://aka.ms/aspnet/openapi
builder.Services.AddOpenApi(options =>
{
    options.AddDocumentTransformer<BearerSecuritySchemeTransformer>();
    options.AddOperationTransformer<BearerSecurityOperationTransformer>();
});
builder.Services.AddSharedInfrastructure(builder.Configuration);
builder.Services.AddCourseCoreRateLimiting(builder.Configuration);

// Only meaningful when ASPNETCORE_FORWARDEDHEADERS_ENABLED=true. The default (1) trusts just
// the last proxy hop. Behind two hops (Vercel rewrite -> Cloud Run) set it to 2 so the rate
// limiter sees the real client IP instead of the first proxy's.
builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    var forwardLimit = builder.Configuration.GetValue<int?>("ForwardedHeaders:ForwardLimit");

    if (forwardLimit is >= 1)
    {
        options.ForwardLimit = forwardLimit;
    }
});
builder.Services.AddAuthModule(builder.Configuration);
builder.Services.AddUsersModule();
builder.Services.AddAccessModule();
builder.Services.AddCoursesModule();
builder.Services.AddMediaModule(builder.Configuration, builder.Environment);
builder.Services.AddProgressModule(builder.Configuration);
builder.Services.AddAuditLogsModule();
builder.Services.AddCertificatesModule();
builder.Services.AddTestimonialsModule();
builder.Services.AddQuestionsModule();
builder.Services.AddVisitorsModule();
builder.Services.AddPaymentsModule(builder.Configuration);

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.MapOpenApi();
    app.MapScalarApiReference(options =>
    {
        options.WithTitle("CourseCore API");
    });

    await app.SeedCourseCoreDatabaseAsync();
}

app.UseMiddleware<CorrelationIdMiddleware>();
app.UseMiddleware<ExceptionHandlingMiddleware>();

if (!app.Environment.IsDevelopment())
{
    app.UseHsts();
}

app.UseHttpsRedirection();

app.UseRouting();

app.UseCors(CorsPolicyName);

app.UseAuthentication();

// After authentication so per-user limits can identify the caller.
app.UseRateLimiter();

app.UseAuthorization();

app.MapControllers();
app.MapHealthChecks("/health/live", new HealthCheckOptions
{
    Predicate = check => check.Tags.Contains("live"),
    ResponseWriter = HealthCheckResponseWriter.WriteMinimalAsync
});
app.MapHealthChecks("/health/ready", new HealthCheckOptions
{
    Predicate = check => check.Tags.Contains("ready"),
    ResponseWriter = app.Environment.IsDevelopment()
        ? HealthCheckResponseWriter.WriteDetailedAsync
        : HealthCheckResponseWriter.WriteMinimalAsync
});
app.MapHealthChecks("/health", new HealthCheckOptions
{
    ResponseWriter = app.Environment.IsDevelopment()
        ? HealthCheckResponseWriter.WriteDetailedAsync
        : HealthCheckResponseWriter.WriteMinimalAsync
});

app.Run();

public partial class Program
{
}