From ad9080be6674bfa4946e2cd413ce3dd8a175ba62 Mon Sep 17 00:00:00 2001
From: XShine555 <xshine555@gmail.com>
Date: Sun, 31 May 2026 19:25:15 +0200
Subject: [PATCH] Return 400 for validation errors without identifier and
 enable permissive CORS in Development

---
 WebApi/Extensions/ResultHttpExtensions.cs |  2 +-
 WebApi/Program.cs                         | 13 ++++++++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/WebApi/Extensions/ResultHttpExtensions.cs b/WebApi/Extensions/ResultHttpExtensions.cs
index 6b3bb64..7858397 100644
--- a/WebApi/Extensions/ResultHttpExtensions.cs
+++ b/WebApi/Extensions/ResultHttpExtensions.cs
@@ -31,6 +31,6 @@ public static class ResultHttpExtensions
 
     private static Dictionary<string, string[]> ToValidationDictionary(IEnumerable<ValidationError> errors) =>
         errors
-            .GroupBy(e => e.Identifier)
+            .GroupBy(e => string.IsNullOrEmpty(e.Identifier) ? "general" : e.Identifier)
             .ToDictionary(g => g.Key, g => g.Select(e => e.ErrorMessage).ToArray());
 }
diff --git a/WebApi/Program.cs b/WebApi/Program.cs
index 38f37e3..ea49b4a 100644
--- a/WebApi/Program.cs
+++ b/WebApi/Program.cs
@@ -5,14 +5,23 @@ using WebApi.Extensions;
 
 var builder = WebApplication.CreateBuilder();
 
+const string devCorsPolicy = "dev-cors";
+
 builder.Services
     .AddApplicationServices(builder.Configuration)
     .AddObservability(builder.Configuration);
 
+if (builder.Environment.IsDevelopment())
+{
+    builder.Services.AddCors(options => options.AddPolicy(devCorsPolicy, policy =>
+        policy.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod()));
+}
+
 var app = builder.Build();
 
 if (app.Environment.IsDevelopment())
 {
+    app.UseCors(devCorsPolicy);
     app.MapOpenApi();
     app.MapScalarApiReference();
 }
@@ -25,6 +34,4 @@ app
     .MapTrackEndpoints()
     .MapUserEndpoints();
 
-app.Run();
-
-public partial class Program { }
+app.Run();
\ No newline at end of file