Distribution_GL Initialization

Middleware/ApiKeyMiddleware.cs

@@ -0,0 +1,54 @@
+using System.Text.Json;
+using General_Ledger_Service.DTOs.Common;
+
+namespace General_Ledger_Service.Middleware
+{
+    public class ApiKeyMiddleware
+    {
+        private const string ApiKeyHeaderName = "X-Api-Key";
+        // /dev-tools/generate-api-key is the bootstrap tool that produces the very first key -
+        // it can never require a key to reach it, or there'd be no way to generate one. It's
+        // still gated to Development-only inside DevToolsService itself; excluding it here only
+        // means "no key needed," not "reachable in every environment."
+        private static readonly string[] ExcludedPathPrefixes = { "/health", "/swagger", "/api/v1/dev-tools" };
+
+        private readonly RequestDelegate _next;
+
+        public ApiKeyMiddleware(RequestDelegate next)
+        {
+            _next = next;
+        }
+
+        public async Task InvokeAsync(HttpContext context, IConfiguration configuration)
+        {
+            var path = context.Request.Path.Value ?? string.Empty;
+            if (ExcludedPathPrefixes.Any(prefix => path.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)))
+            {
+                await _next(context);
+                return;
+            }
+
+            var expectedApiKey = configuration["ApiKey:Value"];
+            var providedApiKey = context.Request.Headers[ApiKeyHeaderName].FirstOrDefault();
+
+            if (string.IsNullOrEmpty(expectedApiKey) || providedApiKey != expectedApiKey)
+            {
+                context.Response.StatusCode = StatusCodes.Status401Unauthorized;
+                context.Response.ContentType = "application/json";
+
+                var response = new ApiResponse
+                {
+                    StatusCode = StatusCodes.Status401Unauthorized,
+                    Success = false,
+                    Message = "Invalid or missing API key",
+                    Data = null
+                };
+
+                await context.Response.WriteAsync(JsonSerializer.Serialize(response));
+                return;
+            }
+
+            await _next(context);
+        }
+    }
+}