Namespace KadicErp.WebApi.Middlewares

Classes

CurrentUserMiddleware

EcfCorrelationMiddleware

Reads or generates an X-Correlation-ID header for every request and injects it into the Serilog log context so all downstream log entries (handler, PSFE client, Hangfire jobs) carry a consistent trace ID.

Placement: registered before authentication middleware so that even failed-auth requests are traceable.

GlobalExceptionMiddleware

MustChangePasswordMiddleware

Hard gate for temporary passwords (plan portal-user-provisioning P4). While the JWT carries the "must_change_password" claim the ERP API rejects EVERY authenticated request with 403 — the ERP hosts no change-password endpoint, so a user with a temporary password has nothing legitimate to do here until they rotate it against KadicAuth. The frontend redirect to force-change-password is UX only; this is the security control.