feat: module pipeline hooks after routing and after authentication; bounded api key lookup cache

src/VirtoCommerce.Platform.Core/Modularity/IPlatformStartup.cs

@@ -15,22 +15,61 @@ public interface IPlatformStartup
     /// Called during Program.cs ConfigureAppConfiguration phase.
     /// Use to add configuration sources (e.g., Azure App Configuration).
     /// </summary>
-    void ConfigureAppConfiguration(IConfigurationBuilder builder, IHostEnvironment env);
+    void ConfigureAppConfiguration(IConfigurationBuilder builder, IHostEnvironment env)
+    {
+    }
 
     /// <summary>
     /// Called during Program.cs ConfigureServices phase.
     /// Use to register host-level services.
     /// </summary>
-    void ConfigureHostServices(IServiceCollection services, IConfiguration config);
+    void ConfigureHostServices(IServiceCollection services, IConfiguration config)
+    {
+    }
 
     /// <summary>
     /// Called during Startup.ConfigureServices after modules are loaded.
     /// Use for application-level service registration.
     /// </summary>
-    void ConfigureServices(IServiceCollection services, IConfiguration config);
+    void ConfigureServices(IServiceCollection services, IConfiguration config)
+    {
+    }
 
     /// <summary>
     /// Called during Startup.Configure.
     /// </summary>
-    void Configure(IApplicationBuilder app, IConfiguration config);
+    void Configure(IApplicationBuilder app, IConfiguration config)
+    {
+    }
+
+    /// <summary>
+    /// Called during Startup.Configure after UseRouting, UseStaticFiles and UseModulesAndAppsFiles, and before
+    /// UseAuthentication: the endpoint is matched (HttpContext.GetEndpoint() is still null when no route
+    /// matched) and the caller is not yet authenticated.
+    /// Use for middleware that needs the matched endpoint but must run before authentication.
+    /// </summary>
+    /// <remarks>
+    /// Requests for platform and module static files never get here: UseStaticFiles and
+    /// UseModulesAndAppsFiles serve the file and end the request first. Middleware registered here sees
+    /// API and page requests, not scripts, styles or images.
+    /// </remarks>
+    void ConfigureAfterRouting(IApplicationBuilder app, IConfiguration config)
+    {
+    }
+
+    /// <summary>
+    /// Called during Startup.Configure after UseAuthentication and UseAccountLockoutMiddleware, and before
+    /// UseAuthorization: HttpContext.User is set (it may be anonymous) and authorization has not run yet, so
+    /// the requests it is about to reject with 401 or 403 are still visible here.
+    /// Use for middleware that needs the principal and the matched endpoint and must also see the requests
+    /// authorization rejects.
+    /// </summary>
+    /// <remarks>
+    /// Requests for platform and module static files never get here: UseStaticFiles and
+    /// UseModulesAndAppsFiles serve the file and end the request first. Middleware registered here sees
+    /// API and page requests, not scripts, styles or images.
+    /// </remarks>
+    void ConfigureAfterAuthentication(IApplicationBuilder app, IConfiguration config)
+    {
+    }
 }

src/VirtoCommerce.Platform.Core/PlatformConstants.cs

@@ -13,6 +13,14 @@ public static class PlatformConstants
 
         public static class Security
         {
+            public static class ApiKeyAuthentication
+            {
+                /// <summary>
+                /// The query-string and header parameter name the API key authentication scheme reads.
+                /// </summary>
+                public const string ParamName = "api_key";
+            }
+
             public static class AuthenticationSchemes
             {
                 public const string MixedScheme = "VirtoMixedAuthenticationScheme";

src/VirtoCommerce.Platform.Modules/ModuleBootstrapper.cs

@@ -608,6 +608,22 @@ public void RunConfigure(IApplicationBuilder applicationBuilder, IConfiguration
         }
     }
 
+    public void RunConfigureAfterRouting(IApplicationBuilder applicationBuilder, IConfiguration configuration)
+    {
+        foreach (var startup in _startups)
+        {
+            startup.ConfigureAfterRouting(applicationBuilder, configuration);
+        }
+    }
+
+    public void RunConfigureAfterAuthentication(IApplicationBuilder applicationBuilder, IConfiguration configuration)
+    {
+        foreach (var startup in _startups)
+        {
+            startup.ConfigureAfterAuthentication(applicationBuilder, configuration);
+        }
+    }
+
     #endregion
 
     #region Private — Discovery
@@ -1198,54 +1214,76 @@ internal void RegisterModulesInternal(IList<ManifestModuleInfo> modules)
 
     #region Private — Startup Discovery
 
-    private void DiscoverStartupsInternal(IList<ManifestModuleInfo> modules)
+    internal void DiscoverStartupsInternal(IList<ManifestModuleInfo> modules)
     {
         var startups = new List<IPlatformStartup>();
         var logger = _loggerFactory.CreateLogger<ModuleBootstrapper>();
 
         foreach (var module in modules)
         {
-            if (string.IsNullOrEmpty(module.StartupType) || module.Assembly == null)
+            var startup = TryCreateStartup(module, logger);
+
+            if (startup != null)
             {
-                continue;
+                startups.Add(startup);
             }
+        }
 
-            try
-            {
-                var startupType = module.Assembly.GetType(module.StartupType) ??
-                                  FindTypeByName(module.Assembly, module.StartupType);
+        _startups = startups;
+        logger.LogDebug("Platform startup extensions: {StartupCount}", startups.Count);
+    }
 
-                if (startupType == null)
-                {
-                    logger.LogWarning("Startup type '{StartupType}' not found in {ModuleId}", module.StartupType, module.Id);
-                    continue;
-                }
+    private IPlatformStartup TryCreateStartup(ManifestModuleInfo module, ILogger logger)
+    {
+        // A module the platform will not initialize must not contribute middleware either. Its assembly is
+        // loaded whatever its errors, and InitializeModules skips it, so its services never reach the
+        // container while the hooks it registers still run and resolve them. Validation has already named
+        // the module and its errors in the log; a second record here would add only a line.
+        if (module.Errors.Count > 0)
+        {
+            return null;
+        }
 
-                if (!typeof(IPlatformStartup).IsAssignableFrom(startupType))
-                {
-                    logger.LogWarning("Type '{StartupType}' does not implement IPlatformStartup in {ModuleId}", module.StartupType, module.Id);
-                    continue;
-                }
+        if (string.IsNullOrEmpty(module.StartupType) || module.Assembly == null)
+        {
+            return null;
+        }
 
-                if (Activator.CreateInstance(startupType) is IPlatformStartup instance)
-                {
-                    if (instance is IHasLogger hasLogger)
-                    {
-                        hasLogger.Logger = _loggerFactory.CreateLogger(startupType);
-                    }
+        try
+        {
+            var startupType = module.Assembly.GetType(module.StartupType) ??
+                              FindTypeByName(module.Assembly, module.StartupType);
 
-                    startups.Add(instance);
-                    logger.LogInformation("Discovered {StartupTypeName} from {ModuleId}", startupType.Name, module.Id);
-                }
+            if (startupType == null)
+            {
+                logger.LogWarning("Startup type '{StartupType}' not found in {ModuleId}", module.StartupType, module.Id);
+                return null;
             }
-            catch (Exception ex)
+
+            if (!typeof(IPlatformStartup).IsAssignableFrom(startupType))
             {
-                logger.LogError(ex, "Error loading startup type from {ModuleId}", module.Id);
+                logger.LogWarning("Type '{StartupType}' does not implement IPlatformStartup in {ModuleId}", module.StartupType, module.Id);
+                return null;
             }
-        }
 
-        _startups = startups;
-        logger.LogDebug("Platform startup extensions: {StartupCount}", startups.Count);
+            if (Activator.CreateInstance(startupType) is not IPlatformStartup instance)
+            {
+                return null;
+            }
+
+            if (instance is IHasLogger hasLogger)
+            {
+                hasLogger.Logger = _loggerFactory.CreateLogger(startupType);
+            }
+
+            logger.LogInformation("Discovered {StartupTypeName} from {ModuleId}", startupType.Name, module.Id);
+            return instance;
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Error loading startup type from {ModuleId}", module.Id);
+            return null;
+        }
     }
 
     private static Type FindTypeByName(Assembly assembly, string typeName)

src/VirtoCommerce.Platform.Security/Services/UserApiKeyService.cs

@@ -1,11 +1,14 @@
 using System;
 using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
 using System.Threading.Tasks;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Caching.Memory;
 using VirtoCommerce.Platform.Core.Caching;
 using VirtoCommerce.Platform.Core.Common;
 using VirtoCommerce.Platform.Core.Security;
+using VirtoCommerce.Platform.Data.Infrastructure;
 using VirtoCommerce.Platform.Security.Caching;
 using VirtoCommerce.Platform.Security.Model;
 using VirtoCommerce.Platform.Security.Repositories;
@@ -14,6 +17,13 @@ namespace VirtoCommerce.Platform.Security.Services
 {
     public class UserApiKeyService : IUserApiKeyService
     {
+        // Own key component rather than a prefix on the value: CacheKey.With joins positionally, so
+        // "0-<raw>" and "1-<digest>" cannot collide whatever the caller sends.
+        private const string RawKeyDiscriminator = "0";
+        private const string DigestedKeyDiscriminator = "1";
+
+        private static readonly TimeSpan _missingApiKeyExpiration = TimeSpan.FromSeconds(30);
+
         private readonly Func<ISecurityRepository> _repositoryFactory;
         private readonly IPlatformMemoryCache _memoryCache;
 
@@ -25,7 +35,7 @@ public UserApiKeyService(Func<ISecurityRepository> repositoryFactory, IPlatformM
 
         public async Task<UserApiKey> GetApiKeyByKeyAsync(string apiKey)
         {
-            var cacheKey = CacheKey.With(GetType(), nameof(GetApiKeyByKeyAsync), apiKey);
+            var cacheKey = BuildApiKeyCacheKey(apiKey);
             return await _memoryCache.GetOrCreateExclusiveAsync(cacheKey, async (cacheEntry) =>
             {
                 //Add cache  expiration token
@@ -35,11 +45,42 @@ public async Task<UserApiKey> GetApiKeyByKeyAsync(string apiKey)
                     var result = await repository.UserApiKeys.Where(x => x.ApiKey == apiKey)
                                                         .AsNoTracking()
                                                         .FirstOrDefaultAsync();
+                    if (result == null)
+                    {
+                        // A miss is keyed on a string the caller chooses, so its entry must not be renewable
+                        // from outside. Clamped, not assigned: a deployment configuring CacheAbsoluteExpiration
+                        // below this bound must not have its negative entries lengthened. Nulled, not left
+                        // alone: the entry arrives sliding-only, and a sliding window shorter than the bound
+                        // would drop the entry between probes and send every probe back to the repository.
+                        cacheEntry.AbsoluteExpirationRelativeToNow = ShorterOf(cacheEntry.AbsoluteExpirationRelativeToNow, _missingApiKeyExpiration);
+                        cacheEntry.SlidingExpiration = null;
+                    }
+
                     return result?.ToModel(AbstractTypeFactory<UserApiKey>.TryCreateInstance());
                 }
             });
         }
 
+        private string BuildApiKeyCacheKey(string apiKey)
+        {
+            // The threshold is the ApiKey column's HasMaxLength; the repository is still queried with the
+            // candidate as presented.
+            if (apiKey == null || apiKey.Length <= DbContextBase.Length128)
+            {
+                return CacheKey.With(GetType(), nameof(GetApiKeyByKeyAsync), RawKeyDiscriminator, apiKey);
+            }
+
+            // Hex, not Base64: CacheKey.Normalize lower-cases the key downstream.
+            var digest = Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(apiKey)));
+
+            return CacheKey.With(GetType(), nameof(GetApiKeyByKeyAsync), DigestedKeyDiscriminator, digest);
+        }
+
+        private static TimeSpan ShorterOf(TimeSpan? configured, TimeSpan bound)
+        {
+            return configured.HasValue && configured.Value < bound ? configured.Value : bound;
+        }
+
         public async Task<UserApiKey[]> GetAllUserApiKeysAsync(string userId)
         {
             var cacheKey = CacheKey.With(GetType(), nameof(GetAllUserApiKeysAsync), userId);

src/VirtoCommerce.Platform.Web/Security/Authentication/ApiKeyAuthenticationOptions.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Authentication;
+using VirtoCommerce.Platform.Core;
 
 namespace VirtoCommerce.Platform.Web.Security.Authentication
 {
@@ -7,6 +8,6 @@ public class ApiKeyAuthenticationOptions : AuthenticationSchemeOptions
         public const string DefaultScheme = "API Key";
 
         public string Scheme { get; set; } = DefaultScheme;
-        public string ApiKeyParamName { get; set; } = "api_key";
+        public string ApiKeyParamName { get; set; } = PlatformConstants.Security.ApiKeyAuthentication.ParamName;
     }
 }