From efc4e3ce1f503105a13a122853f18ead5448fd32 Mon Sep 17 00:00:00 2001 From: Mahmoud Salem Date: Tue, 7 Jul 2026 15:05:05 +0300 Subject: [PATCH] chore(api): expose OpenAPI JSON + Scalar UI in production MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The docs were mounted only under IsDevelopment(). Enable them in all environments so the team can browse the API surface for the graduation demo: - OpenAPI JSON: /openapi/v1.json - Scalar UI: /scalar/v1 Both endpoints are anonymous, but every endpoint they describe still enforces its own [Authorize] — no data or privileged action is reachable without a valid token. --- server/src/ScholarPath.API/Program.cs | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/server/src/ScholarPath.API/Program.cs b/server/src/ScholarPath.API/Program.cs index 2b52252d..eb482265 100644 --- a/server/src/ScholarPath.API/Program.cs +++ b/server/src/ScholarPath.API/Program.cs @@ -346,15 +346,17 @@ app.UseMiddleware(); app.UseMiddleware(); -if (app.Environment.IsDevelopment()) +// API docs are exposed in ALL environments (incl. production) so the team can +// browse the endpoint surface for the graduation demo. The OpenAPI JSON at +// /openapi/v1.json and the Scalar UI at /scalar/v1 are anonymous, but every +// endpoint they describe still enforces its own [Authorize] — no data or +// privileged action is reachable without a valid token. +app.UseSwagger(opts => opts.RouteTemplate = "openapi/{documentName}.json"); +app.MapScalarApiReference(opts => { - app.UseSwagger(opts => opts.RouteTemplate = "openapi/{documentName}.json"); - app.MapScalarApiReference(opts => - { - opts.Title = "ScholarPath API"; - opts.OpenApiRoutePattern = "/openapi/{documentName}.json"; - }); -} + opts.Title = "ScholarPath API"; + opts.OpenApiRoutePattern = "/openapi/{documentName}.json"; +}); app.UseHttpsRedirection(); app.UseCors();