fleshout backend

backend/Gateway/GatewayApplicationBuilderExtensions.cs

@@ -0,0 +1,14 @@
+namespace Backend.Gateway;
+
+public static class GatewayApplicationBuilderExtensions
+{
+    // CORS must run before the rate limiter so that rejected requests still carry
+    // the headers the browser needs to surface a 429 to the client.
+    public static IApplicationBuilder UseApiGateway(this IApplicationBuilder app)
+    {
+        app.UseCors(GatewayServiceCollectionExtensions.CorsPolicyName);
+        app.UseRateLimiter();
+
+        return app;
+    }
+}