From 91b2baa4453b98c8ee6cf933254b4533417da1c5 Mon Sep 17 00:00:00 2001
From: claude <gelu@mihes.ro>
Date: Mon, 1 Jun 2026 22:41:29 +0300
Subject: [PATCH] Fix email-api middleware order: API key check before swagger

UseInternalApiKeyProtection was registered after UseSwaggerInDevelopment,
allowing unauthenticated access to /swagger. Swapped order to match
rag-api and cv-matcher-api.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 Apis/email-api/Program.cs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/Apis/email-api/Program.cs b/Apis/email-api/Program.cs
index 2d7cee0..ae2737f 100644
--- a/Apis/email-api/Program.cs
+++ b/Apis/email-api/Program.cs
@@ -50,9 +50,8 @@ try
 
     app.UseDefaultSerilogRequestLogging();
     app.UseJsonExceptionHandler(ServiceName);
-    app.UseSwaggerInDevelopment("Email API", "EmailAPI");
-
     app.UseInternalApiKeyProtection();
+    app.UseSwaggerInDevelopment("Email API", "EmailAPI");
 
     app.UseRouting();
     app.UseAuthorization();