# Refactor: strict CORS by default; explicit opt-in for AllowAnyOrigin

**Task**: AZ-354_refactor_strict_cors_default
**Name**: Strict CORS default + explicit opt-in for permissive policy
**Description**: When `CorsConfig:AllowedOrigins` is empty, refuse to start in `Production` and warn loudly in `Development`. Only configure the open policy when the operator opts in via `CorsConfig:AllowAnyOrigin=true`.
**Complexity**: 2 points
**Dependencies**: None
**Component**: Api
**Tracker**: AZ-354
**Epic**: AZ-350

## Problem

`SatelliteProvider.Api/Program.cs:37-47` falls through to `policy.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod()` when `CorsConfig:AllowedOrigins` is empty. A misconfigured prod deployment silently exposes the entire surface to any origin.

## Outcome

- Production deployment with empty `AllowedOrigins` fails to start with a clear error message.
- Development deployment with empty `AllowedOrigins` logs a loud warning.
- `CorsConfig:AllowAnyOrigin=true` (explicit) is the only path that produces the permissive policy.
- 37 unit + 5 smoke tests stay green (test fixtures already specify origins).

## Scope

### Included
- Read `CorsConfig:AllowAnyOrigin` (new boolean flag, default false).
- Branch logic in `Program.cs` CORS configuration: empty origins + Production → throw; empty origins + Development → warn; non-empty origins → existing strict policy; explicit `AllowAnyOrigin=true` → existing permissive policy.
- Update `appsettings.Development.json` to set explicit origins (or set the new flag) so dev still works out of the box.

### Excluded
- Changing the CORS policy semantics for non-empty `AllowedOrigins`.
- Adding per-endpoint CORS overrides.

## Acceptance Criteria

**AC-1: Production refuses to start without origins**
Given `ASPNETCORE_ENVIRONMENT=Production` and empty `CorsConfig:AllowedOrigins` and no `CorsConfig:AllowAnyOrigin=true`
When the host attempts to start
Then it throws a clear configuration exception naming the missing setting.

**AC-2: Development warns but starts**
Given `ASPNETCORE_ENVIRONMENT=Development` and empty `CorsConfig:AllowedOrigins`
When the host starts
Then a warning log entry is emitted and the host continues to run.

**AC-3: Explicit opt-in works**
Given `CorsConfig:AllowAnyOrigin=true`
When the host starts
Then the permissive CORS policy is configured (current behavior).

**AC-4: Tests stay green**
Given the post-refactor build
When `scripts/run-tests.sh --smoke` runs
Then all 37 unit + 5 smoke scenarios pass.

## Constraints

- Existing test/dev fixtures that specify origins must continue to work without changes (other than appsettings overrides).

## Risks & Mitigation

**Risk 1: existing prod env vars don't have origins set**
- *Risk*: if any deployed environment relies on the default-permissive behavior, it will break.
- *Mitigation*: this is the security fix the change exists to provide. Document in deploy notes / runbook.

Full change entry: `_docs/04_refactoring/03-code-quality-refactoring/list-of-changes.md` (C04).
