From 5df0f62f3b3658e2e97bc48a719d9e5deffe73f6 Mon Sep 17 00:00:00 2001
From: AzuTear <vmbao62@hotmail.com>
Date: Sat, 1 Aug 2026 02:07:27 +0200
Subject: [PATCH] fix(build): finalize ephemeral key options

---
 backend/Program.cs | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/backend/Program.cs b/backend/Program.cs
index 3444555..806245a 100644
--- a/backend/Program.cs
+++ b/backend/Program.cs
@@ -13,10 +13,6 @@ if (isOpenApiGeneration)
     // auth services, so use an ephemeral contract-only signing value.
     builder.Configuration["Jwt:Key"] =
         "openapi-contract-generation-only-000000000000000000";
-    builder.Services.AddDataProtection()
-        .UseEphemeralDataProtectionProvider();
-    builder.Services.Configure<KeyManagementOptions>(options =>
-        options.AutoGenerateKeys = false);
 }
 
 // --- Service Registration ---
@@ -34,6 +30,16 @@ builder.Services.AddNexusHealthChecks(builder.Configuration);
 builder.Services.AddNexusPlatform(builder.Configuration);
 builder.Services.AddControllers(options =>
     options.Filters.Add<NexusProblemDetailsFilter>());
+if (isOpenApiGeneration)
+{
+    // Apply this after every framework service has registered its defaults.
+    // The contract host never accepts traffic and must not persist runtime
+    // key material as a side effect of schema extraction.
+    builder.Services.AddDataProtection()
+        .UseEphemeralDataProtectionProvider();
+    builder.Services.PostConfigure<KeyManagementOptions>(options =>
+        options.AutoGenerateKeys = false);
+}
 
 var app = builder.Build();