fix(cors): allow PATCH in restricted policy

src/Host/FSH.Starter.Api/appsettings.Production.json

@@ -60,7 +60,7 @@
     "AllowAll": false,
     "AllowedOrigins": [],
     "AllowedHeaders": [ "content-type", "authorization" ],
-    "AllowedMethods": [ "GET", "POST", "PUT", "DELETE" ]
+    "AllowedMethods": [ "GET", "POST", "PUT", "PATCH", "DELETE" ]
   },
   "JwtOptions": {
     "Issuer": "fsh.local",

src/Host/FSH.Starter.Api/appsettings.json

@@ -101,7 +101,7 @@
       "http://localhost:5174"
     ],
     "AllowedHeaders": [ "content-type", "authorization" ],
-    "AllowedMethods": [ "GET", "POST", "PUT", "DELETE" ]
+    "AllowedMethods": [ "GET", "POST", "PUT", "PATCH", "DELETE" ]
   },
   "JwtOptions": {
     "Issuer": "fsh.local",

src/Tests/Framework.Tests/Framework.Tests.csproj

@@ -32,4 +32,13 @@
 		<ProjectReference Include="..\..\BuildingBlocks\Web\Web.csproj" />
 	</ItemGroup>
 
+	<ItemGroup>
+		<None Include="..\..\Host\FSH.Starter.Api\appsettings.json"
+			  Link="HostConfiguration\appsettings.json"
+			  CopyToOutputDirectory="PreserveNewest" />
+		<None Include="..\..\Host\FSH.Starter.Api\appsettings.Production.json"
+			  Link="HostConfiguration\appsettings.Production.json"
+			  CopyToOutputDirectory="PreserveNewest" />
+	</ItemGroup>
+
 </Project>

src/Tests/Framework.Tests/Web/CorsConfigurationTests.cs

@@ -0,0 +1,29 @@
+using System.Text.Json;
+
+namespace Framework.Tests.Web;
+
+public sealed class CorsConfigurationTests
+{
+    [Theory]
+    [InlineData("appsettings.json")]
+    [InlineData("appsettings.Production.json")]
+    public void AllowedMethods_Should_IncludePatch_When_RestrictedCorsIsConfigured(string fileName)
+    {
+        // Arrange
+        string path = Path.Combine(AppContext.BaseDirectory, "HostConfiguration", fileName);
+
+        // Act
+        using JsonDocument document = JsonDocument.Parse(File.ReadAllText(path));
+        JsonElement corsOptions = document.RootElement.GetProperty("CorsOptions");
+        string[] allowedMethods = corsOptions
+            .GetProperty("AllowedMethods")
+            .EnumerateArray()
+            .Select(method => method.GetString())
+            .OfType<string>()
+            .ToArray();
+
+        // Assert
+        corsOptions.GetProperty("AllowAll").GetBoolean().ShouldBeFalse();
+        allowedMethods.ShouldContain("PATCH");
+    }
+}