next.config.mjs

next.config.mjsapps/web/next.config.mjsraw ← web4,913 B← Back to the app
1import { webSecurityHeaders } from "@factory/shared/security-headers";
2 
3/**
4 * Security headers (TASK-0134, ASVS L2 §7/§9). Applied to EVERY web response
5 * via Next's `headers()` — the web previously sent NONE (no CSP, no
6 * X-Frame-Options, no nosniff): a finding fixed here.
7 *
8 * The policy lives in `@factory/shared/security-headers.ts` (single source of
9 * truth) and is asserted by `tests/security/headers.test.ts`, which imports
10 * the SAME module — the web's live headers and the test expectations cannot
11 * drift. `next.config.mjs` imports the module directly (Node ≥22.6 type
12 * stripping; the module is dependency-free pure ESM).
13 *
14 * The connect-src API/WS origins mirror `apps/web/src/lib/constants.ts`
15 * (NEXT_PUBLIC_API_URL / NEXT_PUBLIC_WS_URL with the same dev defaults).
16 */
17const apiUrl = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:4000/api/v1";
18const wsUrl = process.env.NEXT_PUBLIC_WS_URL ?? "ws://localhost:4001";
19const apiOrigin = apiUrl.replace(/\/api\/v1\/?$/, "");
20const securityHeaders = webSecurityHeaders({ apiOrigin, wsOrigin: wsUrl });
21 
22/** @type {import('next').NextConfig} */
23const nextConfig = {
24  reactStrictMode: true,
25  async headers() {
26    return [
27      {
28        source: "/(.*)",
29        headers: Object.entries(securityHeaders).map(([key, value]) => ({ key, value }))
30      }
31    ];
32  },
33  // The @factory/* packages are consumed source-first (no build step). Transpile
34  // them through the web bundler so their TS/TSX resolves against the app's
35  // TS config instead of requiring per-package dist artifacts.
36  transpilePackages: [
37    "@factory/shared",
38    "@factory/ui",
39    "@factory/editor",
40    "@factory/collaboration",
41    "@factory/database-engine",
42    "@factory/config",
43    "@factory/whiteboard"
44  ],
45  // The @factory/* packages use NodeNext-style relative imports that end in
46  // ".js" even though the source files are ".ts" (e.g. `export * from
47  // "./errors.js"` resolves to errors.ts). tsx/esbuild (API, worker) map
48  // .js→.ts automatically, but Next's webpack does not, so without this every
49  // transpiled-package import fails to resolve and every page render 500s
50  // ("Can't resolve './errors.js'"). extensionAlias tells webpack to fall back
51  // to the TS extension when a .js import has no .js file on disk.
52  // (TASK-0100 S5 — surfaced when the web was first rendered under Playwright.)
53  webpack: (config) => {
54    config.resolve = config.resolve ?? {};
55    config.resolve.extensionAlias = {
56      ...config.resolve.extensionAlias,
57      ".js": [".js", ".ts", ".tsx"],
58      ".jsx": [".jsx", ".tsx"],
59      ".mjs": [".mjs", ".ts", ".tsx"]
60    };
61    return config;
62  },
63  images: {
64    remotePatterns: [
65      // Local MinIO S3 endpoint (file pipeline dev deployment).
66      { protocol: "http", hostname: "localhost", port: "9001" },
67      { protocol: "http", hostname: "127.0.0.1", port: "9001" },
68      // Production S3 host — replace with the real bucket endpoint per
69      // infrastructure/ deployment.
70      { protocol: "https", hostname: "s3.<region>.amazonaws.com" },
71      { protocol: "https", hostname: "s3.<region>.amazonaws.com.cn" }
72    ]
73  },
74  // NEXT_PUBLIC_* vars are inlined at build time; everything else reaches
75  // route handlers / server components as plain process.env values. No
76  // additional passthrough wiring is needed beyond the standard Next env
77  // handling (see .env.example).
78  experimental: {
79    typedRoutes: false
80  },
81  // ── PRE-EXISTING TECH DEBT — recorded conflict (AGENTS.md rule 29) ─────────
82  // `next build` runs the full tsc pass and the build-time ESLint, and both
83  // currently fail for reasons unrelated to any runtime behavior:
84  //   1. ~95 pre-existing type errors across 24 files (known baseline; the
85  //      dev server compiles the same source fine because esbuild strips
86  //      types — nothing here is new breakage).
87  //   2. The build-time linter invokes ESLint with `--useEslintrc`/
88  //      `--extensions`, which the repo's ESLint 9 rejects
89  //      ("Unknown options: useEslintrc, extensions"); `next lint` is broken
90  //      at baseline for the same reason (lint runs via the legacy
91  //      --no-eslintrc invocation instead).
92  // These flags make the production build (the performance-critical serving
93  // path — dev-mode `next dev` ships ~27 MB of unminified JS and compiles
94  // each route on demand, 2.8–7.9 s per click) succeed while the baseline
95  // debt is paid down. RE-ENABLE (remove these two keys) once:
96  //   tsc -p apps/web/tsconfig.json --noEmit  → 0 errors
97  //   and the repo lints again under ESLint 9 (flat config).
98  // CI's standalone `typecheck` (tsc --noEmit) and `lint` steps are the
99  // quality gate while this is in place — they are NOT bypassed by a build.
100  typescript: { ignoreBuildErrors: true },
101  eslint: { ignoreDuringBuilds: true }
102};
103 
104export default nextConfig;
105