LovroG05
9d807a6cf1
Add /auth/login and /auth/callback handlers. The backend holds the client secret and exchanges the authorization code server-side; the browser never sees the secret. Redirect URI and post-login fragment destination are derived solely from GATEWAY_SERVER_PUBLIC_URL (required when OIDC is set) to prevent host-header injection.
23 lines
715 B
TypeScript
23 lines
715 B
TypeScript
import { defineConfig } from 'vite';
|
|
import react from '@vitejs/plugin-react';
|
|
import tailwindcss from '@tailwindcss/vite';
|
|
|
|
// https://vite.dev/config/
|
|
export default defineConfig({
|
|
plugins: [react(), tailwindcss()],
|
|
build: {
|
|
// Build straight into the Go embed package so `go build` bundles the UI.
|
|
// emptyOutDir is required because the target is outside the project root.
|
|
outDir: '../internal/web/dist',
|
|
emptyOutDir: true,
|
|
},
|
|
server: {
|
|
// Forward gateway routes to the Go server during `npm run dev`.
|
|
proxy: {
|
|
'/v1': 'http://localhost:8080',
|
|
'/api': 'http://localhost:8080',
|
|
'/auth': { target: 'http://localhost:8080', changeOrigin: false },
|
|
},
|
|
},
|
|
});
|