netlify.toml

# Netlify configuration for KubeStellar Console
# Enables PR preview deployments with mock data (no backend required)

[build]
  # Frontend is in web/ subdirectory
  base = "web"
  # Skip the tsc type-check step on Netlify — TypeScript 6 needs ~3 GB heap
  # which exceeds the default Node allocation in Netlify build containers,
  # causing OOM crashes during `tsc -b`. Type checking is already enforced
  # by CI (build workflow) and local `npm run build`. Vite compiles TS
  # directly via esbuild, so the runtime bundle is unaffected.
  command = "npm ci && npx vite build && node scripts/check-vendor-safety.mjs"
  publish = "dist"

[functions]
  # Netlify Functions directory (relative to base)
  directory = "netlify/functions"
  node_bundler = "esbuild"

# Edge Functions — inject SEO meta tags, serve robots.txt + sitemap.xml
# These only run on Netlify, not on localhost or cluster deployments
[[edge_functions]]
  path = "/*"
  function = "seo-meta"

[[edge_functions]]
  path = "/robots.txt"
  function = "robots"

[[edge_functions]]
  path = "/sitemap.xml"
  function = "sitemap"

[build.environment]
  # Enable demo mode with mock data for Netlify previews
  VITE_DEMO_MODE = "true"
  NODE_VERSION = "20"
  # Raise the V8 heap ceiling so esbuild function bundling (33 functions,
  # including the 30 MB googleapis tree) does not OOM.
  NODE_OPTIONS = "--max_old_space_size=4096"

# GitHub avatar proxy — avatars.githubusercontent.com is blocked by browser
# when loaded inside SVG foreignObject. Proxy through our domain to avoid CORS.
[[redirects]]
  from = "/api/avatar/:id"
  to = "https://avatars.githubusercontent.com/u/:id?s=40&v=4"
  status = 200
  force = true

# CNCF artwork proxy — official project icons from the cncf/artwork repo
[[redirects]]
  from = "/api/cncf-icon/:project"
  to = "https://raw.githubusercontent.com/cncf/artwork/master/projects/:project/icon/color/:project-icon-color.png"
  status = 200
  force = true

# Nightly E2E status API — proxy to Netlify Function
# Serves live GitHub Actions data (GITHUB_TOKEN set in Netlify dashboard)
[[redirects]]
  from = "/api/nightly-e2e/runs"
  to = "/.netlify/functions/nightly-e2e"
  status = 200

[[redirects]]
  from = "/api/public/nightly-e2e/runs"
  to = "/.netlify/functions/nightly-e2e"
  status = 200

# Presence tracking API — proxy to Netlify Function
[[redirects]]
  from = "/api/active-users"
  to = "/.netlify/functions/presence"
  status = 200

# Feedback App attribution proxy — creates issues via the
# kubestellar-console-bot GitHub App. Holds the App private key in
# Netlify env; consumer consoles (localhost + cluster) POST here with
# a per-user client credential so GitHub stamps
# performed_via_github_app.slug on every console-submitted issue.
[[redirects]]
  from = "/api/feedback-app"
  to = "/.netlify/functions/feedback-app"
  status = 200

# Missions API — proxy to Netlify Function (console-kb knowledge base)
[[redirects]]
  from = "/api/missions/file"
  to = "/.netlify/functions/missions-file"
  status = 200

[[redirects]]
  from = "/api/missions/browse"
  to = "/.netlify/functions/missions-browse"
  status = 200

[[redirects]]
  from = "/api/missions/scores/:project/:id"
  to = "/.netlify/functions/missions-scores?project=:project&id=:id"
  status = 200

[[redirects]]
  from = "/api/missions/scores"
  to = "/.netlify/functions/missions-scores"
  status = 200

# GA4 gtag.js proxy — Netlify Function serves gtag.js from same origin,
# bypassing domain-based ad blockers. This is the Netlify equivalent of
# the Go backend's GA4ScriptProxy. Route handled by gtag-proxy.mts via
# Config.path, so no redirect needed here.

# GA4 event collection — custom lightweight tracker sends directly to /api/m
# (Netlify Function via Config.path, no gtag.js loaded)

# Analytics dashboard API — proxy to Netlify Function
# Serves live GA4 Data API data (GA4_SERVICE_ACCOUNT_JSON + GA4_PROPERTY_ID in Netlify dashboard)
[[redirects]]
  from = "/api/analytics-dashboard"
  to = "/.netlify/functions/analytics-dashboard"
  status = 200

# YouTube playlist API — proxy to Netlify Function
[[redirects]]
  from = "/api/youtube/playlist"
  to = "/.netlify/functions/youtube-playlist"
  status = 200

# Medium blog API — proxy to Netlify Function
[[redirects]]
  from = "/api/medium/blog"
  to = "/.netlify/functions/medium-blog"
  status = 200

# YouTube thumbnail proxy — serves thumbnails through our origin to avoid MSW blocking
[[redirects]]
  from = "/api/youtube/thumbnail/*"
  to = "/.netlify/functions/youtube-thumbnail"
  status = 200

# Analytics dashboard page — serve static HTML
[[redirects]]
  from = "/analytics"
  to = "/analytics.html"
  status = 200

# Issue Activity Stats API — proxy to Netlify Function
# Daily issue opened/closed + PRs merged chart data (GITHUB_TOKEN in Netlify dashboard)
[[redirects]]
  from = "/api/issue-stats"
  to = "/.netlify/functions/issue-stats"
  status = 200

# Contributor badge API (RFC #8862 Phase 3) — public SVG tier badge.
# Mirrors pkg/api/handlers/rewards_badge.go so the Netlify-hosted site
# answers GET /api/rewards/badge/:github_login identically to the Go
# backend. status=200 so the function sees the original URL path.
[[redirects]]
  from = "/api/rewards/badge/*"
  to = "/.netlify/functions/rewards-badge/:splat"
  status = 200

# Identity OIDC API — proxy to Netlify Functions (enterprise OIDC dashboard)
[[redirects]]
  from = "/api/identity/oidc/summary"
  to = "/.netlify/functions/identity-oidc-summary"
  status = 200

[[redirects]]
  from = "/api/identity/oidc/providers"
  to = "/.netlify/functions/identity-oidc-providers"
  status = 200

[[redirects]]
  from = "/api/identity/oidc/sessions"
  to = "/.netlify/functions/identity-oidc-sessions"
  status = 200

# Identity RBAC API — proxy to Netlify Functions (enterprise RBAC Audit dashboard)
[[redirects]]
  from = "/api/identity/rbac/summary"
  to = "/.netlify/functions/identity-rbac-summary"
  status = 200

[[redirects]]
  from = "/api/identity/rbac/bindings"
  to = "/.netlify/functions/identity-rbac-bindings"
  status = 200

[[redirects]]
  from = "/api/identity/rbac/findings"
  to = "/.netlify/functions/identity-rbac-findings"
  status = 200

# Identity Sessions API — proxy to Netlify Functions (enterprise Session dashboard)
[[redirects]]
  from = "/api/identity/sessions/summary"
  to = "/.netlify/functions/identity-sessions-summary"
  status = 200

[[redirects]]
  from = "/api/identity/sessions/active"
  to = "/.netlify/functions/identity-sessions-active"
  status = 200

[[redirects]]
  from = "/api/identity/sessions/policies"
  to = "/.netlify/functions/identity-sessions-policies"
  status = 200

# Compliance SIEM API — proxy to Netlify Functions (enterprise SIEM dashboard)
[[redirects]]
  from = "/api/v1/compliance/siem/events"
  to = "/.netlify/functions/compliance-siem-events"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/siem/alerts"
  to = "/.netlify/functions/compliance-siem-alerts"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/siem/summary"
  to = "/.netlify/functions/compliance-siem-summary"
  status = 200

# Compliance Incident Response API — proxy to Netlify Functions (enterprise incident response dashboard)
[[redirects]]
  from = "/api/v1/compliance/incidents"
  to = "/.netlify/functions/compliance-incidents"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/incidents/metrics"
  to = "/.netlify/functions/compliance-incidents-metrics"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/incidents/playbooks"
  to = "/.netlify/functions/compliance-incidents-playbooks"
  status = 200

# Compliance Threat Intel API — proxy to Netlify Functions (enterprise threat intel dashboard)
[[redirects]]
  from = "/api/v1/compliance/threat-intel/feeds"
  to = "/.netlify/functions/compliance-threat-intel-feeds"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/threat-intel/iocs"
  to = "/.netlify/functions/compliance-threat-intel-iocs"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/threat-intel/summary"
  to = "/.netlify/functions/compliance-threat-intel-summary"
  status = 200

# Compliance ERM Risk Matrix API — proxy to Netlify Functions (enterprise risk matrix dashboard)
[[redirects]]
  from = "/api/v1/compliance/erm/risk-matrix/risks"
  to = "/.netlify/functions/compliance-erm-risk-matrix-risks"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/erm/risk-matrix/heatmap"
  to = "/.netlify/functions/compliance-erm-risk-matrix-heatmap"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/erm/risk-matrix/summary"
  to = "/.netlify/functions/compliance-erm-risk-matrix-summary"
  status = 200

# Compliance ERM Risk Register API — proxy to Netlify Functions (enterprise risk register dashboard)
[[redirects]]
  from = "/api/v1/compliance/erm/risk-register/risks"
  to = "/.netlify/functions/compliance-erm-risk-register-risks"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/erm/risk-register/categories"
  to = "/.netlify/functions/compliance-erm-risk-register-categories"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/erm/risk-register/summary"
  to = "/.netlify/functions/compliance-erm-risk-register-summary"
  status = 200

# Compliance ERM Risk Appetite API — proxy to Netlify Functions (enterprise risk appetite dashboard)
[[redirects]]
  from = "/api/v1/compliance/erm/risk-appetite/thresholds"
  to = "/.netlify/functions/compliance-erm-risk-appetite-thresholds"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/erm/risk-appetite/kris"
  to = "/.netlify/functions/compliance-erm-risk-appetite-kris"
  status = 200

[[redirects]]
  from = "/api/v1/compliance/erm/risk-appetite/summary"
  to = "/.netlify/functions/compliance-erm-risk-appetite-summary"
  status = 200

# Supply Chain SBOM API — proxy to Netlify Functions (enterprise SBOM dashboard)
[[redirects]]
  from = "/api/supply-chain/sbom/documents"
  to = "/.netlify/functions/supply-chain-sbom-documents"
  status = 200

[[redirects]]
  from = "/api/supply-chain/sbom/summary"
  to = "/.netlify/functions/supply-chain-sbom-summary"
  status = 200

# Supply Chain License Compliance API — proxy to Netlify Functions (enterprise license dashboard)
[[redirects]]
  from = "/api/supply-chain/licenses/packages"
  to = "/.netlify/functions/supply-chain-licenses-packages"
  status = 200

[[redirects]]
  from = "/api/supply-chain/licenses/categories"
  to = "/.netlify/functions/supply-chain-licenses-categories"
  status = 200

[[redirects]]
  from = "/api/supply-chain/licenses/summary"
  to = "/.netlify/functions/supply-chain-licenses-summary"
  status = 200

# ACMM maturity scan API
[[redirects]]
  from = "/api/acmm/scan"
  to = "/.netlify/functions/acmm-scan"
  status = 200

# ACMM maturity badge (SVG)
[[redirects]]
  from = "/api/acmm/badge/*"
  to = "/.netlify/functions/acmm-badge/:splat"
  status = 200

# GitHub Actions pipelines API
[[redirects]]
  from = "/api/github-pipelines"
  to = "/.netlify/functions/github-pipelines"
  status = 200

# Daily bonus points API
[[redirects]]
  from = "/api/rewards/bonus"
  to = "/.netlify/functions/bonus-points"
  status = 200

# GA4 gtag.js script proxy (same-origin)
[[redirects]]
  from = "/api/gtag"
  to = "/.netlify/functions/gtag-proxy"
  status = 200

# GA4 event collection proxy (base64 relay)
[[redirects]]
  from = "/api/m"
  to = "/.netlify/functions/analytics-collect"
  status = 200

# Umami tracking script proxy (same-origin)
[[redirects]]
  from = "/api/ksc"
  to = "/.netlify/functions/umami-script"
  status = 200

# Umami event collection proxy
[[redirects]]
  from = "/api/send"
  to = "/.netlify/functions/umami-collect"
  status = 200

# GitHub contributor rewards API
[[redirects]]
  from = "/api/rewards/github"
  to = "/.netlify/functions/github-rewards"
  status = 200

# NPS survey API
[[redirects]]
  from = "/api/nps"
  to = "/.netlify/functions/nps"
  status = 200

# Affiliate click tracking API
[[redirects]]
  from = "/api/affiliate/clicks"
  to = "/.netlify/functions/affiliate-clicks"
  status = 200

# Analytics ACMM integration
[[redirects]]
  from = "/api/analytics-accm"
  to = "/.netlify/functions/analytics-accm"
  status = 200

# Health endpoint — serves project config + enabled_dashboards so the
# sidebar can discover and promote dashboards (e.g. quantum). Without this,
# fetch('/health') falls through to the SPA catch-all and returns HTML.
[[redirects]]
  from = "/health"
  to = "/.netlify/functions/health"
  status = 200

# Quantum proxy — forwards /api/quantum/* and /api/result/histogram to the
# quantum-proxy Netlify function. Without these rules every quantum request
# falls through to the SPA catch-all and returns HTML instead of JSON.
[[redirects]]
  from = "/api/quantum/*"
  to = "/.netlify/functions/quantum-proxy/:splat"
  status = 200

[[redirects]]
  from = "/api/result/histogram"
  to = "/.netlify/functions/quantum-proxy/result/histogram"
  status = 200

# SPA routing - redirect all routes to index.html (only if file doesn't exist)
[[redirects]]
  from = "/*"
  to = "/index.html"
  status = 200
  force = false

# Headers for security and caching.
# Cache-Control: no-cache, no-store is set here for all routes so that SPA paths like
# /clusters (served as index.html via the /* rewrite) are always refetched fresh
# after a deploy. Netlify matches headers against the request path, not the
# served file, so the /*.html rule below does NOT cover /clusters etc.
# The /assets/* rule (below) overrides this with immutable for hashed bundles.
[[headers]]
  for = "/*"
  [headers.values]
    X-Frame-Options = "DENY"
    X-Content-Type-Options = "nosniff"
    Referrer-Policy = "strict-origin-when-cross-origin"
    Strict-Transport-Security = "max-age=31536000; includeSubDomains"
    Permissions-Policy = "camera=(), microphone=(), geolocation=()"
    X-XSS-Protection = "1; mode=block"
    # Content Security Policy
    #
    # Hardened per OWASP ZAP findings (issue #5971):
    #   - Removed script-src 'unsafe-inline' — the one inline <script> in
    #     index.html was moved to /secure-context-check.js.
    #   - Removed host wildcards (https://*.google-analytics.com etc.) in
    #     favor of explicit subdomain allowlists.
    #   - Removed scheme-only wss: wildcard; same-origin WebSockets are
    #     already covered by 'self' under CSP Level 3.
    #   - Removed ws://localhost:* — the local agent WebSocket is a dev-only
    #     feature and never successfully connects from console.kubestellar.io.
    #
    # Retained unsafe directives (cannot be removed without breaking features):
    #   - style-src 'unsafe-inline' — React renders `style={{}}` props as
    #     `style="..."` HTML attributes, which are blocked under strict CSP
    #     without 'unsafe-inline'. Tailwind and our app-shell <style> block
    #     also rely on inline styles. Removing this would require rewriting
    #     every inline style across the entire component tree.
    Content-Security-Policy = "default-src 'self'; script-src 'self' https://www.googletagmanager.com https://analytics.kubestellar.io; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https://github.com https://avatars.githubusercontent.com https://raw.githubusercontent.com https://api.dicebear.com; connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://analytics.google.com https://fonts.googleapis.com https://www.googleapis.com https://www.googletagmanager.com https://api.github.com https://api.dicebear.com https://fonts.gstatic.com https://analytics.kubestellar.io https://raw.githubusercontent.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; worker-src 'self' blob:; manifest-src 'self'; report-uri /api/csp-report"
    Report-To = "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/api/csp-report\"}]}"
    Cache-Control = "no-cache, no-store, must-revalidate"
    Pragma = "no-cache"

# Versioned JS/CSS assets have content-hashed filenames — safe to cache forever.
# Netlify uses the most specific matching path, so /assets/* takes precedence over /*.
[[headers]]
  for = "/assets/*"
  [headers.values]
    Cache-Control = "public, max-age=31536000, immutable"

# Embed routes allow iframe embedding for CI/CD pipeline cards.
# Overrides global X-Frame-Options: DENY and CSP frame-ancestors 'none' to enable framing.
# These routes display public GitHub Actions data and are designed for embedding.
[[headers]]
  for = "/embed/*"
  [headers.values]
    X-Frame-Options = "SAMEORIGIN"
    Content-Security-Policy = "default-src 'self'; script-src 'self' https://www.googletagmanager.com https://analytics.kubestellar.io; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https://github.com https://avatars.githubusercontent.com https://raw.githubusercontent.com https://api.dicebear.com; connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://analytics.google.com https://fonts.googleapis.com https://www.googleapis.com https://www.googletagmanager.com https://api.github.com https://api.dicebear.com https://fonts.gstatic.com https://analytics.kubestellar.io https://raw.githubusercontent.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'self'; worker-src 'self' blob:; manifest-src 'self'; report-uri /api/csp-report"
    Report-To = "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/api/csp-report\"}]}"
    Cache-Control = "no-cache, no-store, must-revalidate"
    Pragma = "no-cache"

# HTML files must always revalidate to pick up new chunk references after deploys
[[headers]]
  for = "/*.html"
  [headers.values]
    Cache-Control = "no-cache, no-store, must-revalidate"
    Pragma = "no-cache"

[[headers]]
  for = "/index.html"
  [headers.values]
    Cache-Control = "no-cache, no-store, must-revalidate"
    Pragma = "no-cache"

# Context-specific settings
[context.production]
  # Production builds (main branch) - still use demo mode for now
  [context.production.environment]
    VITE_DEMO_MODE = "true"

[context.deploy-preview]
  # PR preview deployments - always use demo mode
  [context.deploy-preview.environment]
    VITE_DEMO_MODE = "true"

[context.branch-deploy]
  # Branch deploys - use demo mode
  [context.branch-deploy.environment]
    VITE_DEMO_MODE = "true"