fix(admin): resolve CSP and API URL issues

- Add *.docs.plus to CSP connect-src for API calls
- Remove /api from NEXT_PUBLIC_API_URL (endpoints include /api)
- Exclude Next.js 15 missing manifests from PWA precache

Author: HMarzban

docker-compose.prod.yml

@@ -497,7 +497,7 @@ services:
       args:
         NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
         NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
-        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-https://prodback.docs.plus/api}
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-https://prodback.docs.plus}
         NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-https://docs.plus}
     restart: always
     stop_grace_period: 30s
@@ -508,7 +508,7 @@ services:
       HOSTNAME: '0.0.0.0'
       NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
       NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
-      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-https://prodback.docs.plus/api}
+      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-https://prodback.docs.plus}
       NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-https://docs.plus}
     networks:
       - docsplus-network

packages/admin-dashboard/next.config.js

@@ -52,7 +52,7 @@ const nextConfig = {
       "style-src 'self' 'unsafe-inline'",
       `img-src 'self' data: blob: https://*.supabase.co https://*.googleusercontent.com${isDev ? ' http://localhost:* http://127.0.0.1:*' : ''}`,
       "font-src 'self' data:",
-      `connect-src 'self' https://*.supabase.co wss://*.supabase.co https://accounts.google.com${localDevHosts}`,
+      `connect-src 'self' https://*.supabase.co wss://*.supabase.co https://accounts.google.com https://*.docs.plus${localDevHosts}`,
       `frame-src 'self' https://accounts.google.com${isDev ? ' http://localhost:*' : ''}`,
       "frame-ancestors 'none'",
       "form-action 'self'",

packages/admin-dashboard/src/constants/config.ts

@@ -6,6 +6,7 @@
 export const APP_URL = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3001'
 
 // API URL for backend requests
+// API_URL is the base URL - endpoints include /api/admin/... paths
 export const API_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000'
 
 // Default page size for tables

packages/webapp/next.config.js

@@ -9,8 +9,9 @@ const withPWA = require('next-pwa')({
   disable: !isProduction,
   register: true,
   skipWaiting: false,
-  runtimeCaching
-  // disableDevLogs: true,
+  runtimeCaching,
+  // Exclude files that don't exist in Next.js 15+
+  buildExcludes: [/dynamic-css-manifest\.json$/, /middleware-manifest\.json$/]
 })
 
 module.exports = withPWA({