fix(routing): let MVC controllers win over Vue SPA shell on shared prefixes

Vue app prefixes like /CMS, /Effort, etc. were claimed in two places that
ran before MVC routing: a dev-only Vite proxy and the URL rewriter
("(?i)^{appName}" → "/2/vue/src/{app}/index.html"). Any controller route
under those prefixes - notably /CMS/Files (CMSController.Files, the
modernized download surface VPR-138 hardens) - was returned the SPA shell
instead of executing.

Restructure so SPA shell serving (Vite proxy + rewriter + /2/vue static
files) runs inside a UseWhen branch gated on ctx.GetEndpoint() == null.
MVC controller routes claim their endpoints during UseRouting() and the
branch is skipped; everything else (Vue SPA roots, deep client-side
routes, Vite asset paths) still hits the branch and gets the SPA shell.

Smoke-tested locally:
- /CMS/Files?ids=<bogus> now returns 404 from the controller
  (was 200 SPA shell).
- /CMS still serves the Vue SPA shell.
- /Effort and /favicon.ico unaffected.
- Vite /2/vue/@vite/client and HMR assets unaffected.

Author: rlorenzo

web/Program.cs

@@ -416,44 +416,6 @@ void RegisterDbContext<TContext>(string connectionStringKey) where TContext : Db
 
     }
 
-    // In development, set up Vite proxy BEFORE rewrite rules so it can handle .ts/.js files
-    if (app.Environment.IsDevelopment())
-    {
-        // Development: Proxy Vue.js assets to Vite dev server for hot module replacement (HMR)
-        // This middleware intercepts requests for Vue assets and forwards them to the Vite dev server
-        app.Use(async (context, next) =>
-        {
-            if (ViteProxyHelpers.ShouldProxyToVite(context, VueAppNames))
-            {
-                try
-                {
-                    // Use the registered HttpClient from dependency injection
-                    var httpClientFactory = context.RequestServices.GetRequiredService<IHttpClientFactory>();
-                    var httpClient = httpClientFactory.CreateClient("ViteProxy");
-
-                    // Build the Vite server URL and try to proxy directly
-                    var viteUrl = ViteProxyHelpers.BuildViteUrl(context.Request.Path, context.Request.QueryString, VueAppNames);
-                    var requestMessage = ViteProxyHelpers.CreateProxyRequest(context, viteUrl);
-                    using var response = await httpClient.SendAsync(requestMessage, HttpCompletionOption.ResponseHeadersRead, context.RequestAborted);
-
-                    // Copy the response back to the client
-                    await ViteProxyHelpers.CopyProxyResponse(context, response);
-                    return; // Successfully proxied, don't continue to static files
-                }
-                catch (Exception ex)
-                {
-                    var logger = context.RequestServices.GetRequiredService<ILogger<Program>>();
-                    logger.LogDebug(ex, "Vite server not available, falling back to static files for {Path}",
-                        Uri.EscapeDataString(context.Request.Path.Value ?? "unknown"));
-                    // Fall through to static file serving
-                }
-            }
-
-            // Continue to static file serving (either Vite not needed or not available)
-            await next();
-        });
-    }
-
     var rewriteOptions = new RewriteOptions();
 
     // Add redirects and rewrites for each SPA using centralized app names
@@ -470,9 +432,7 @@ void RegisterDbContext<TContext>(string connectionStringKey) where TContext : Db
         rewriteOptions.AddRewrite($@"(?i)^{escapedAppName}", $"/2/vue/src/{lowerAppName}/index.html", true);
     }
 
-    app.UseRewriter(rewriteOptions);
-
-    //for the vue src files, use directories in the url but serve index.html
+    // Default-file convention for /vue (legacy path).
     app.UseDefaultFiles(new DefaultFilesOptions
     {
         DefaultFileNames = new List<string> { "index.html" },
@@ -482,29 +442,68 @@ void RegisterDbContext<TContext>(string connectionStringKey) where TContext : Db
         RedirectToAppendTrailingSlash = true
     });
 
-    // Static file serving configuration
-    // Serve built Vue files - in development proxy middleware runs first,
-    // in production these files are served directly
-    app.UseStaticFiles(new StaticFileOptions
-    {
-        FileProvider = new PhysicalFileProvider(
-            Path.Combine(builder.Environment.ContentRootPath, "wwwroot/vue")),
-        RequestPath = "/2/vue"
-    });
-
-    // Serve other static files
+    // General static files (favicon, /css, /js, /images, etc.).
     app.UseStaticFiles();
 
-    // Add sitemap middleware after static file handling
     app.UseSitemapMiddleware();
 
-    // apply settings define earlier
+    // Routing first so subsequent middleware can defer to a matched MVC endpoint.
     app.UseRouting();
     app.UseAuthentication();
     app.UseAuthorization();
     app.UseCookiePolicy();
     app.UseSession();
 
+    // SPA shell serving — Vue app prefixes like /CMS, /Effort, etc.
+    // Only runs when no MVC controller endpoint claimed the path, so attribute-routed
+    // legacy endpoints (e.g. /CMS/Files → CMSController.Files) reach the controller
+    // instead of being rewritten to the SPA shell.
+    app.UseWhen(
+        ctx => ctx.GetEndpoint() is null,
+        branch =>
+        {
+            if (app.Environment.IsDevelopment())
+            {
+                // Dev: proxy Vue assets and SPA routes to the Vite dev server (HMR).
+                branch.Use(async (context, next) =>
+                {
+                    if (ViteProxyHelpers.ShouldProxyToVite(context, VueAppNames))
+                    {
+                        try
+                        {
+                            var httpClientFactory = context.RequestServices.GetRequiredService<IHttpClientFactory>();
+                            var httpClient = httpClientFactory.CreateClient("ViteProxy");
+
+                            var viteUrl = ViteProxyHelpers.BuildViteUrl(context.Request.Path, context.Request.QueryString, VueAppNames);
+                            var requestMessage = ViteProxyHelpers.CreateProxyRequest(context, viteUrl);
+                            using var response = await httpClient.SendAsync(requestMessage, HttpCompletionOption.ResponseHeadersRead, context.RequestAborted);
+
+                            await ViteProxyHelpers.CopyProxyResponse(context, response);
+                            return;
+                        }
+                        catch (Exception ex)
+                        {
+                            var logger = context.RequestServices.GetRequiredService<ILogger<Program>>();
+                            logger.LogDebug(ex, "Vite server not available, falling back to static files for {Path}",
+                                Uri.EscapeDataString(context.Request.Path.Value ?? "unknown"));
+                        }
+                    }
+
+                    await next();
+                });
+            }
+
+            // Prod (and dev fallback): rewrite SPA routes to the built SPA shell,
+            // then serve the static file from wwwroot/vue.
+            branch.UseRewriter(rewriteOptions);
+            branch.UseStaticFiles(new StaticFileOptions
+            {
+                FileProvider = new PhysicalFileProvider(
+                    Path.Combine(builder.Environment.ContentRootPath, "wwwroot/vue")),
+                RequestPath = "/2/vue"
+            });
+        });
+
     // All health-check pipeline wiring lives in HealthCheckExtensions.
     app.UseViperHealthChecks();