Repo cleanup and updates

apps/bridge-frontend/Dockerfile

@@ -2,22 +2,28 @@ FROM node:22-bookworm-slim AS base
 
 FROM base AS builder
 ARG APP_DIR=/opt/bridge-frontend
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
 RUN mkdir -p ${APP_DIR}/
-RUN npm i -g turbo
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
+RUN pnpm add -g turbo
 WORKDIR ${APP_DIR}
 COPY . .
 RUN turbo prune --scope=@link-stack/bridge-frontend --scope=@link-stack/bridge-migrations --docker
 
 FROM base AS installer
 ARG APP_DIR=/opt/bridge-frontend
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
 WORKDIR ${APP_DIR}
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
 COPY --from=builder ${APP_DIR}/.gitignore .gitignore
 COPY --from=builder ${APP_DIR}/out/json/ .
-COPY --from=builder ${APP_DIR}/out/package-lock.json ./package-lock.json
-RUN npm ci
+COPY --from=builder ${APP_DIR}/out/pnpm-lock.yaml ./pnpm-lock.yaml
+RUN pnpm install --frozen-lockfile
 
 COPY --from=builder ${APP_DIR}/out/full/ .
-RUN npm i -g turbo
+RUN pnpm add -g turbo
 RUN turbo run build --filter=@link-stack/bridge-frontend --filter=@link-stack/bridge-migrations
 
 FROM base AS runner
@@ -29,6 +35,9 @@ LABEL maintainer="Darren Clarke <darren@redaranj.com>"
 LABEL org.label-schema.build-date=$BUILD_DATE
 LABEL org.label-schema.version=$VERSION
 ENV APP_DIR ${APP_DIR}
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
 RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
     apt-get install -y --no-install-recommends \
     dumb-init

apps/bridge-frontend/app/_lib/authentication.ts

@@ -1,10 +1,6 @@
 import GoogleProvider from "next-auth/providers/google";
-import { KyselyAdapter } from "@auth/kysely-adapter";
-import { db } from "@link-stack/bridge-common";
 
 export const authOptions = {
-  // @ts-ignore
-  adapter: KyselyAdapter(db),
   providers: [
     GoogleProvider({
       clientId: process.env.GOOGLE_CLIENT_ID!,

apps/bridge-frontend/app/api/auth/[...nextauth]/route.ts

@@ -1,6 +1,9 @@
 import NextAuth from "next-auth";
 import { authOptions } from "@/app/_lib/authentication";
 
+// Force this route to be dynamic (not statically generated at build time)
+export const dynamic = 'force-dynamic';
+
 const handler = NextAuth(authOptions);
 
 export { handler as GET, handler as POST };

apps/bridge-frontend/docker-entrypoint.sh

@@ -2,6 +2,6 @@
 
 set -e
 echo "running migrations"
-(cd ../bridge-migrations/ && npm run migrate:up:all)
+(cd ../bridge-migrations/ && pnpm run migrate:up:all)
 echo "starting bridge-frontend"
-exec dumb-init npm run start
+exec dumb-init pnpm run start

apps/bridge-frontend/middleware.ts

@@ -1,23 +1,81 @@
 import { withAuth } from "next-auth/middleware";
+import { NextResponse } from "next/server";
 
-export default withAuth({
-  pages: {
-    signIn: `/login`,
+export default withAuth(
+  function middleware(req) {
+    const isDev = process.env.NODE_ENV === "development";
+    const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
+
+    // Allow digiresilience.org for embedding documentation
+    const frameSrcDirective = `frame-src 'self' https://digiresilience.org;`;
+
+    const cspHeader = `
+      default-src 'self';
+      ${frameSrcDirective}
+      connect-src 'self';
+      script-src 'self' 'nonce-${nonce}' 'strict-dynamic' ${isDev ? "'unsafe-eval'" : ""};
+      style-src 'self' 'unsafe-inline';
+      img-src 'self' blob: data:;
+      font-src 'self';
+      object-src 'none';
+      base-uri 'self';
+      form-action 'self';
+      frame-ancestors 'self';
+      upgrade-insecure-requests;
+    `;
+    const contentSecurityPolicyHeaderValue = cspHeader
+      .replace(/\s{2,}/g, " ")
+      .trim();
+
+    const requestHeaders = new Headers(req.headers);
+    requestHeaders.set("x-nonce", nonce);
+    requestHeaders.set(
+      "Content-Security-Policy",
+      contentSecurityPolicyHeaderValue,
+    );
+
+    const response = NextResponse.next({
+      request: {
+        headers: requestHeaders,
+      },
+    });
+
+    response.headers.set(
+      "Content-Security-Policy",
+      contentSecurityPolicyHeaderValue,
+    );
+
+    // Additional security headers
+    response.headers.set("X-Frame-Options", "SAMEORIGIN");
+    response.headers.set("X-Content-Type-Options", "nosniff");
+    response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+    response.headers.set("X-XSS-Protection", "1; mode=block");
+    response.headers.set(
+      "Permissions-Policy",
+      "camera=(), microphone=(), geolocation=()"
+    );
+
+    return response;
   },
-  callbacks: {
-    authorized: ({ token }) => {
-      if (process.env.SETUP_MODE === "true") {
-        return true;
-      }
-
-      if (token?.email) {
-        return true;
-      }
-
-      return false;
+  {
+    pages: {
+      signIn: `/login`,
     },
-  },
-});
+    callbacks: {
+      authorized: ({ token }) => {
+        if (process.env.SETUP_MODE === "true") {
+          return true;
+        }
+
+        if (token?.email) {
+          return true;
+        }
+
+        return false;
+      },
+    },
+  }
+);
 
 export const config = {
   matcher: ["/((?!ws|wss|api|_next/static|_next/image|favicon.ico).*)"],

apps/bridge-frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-stack/bridge-frontend",
-  "version": "3.2.0b3",
+  "version": "3.3.0-beta.1",
   "type": "module",
   "scripts": {
     "dev": "next dev",
@@ -18,25 +18,23 @@
     "@mui/material": "^6",
     "@mui/material-nextjs": "^6",
     "@mui/x-license": "^7",
-    "@link-stack/bridge-common": "*",
-    "@link-stack/bridge-ui": "*",
+    "@link-stack/bridge-common": "workspace:*",
+    "@link-stack/bridge-ui": "workspace:*",
     "next": "15.5.4",
     "next-auth": "^4.24.11",
     "react": "19.2.0",
     "react-dom": "19.2.0",
     "sharp": "^0.34.4",
     "tsx": "^4.20.6",
-    "@link-stack/ui": "*"
+    "@link-stack/ui": "workspace:*"
   },
   "devDependencies": {
-    "@link-stack/eslint-config": "*",
-    "@link-stack/typescript-config": "*",
+    "@link-stack/eslint-config": "workspace:*",
+    "@link-stack/typescript-config": "workspace:*",
     "@types/node": "^24",
     "@types/pg": "^8.15.5",
     "@types/react": "^19",
     "@types/react-dom": "^19",
-    "@link-stack/eslint-config": "*",
-    "@link-stack/typescript-config": "*",
     "typescript": "^5"
   }
 }