Bootstrap Live Dev Server recipe and Dockerfile

[yattias]

Summary

Make ResearchHub/web ready for CodePress Live Dev Server previews with a committed recipe that describes the root Next.js app and a thin dev image that starts it on the expected preview port.

Technical details

The commit adds .codepress/dev-server/recipe.json for the single root frontend (Next.js, Node 22, npm, port 3000, package-lock.json dependency fingerprint, and procps) and .codepress/dev-server/Dockerfile.web. The Dockerfile uses the full public-ECR node:22-bookworm image, installs only procps, declares the bind/HMR runtime variables, exposes port 3000, leaves source and node_modules to the runtime checkout, and runs npm run dev.

Discovery did not find a confident staging backend declaration, so staging_backend_url is intentionally omitted and no Live Dev Server public API variable was overwritten or invented. No backend source/CORS surface exists in this repository; the external API would need its own repository bootstrap.

The bounded social-auth audit found Google through next-auth 4.24.11. The flow is server-owned by NextAuth and does not expose a safe relay seam for the required redirect_uri/state wrapping in this codebase, so no auth file was changed. There was no CodePress-shaped authorize-url fetch followed by window.location navigation, so Step 3a is not applicable.

PREVIEW_AUTH_STATUS: needs-customer-action
PREVIEW_AUTH_CHANGED_PATHS: none
PREVIEW_AUTH_PROVIDERS: Google: class A / NextAuth v4 owns the callback and state exchange; report-only because no safe relay seam is exposed
PREVIEW_AUTH_APPLIED_STEPS: none
PREVIEW_AUTH_CUSTOMER_ACTION: If preview relay support is required, register https://auth-87d3f8ab798deaec.preview.codepress.dev/callback as Google's exact authorized redirect URI and implement or supply a customer-owned NextAuth-compatible relay/proxy that preserves state/PKCE; the relay registration alone is not claimed as complete here
PREVIEW_AUTH_PUBLIC_ENV: none; GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET remain server-side, and no public secret or env value was added
PREVIEW_AUTH_STEP3A_INVARIANTS: PASS — no identifiable fetch/await-authorize-url plus window.location launcher; Step 3a not applicable
PREVIEW_AUTH_VALIDATION: Recipe JSON parse and Dockerfile contract checks passed; bounded auth inventory passed; live Google OAuth was not exercised and no provider-console change was made.

Changes

• Add the committed Live Dev Server recipe for the root Next.js frontend.
• Add a thin Node 22/bookworm dev Dockerfile with procps, runtime bind/HMR variables, and the npm dev command.

Test plan

• From the repository root, parse .codepress/dev-server/recipe.json and verify schema_version 1, the root working_dir, port 3000, npm install command, package-lock.json dependency manifest, and procps.
• Build .codepress/dev-server/Dockerfile.web from the repository root, mount the checkout at /app after hydrating dependencies, and verify the Next.js dev server responds on port 3000.
• For preview sign-in, complete the customer-owned NextAuth relay/proxy work and register the exact Google callback URL before attempting a live OAuth test.

Open items

• No safe staging API URL was found, so the recipe does not prefill NEXT_PUBLIC_API_URL; set the correct staging value in Live Dev Server settings when known.
• Google preview sign-in remains a customer-action report for the NextAuth v4 callback/state architecture; live OAuth was not claimed.
• The external API backend is not in this repository, so preview CORS must be bootstrapped and deployed from that backend's own repository.

Authors

Generated with CodePress · View the chat session

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web	Ready	Preview	Aug 13, 2026 7:46pm

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE