Stage M2

apps/admin/next.config.ts

@@ -6,16 +6,48 @@ const withNextIntl = createNextIntlPlugin('./src/i18n/request.ts');
 
 const nextConfig: NextConfig = {
   reactStrictMode: true,
+
+  /**
+   * Proxies API calls through this app's own origin.
+   *
+   * The refresh token is a `SameSite=Lax` httpOnly cookie, so the browser only
+   * sends it first-party. Calling the API host directly from the browser would
+   * mean `SameSite=None; Secure`, which cannot work over plain HTTP in local
+   * development at all. Production does the same thing at the Nginx layer, so
+   * dev and prod share one topology instead of two.
+   */
+  async rewrites() {
+    const target = process.env.API_INTERNAL_URL ?? 'http://localhost:4000';
+    return [{ source: '/api/:path*', destination: `${target}/api/:path*` }];
+  },
+
   transpilePackages: ['@sport/ui'],
   typedRoutes: true,
   output: 'standalone',
 
   images: {
+    /**
+     * Media is served from R2/CDN in production and MinIO locally.
+     *
+     * `pathname` and `search` are specified explicitly: Next 16 matches remote
+     * patterns strictly, and an entry without them does not authorise the URL —
+     * the optimizer answers `"url" parameter is not allowed` and every product
+     * image renders broken. Scoping to the bucket path also keeps this from
+     * becoming an open image proxy.
+     */
     remotePatterns: [
-      { protocol: 'http', hostname: 'localhost', port: '9000' },
-      { protocol: 'https', hostname: '**.r2.dev' },
-      { protocol: 'https', hostname: 'cdn.sport-store.local' },
+      { protocol: 'http', hostname: 'localhost', port: '9000', pathname: '/**', search: '' },
+      { protocol: 'https', hostname: '**.r2.dev', pathname: '/**', search: '' },
+      { protocol: 'https', hostname: 'cdn.sport-store.local', pathname: '/**', search: '' },
     ],
+
+    /**
+     * DEVELOPMENT ONLY. See the storefront config for the full explanation:
+     * Next 16 blocks upstream images on private IPs (SSRF guard) and reports it
+     * with the same message as an unmatched pattern. Local MinIO is on
+     * localhost, production media is on a public CDN host.
+     */
+    dangerouslyAllowLocalIP: process.env.NODE_ENV !== 'production',
   },
 
   // The admin is an internal tool: keep it out of every index, permanently.