docker-compose.zap.yml

# Overlay for the OWASP ZAP baseline scan (see .github/workflows/zap.yml).
#
# The base docker-compose.e2e.yml runs the frontend as a development image
# (Turbopack, `npm run dev`) because that is fastest for Playwright. A DAST
# baseline should instead scan what users actually receive, so this overlay
# rebuilds the frontend from its `production` target with NODE_ENV=production.
#
# Why it matters for the scan results:
#   - The dev CSP allows 'unsafe-eval' (gated on NODE_ENV in proxy.ts); the
#     production build drops it.
#   - Dev serves unminified vendor chunks that trip ZAP's "Suspicious Comments",
#     "Dangerous JS Functions", "Base64 Disclosure" and "Timestamp Disclosure"
#     pattern matchers; the production bundle is minified.
#   - Dev renders verbose 404 pages (full filesystem paths, source-looking text)
#     for unknown routes like /robots.txt and /sitemap.xml, flagged as
#     "Full Path Disclosure" and "Source Code Disclosure - SQL"; production
#     returns a minimal 404.
#
# Only the frontend changes; backend + postgres stay on their e2e definitions.
services:
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      target: production
    environment:
      NODE_ENV: production
      INTERNAL_API_URL: http://backend:3000
      PUBLIC_APP_URL: http://localhost:3001
    # The standalone production server binds IPv4-only (HOSTNAME=0.0.0.0 in the
    # frontend Dockerfile), but inside the container `localhost` resolves to ::1
    # first, so the base e2e healthcheck's wget to http://localhost:3000 is
    # refused and the container never becomes healthy (`up --wait` then times
    # out). The dev server binds dual-stack, so this only bites the production
    # image. Probe 127.0.0.1 explicitly. (Only `test` is overridden; interval,
    # timeout, retries and start_period are inherited from docker-compose.e2e.yml.)
    healthcheck:
      test:
        ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:3000/login || exit 1"]