chore(sync) Syncing changes from alpha to master

.github/workflows/lighthouse.yml

@@ -19,7 +19,7 @@ jobs:
       - name: setup node
         uses: actions/setup-node@v6
         with:
-          node-version: '16.x'
+          node-version: '22.x'
       - name: install node deps
         run: npm install
       - name: node build
@@ -38,10 +38,19 @@ jobs:
           install: localdb
       - name: migrate
         run: .\.dotnet-tools\dotnet-ef database update --project web/web.csproj
+        env:
+          Jwt__Key: "lighthouse-ci-test-jwt-key-minimum-32-characters-required"
+          Jwt__Issuer: "atlas-lighthouse-ci"
+          Jwt__Audience: "atlas-lighthouse-ci"
       - name: run Lighthouse CI
         run: |
           npm install -g @lhci/cli@0.9.x
           lhci autorun
         env:
           LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}
           LHCI_TOKEN: ${{ secrets.LHCI_TOKEN }}
+          Jwt__Key: "lighthouse-ci-test-jwt-key-minimum-32-characters-required"
+          Jwt__Issuer: "atlas-lighthouse-ci"
+          Jwt__Audience: "atlas-lighthouse-ci"
+          Cors__AllowedOrigins__0: "http://localhost:3000"
+          Auth__DefaultCallbackPath: "/auth/callback"

.github/workflows/release.yaml

@@ -19,7 +19,7 @@ jobs:
       - name: setup node
         uses: actions/setup-node@v6
         with:
-          node-version: '20.x'
+          node-version: '22.x'
       - name: install node deps
         run: npm install --ignore-scripts --no-audit --no-fund
       - name: Semantic Release

.github/workflows/sonar.yml

@@ -38,8 +38,13 @@
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          Jwt__Key: "sonar-ci-test-jwt-key-minimum-32-characters-required-for-build"
+          Jwt__Issuer: "atlas-sonar-ci"
+          Jwt__Audience: "atlas-sonar-ci"
+          Cors__AllowedOrigins__0: "http://localhost:3000"
+          Auth__DefaultCallbackPath: "/auth/callback"
         shell: powershell
         run: |
           .\.sonar\scanner\dotnet-sonarscanner begin /k:"atlas-bi_atlas-bi-library" /o:"atlas-bi" /d:sonar.login="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io"
           dotnet build
           .\.sonar\scanner\dotnet-sonarscanner end /d:sonar.login="${{ secrets.SONAR_TOKEN }}"

.github/workflows/test.yaml

@@ -17,7 +17,7 @@ jobs:
       - name: setup node
         uses: actions/setup-node@v6
         with:
-          node-version: '18.x'
+          node-version: '22.x'
 
       - name: install node deps
         run: npm install --ignore-scripts --no-audit --no-fund
@@ -41,7 +41,7 @@ jobs:
       - name: setup node
         uses: actions/setup-node@v6
         with:
-          node-version: '18.x'
+          node-version: '22.x'
       - name: install node deps
         run: npm install --ignore-scripts --no-audit --no-fund
       - name: node build
@@ -82,7 +82,7 @@ jobs:
       - name: setup node
         uses: actions/setup-node@v6
         with:
-          node-version: '18.x'
+          node-version: '22.x'
       - name: setup java
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
         with:
@@ -94,7 +94,6 @@ jobs:
         run: npm run build
       - name: install dotnet deps
         run: |
-          dotnet tool install -g coverlet.console
           dotnet tool install -g dotnet-reportgenerator-globaltool
           dotnet restore
       - name: build
@@ -109,6 +108,21 @@ jobs:
           BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
           BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }}
 
+      - name: collect coverage file
+        if: always()
+        shell: pwsh
+        run: |
+          $coverageFile = Get-ChildItem -Path TestResults -Recurse -Filter coverage.cobertura.xml |
+            Sort-Object LastWriteTimeUtc -Descending |
+            Select-Object -First 1
+
+          if ($coverageFile) {
+            Copy-Item $coverageFile.FullName coverage.cobertura.xml -Force
+            Write-Host "Copied coverage file from $($coverageFile.FullName)"
+          } else {
+            Write-Host "Coverage file not found under TestResults"
+          }
+
       - name: console coverage
         if: always()
         run: |
@@ -126,6 +140,8 @@ jobs:
         uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de
         with:
           files: ./coverage.cobertura.xml
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
           verbose: true
 
   # browser_tests:
@@ -204,7 +220,7 @@ jobs:
       - name: setup node
         uses: actions/setup-node@v6
         with:
-          node-version: '18.x'
+          node-version: '22.x'
       - name: setup java
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
         with:
@@ -216,7 +232,6 @@ jobs:
         run: npm run build
       - name: install dotnet deps
         run: |
-          dotnet tool install -g coverlet.console
           dotnet tool install -g dotnet-reportgenerator-globaltool
           dotnet restore
       - name: build
@@ -231,6 +246,21 @@ jobs:
           BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
           BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }}
 
+      - name: collect coverage file
+        if: always()
+        shell: pwsh
+        run: |
+          $coverageFile = Get-ChildItem -Path TestResults -Recurse -Filter coverage.cobertura.xml |
+            Sort-Object LastWriteTimeUtc -Descending |
+            Select-Object -First 1
+
+          if ($coverageFile) {
+            Copy-Item $coverageFile.FullName coverage.cobertura.xml -Force
+            Write-Host "Copied coverage file from $($coverageFile.FullName)"
+          } else {
+            Write-Host "Coverage file not found under TestResults"
+          }
+
       - name: console coverage
         if: always()
         run: |
@@ -248,4 +278,6 @@ jobs:
         uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de
         with:
           files: ./coverage.cobertura.xml
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
           verbose: true

docker-compose.yml

@@ -1,15 +1,15 @@
-version: '3.9'
-
 services:
   sqlserver:
-    image: mcr.microsoft.com/mssql/server:2022-latest
+    image: mcr.microsoft.com/mssql/server:2025-latest
     container_name: atlas_sqlserver
     environment:
       ACCEPT_EULA: 'Y'
       MSSQL_SA_PASSWORD: ${SERVICE_PASSWORD_SQLSERVER:-StrongPassword!123}
       MSSQL_PID: ${MSSQL_PID:-Evaluation}
     expose:
       - 1433
+    ulimits:
+      core: 0
     volumes:
       - sqlserver_data:/var/opt/mssql
     healthcheck:
@@ -45,7 +45,7 @@ services:
       test:
         [
           'CMD-SHELL',
-          'wget -qO- http://localhost:${SOLR_PORT:-8983}/solr/admin/ping | grep -q ''"status":"OK"''',
+          'wget -qO- http://127.0.0.1:${SOLR_PORT:-8983}/solr/atlas/admin/ping | grep -q ''"status":"OK"''',
         ]
       interval: 15s
       timeout: 5s
@@ -66,19 +66,44 @@ services:
       - solr
       - sqlserver
     environment:
-      PORT: ${WEB_PORT:-3000}
+      PORT: ${WEB_PORT:-5000}
+      Demo: ${DEMO:-true}
       SEED_DEMO: ${SEED_DEMO:-true}
+      DEMO_ADMIN_USERNAME: ${DEMO_ADMIN_USERNAME:-local-admin}
+      Jwt__Key: ${JWT_KEY}
+      Jwt__Issuer: ${JWT_ISSUER}
+      Jwt__Audience: ${JWT_AUDIENCE}
     expose:
-      - ${WEB_PORT:-3000}
+      - ${WEB_PORT:-5000}
     ports:
-      - '${WEB_PORT:-3000}:${WEB_PORT:-3000}'
+      - '${WEB_PORT:-5000}:${WEB_PORT:-5000}'
+
+  frontend:
+    build:
+      context: ./frontend
+      dockerfile: Dockerfile
+      args:
+        API_URL: http://web:${WEB_PORT:-5000}
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:5000}
+    container_name: atlas_frontend
+    depends_on:
+      - web
+    environment:
+      API_URL: http://web:${WEB_PORT:-5000}
+      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:5000}
+      AUTH_RETURN_URL_ORIGIN: ${AUTH_RETURN_URL_ORIGIN:-http://localhost:3000}
+      DEMO: ${DEMO:-true}
+      DEMO_ADMIN_USERNAME: ${DEMO_ADMIN_USERNAME:-local-admin}
+    expose:
+      - 3000
+    ports:
+      - '${FRONTEND_PORT:-3000}:3000'
     healthcheck:
-      test:
-        ['CMD-SHELL', 'wget -qO- http://localhost:${WEB_PORT:-3000}/ || exit 1']
+      test: ['CMD-SHELL', 'wget -qO- http://127.0.0.1:3000/ || exit 1']
       interval: 15s
       timeout: 5s
-      retries: 10
-      start_period: 20s
+      retries: 5
+      start_period: 15s
 
 volumes:
   sqlserver_data:

frontend/.czrc

@@ -0,0 +1,4 @@
+{
+  "path": "cz-conventional-changelog"
+}
+

frontend/.dockerignore

@@ -0,0 +1,5 @@
+.next
+node_modules
+.git
+.env*
+!.env.example

frontend/.gitignore

@@ -0,0 +1,41 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/versions
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
+
+# env files (can opt-in for committing if needed)
+.env*
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts

frontend/.husky/_/husky.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env sh
+# Minimal husky shim
+
+if [ -z "$husky_skip_init" ]; then
+  debug () {
+    if [ "${HUSKY_DEBUG}" = "1" ]; then
+      echo "husky (debug) - $1"
+    fi
+  }
+
+  readonly hook_name="$(basename "$0")"
+  debug "starting $hook_name..."
+
+  if [ "$HUSKY" = "0" ]; then
+    debug "HUSKY=0, skipping hook"
+    exit 0
+  fi
+
+  if [ -f ~/.huskyrc ]; then
+    debug "sourcing ~/.huskyrc"
+    . ~/.huskyrc
+  fi
+fi

frontend/.husky/commit-msg

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+pnpm -s exec commitlint --edit "$1"
+

frontend/.husky/install.mjs

@@ -0,0 +1,53 @@
+import fs from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = path.dirname(__filename)
+const root = path.resolve(__dirname, "..")
+const huskyDir = path.join(root, ".husky")
+
+// Avoid running in CI environments (mirrors common Husky patterns)
+if (process.env.CI) {
+  process.exit(0)
+}
+
+const hooksDir = path.join(root, ".git", "hooks")
+if (!fs.existsSync(hooksDir)) {
+  // Not a git checkout (or .git missing) – silently no-op.
+  process.exit(0)
+}
+
+const huskySh = `#!/usr/bin/env sh
+# Minimal husky shim
+
+if [ -z "$husky_skip_init" ]; then
+  debug () {
+    if [ "\${HUSKY_DEBUG}" = "1" ]; then
+      echo "husky (debug) - $1"
+    fi
+  }
+
+  readonly hook_name="$(basename "$0")"
+  debug "starting $hook_name..."
+
+  if [ "$HUSKY" = "0" ]; then
+    debug "HUSKY=0, skipping hook"
+    exit 0
+  fi
+
+  if [ -f ~/.huskyrc ]; then
+    debug "sourcing ~/.huskyrc"
+    . ~/.huskyrc
+  fi
+fi
+`
+
+const ensureDir = (p) => {
+  if (!fs.existsSync(p)) fs.mkdirSync(p, { recursive: true })
+}
+
+ensureDir(path.join(huskyDir, "_"))
+
+// Minimal husky shim so the hook scripts can run consistently.
+fs.writeFileSync(path.join(huskyDir, "_", "husky.sh"), huskySh, "utf8")

frontend/.husky/pre-commit

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+pnpm lint-staged
+

frontend/.husky/prepare-commit-msg

@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+# Commitizen interactive prompt (like the other project)
+exec < /dev/tty && pnpm -s exec cz --hook || exit 0
+