[pwei1018]

Issue #: bcgov/entity#35321

Description of changes:

This pull request introduces significant updates to the express-checkout application, focusing on modernizing the build and deployment pipeline, enhancing security and environment configuration, and upgrading dependencies for better maintainability and compatibility. The changes transition the project to Nuxt 4, update Docker and environment handling for production readiness, and improve security practices, especially around redirects and sensitive configuration.

Key changes include:

Build and Deployment Modernization

• Migrated deployment workflows from Firebase to Google Cloud Platform (GCP).
• Implemented stricter security headers and route rules in nuxt.config.ts, including SSR configuration and long-term caching for static assets. Content-Security-Policy is now managed at runtime via environment variables.
• Introduced safe redirect utilities to prevent open redirects and unsafe URL handling, and refactored login logic to use these utilities.
• Refactored environment variable usage for API URLs and keys, separating public and server-only values to enhance security and clarity.
• Improved API composables to use absolute URLs and ensure requests are correctly routed through the server proxy, keeping sensitive keys on the server side.
• Various small fixes and improvements, such as correcting default value handling in components, explicit imports for enums, and minor logic adjustments.

[Jxio]

is Bear token might be null or undefined?

[pwei1018]

This validation only checks the format of the header. Literal values such as Bearer null or Bearer undefined would still match the pattern. If we need to reject those values, I can add additional validation logic or explicitly parse and validate the token.