fix: resolve 20 audit findings and stabilize BFF proxy integration (!17) · Merge Requests · ThinhNC / upgrade-data-crawler-fe

fix: resolve 20 audit findings and stabilize BFF proxy integration

Summary of Changes

This PR addresses and resolves all 20 audit findings identified in the frontend code review according to AGENTS.md standards, removing all mock fallbacks, securing application origins, improving accessibility, and ensuring 0 TypeScript errors.

Key Improvements

1. Service Layer & State Integrity (Findings 001, 002, 006)

Removed All Mock Fallbacks: Completely eliminated MOCK_ arrays and module-scoped mutable variables (localSchedules, localApiKeys, localWebhooks) from crawl-schedule.service.ts and developer.service.ts.
Proper Error Propagation: Mutating and reading operations now re-throw server errors instead of silently swallowing them or generating fake responses.

2. Hooks & Performance (Findings 004, 005)

Simplified Rerun Mutation: Removed module-level rerunInFlight Set and unsafe type assertions in use-crawl-jobs.ts.
Controlled Polling: Set default refetchInterval to false for useCrawlJobLogs to prevent unintended background network polling.

3. Authentication & Security (Findings 007, 010, 014, 015, 017, 020)

Edge Middleware RBAC: Added /settings/developer to STRICT_ADMIN_ROUTES with case-insensitive role verification.
Strict Sandbox Isolation: Removed allow-same-origin from safe-html-preview.tsx iframe sandbox to strictly isolate crawled preview HTML from the app origin.
Auth Provider Memoization: Wrapped login, register, and refreshProfile in useCallback; memoized roles, permissions, and contextValue with useMemo.
Redirect Loop Protection: Added /verify-email to getSafeRedirectUrl auth blocklist.

4. Internationalization & UX (Findings 011, 012, 016)

Hydration Mismatch Fix: Initialized LanguageProvider with consistent 'vi' locale across SSR and client, deferring stored locale sync to client-side microtask.
Robust Cron Validation: Upgraded isValidCronExpression with regex checking each field of the 5-part cron syntax.
Accessibility (A11y): Added aria-haspopup="menu", aria-expanded, role="menu", and role="menuitem" to UserMenu.

5. Network & Utils (Findings 003, 008, 009, 013, 018, 019)

Deterministic Timezone Range: Standardized getLocalDateRangeISO using fixed Date.UTC() offset (+7h) independent of browser runtime timezone.
Proxy Body Forwarding: Added DELETE method to request body forwarding in BFF proxy route.
Type Safety & Devtools: Eliminated double type casts in crawler-task-table.tsx and download-helper.ts; restricted ReactQueryDevtools to development environments only.

## Summary of Changes

This PR addresses and resolves all **20 audit findings** identified in the frontend code review according to `AGENTS.md` standards, removing all mock fallbacks, securing application origins, improving accessibility, and ensuring **0 TypeScript errors**.

### Key Improvements

#### 1. Service Layer & State Integrity (Findings 001, 002, 006)
- **Removed All Mock Fallbacks:** Completely eliminated `MOCK_` arrays and module-scoped mutable variables (`localSchedules`, `localApiKeys`, `localWebhooks`) from `crawl-schedule.service.ts` and `developer.service.ts`.
- **Proper Error Propagation:** Mutating and reading operations now re-throw server errors instead of silently swallowing them or generating fake responses.

#### 2. Hooks & Performance (Findings 004, 005)
- **Simplified Rerun Mutation:** Removed module-level `rerunInFlight` Set and unsafe type assertions in `use-crawl-jobs.ts`.
- **Controlled Polling:** Set default `refetchInterval` to `false` for `useCrawlJobLogs` to prevent unintended background network polling.

#### 3. Authentication & Security (Findings 007, 010, 014, 015, 017, 020)
- **Edge Middleware RBAC:** Added `/settings/developer` to `STRICT_ADMIN_ROUTES` with case-insensitive role verification.
- **Strict Sandbox Isolation:** Removed `allow-same-origin` from `safe-html-preview.tsx` iframe sandbox to strictly isolate crawled preview HTML from the app origin.
- **Auth Provider Memoization:** Wrapped `login`, `register`, and `refreshProfile` in `useCallback`; memoized `roles`, `permissions`, and `contextValue` with `useMemo`.
- **Redirect Loop Protection:** Added `/verify-email` to `getSafeRedirectUrl` auth blocklist.

#### 4. Internationalization & UX (Findings 011, 012, 016)
- **Hydration Mismatch Fix:** Initialized `LanguageProvider` with consistent `'vi'` locale across SSR and client, deferring stored locale sync to client-side microtask.
- **Robust Cron Validation:** Upgraded `isValidCronExpression` with regex checking each field of the 5-part cron syntax.
- **Accessibility (A11y):** Added `aria-haspopup="menu"`, `aria-expanded`, `role="menu"`, and `role="menuitem"` to `UserMenu`.

#### 5. Network & Utils (Findings 003, 008, 009, 013, 018, 019)
- **Deterministic Timezone Range:** Standardized `getLocalDateRangeISO` using fixed `Date.UTC()` offset (`+7h`) independent of browser runtime timezone.
- **Proxy Body Forwarding:** Added `DELETE` method to request body forwarding in BFF proxy route.
- **Type Safety & Devtools:** Eliminated double type casts in `crawler-task-table.tsx` and `download-helper.ts`; restricted `ReactQueryDevtools` to development environments only.