Adopt the direct cross-origin API approach (from feat/cd-cdk-fixes) now that the
dev backend allows CORS:
- VITE_API_URL=https://api.dev.seahaven.com/api (absolute, baked into the build)
- remove the CloudFront /api/* proxy behavior + HTTP origin; CloudFront serves
static content only
- keep the custom domain (dev.seahaven.com), ACM cert, and Route 53 apex alias
VITE_API_URL is per-environment (baked at vite build), so staging/prod builds
must override it and the backend must allow their origins.
Move the dev frontend to its custom domain now that the backend, DNS zones,
and ACM cert all live in the dev account (396287094661):
- CloudFront alias dev.seahaven.com with the *.seahaven.com ACM cert
- /api/* proxied over HTTPS to api.dev.seahaven.com (no CORS, no mixed content)
- Route 53 apex A/AAAA alias -> CloudFront in the delegated dev.seahaven.com zone
Env-specific values (domain, cert, zone, API host, protocol) are parameterized
and set in cdk.json context so the CI `cdk deploy` produces this with no flags;
staging/prod override the same keys per environment.
The SPA is served over HTTPS by CloudFront but the backend
(console.seahavenind.com) is HTTP-only, so direct API calls would be blocked
as mixed content. Add a CloudFront /api/* behavior that proxies to the backend
over HTTP (browser <-> CloudFront is HTTPS; CloudFront <-> origin is HTTP) and
set VITE_API_URL=/api (same-origin).
Because distribution-level customErrorResponses are global and would rewrite
real /api 403/404s into the SPA shell, replace them with a viewer-request
CloudFront Function scoped to the S3 (default) behavior that rewrites
extensionless paths to /index.html. /api/* carries no function association.
Backend host is configurable via `-c apiOriginDomain=<host>` (default
console.seahavenind.com).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Provision the frontend's AWS hosting as a CDK app local to this repo
(private S3 + OAC, CloudFront with SPA 403/404 -> index.html fallback) and a
GitHub OIDC deploy role scoped to the dev branch. Deploy on push to dev via
the org reusable cd-cdk.yaml: cdk deploy provisions infra, then
scripts/deploy-web.sh builds the SPA, syncs to S3 (immutable hashed assets,
no-cache index.html) and invalidates CloudFront.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
