Improvement design

.env.deploy.example

@@ -0,0 +1,84 @@
+# Deployment template — copy to .env.deploy and `source` (or `set -a`-export)
+# before running `./bin/up.sh --with-proxy`.
+#
+# The UI lives behind the bundled nginx proxy on port 80 (PROXY_HOST_PORT).
+# Backend services are reached on whatever URL is registered for them:
+#
+#       UI            → http://<host>:80           (this nginx ↔ web:3000)
+#       user-mgmt     → https://usermanagement.brainkb.org   (own domain)
+#       ml service    → http://<host>:8007         (host-mapped port)
+#       query service → http://<host>:8010
+#       chat service  → http://<host>:8011         (optional)
+#
+# As more services get their own public domains, swap their entries the
+# same way `usermanagement.brainkb.org` was swapped — replace
+# `http://<host>:<port>` with `https://<service>.brainkb.org`. For
+# same-system / single-host testing without TLS, you can revert any
+# `https://<service>.brainkb.org` back to `http://localhost:<port>`.
+
+# ── Public origin ─────────────────────────────────────────────────────────
+# Where users hit the UI. Used by NextAuth for OAuth callback URLs;
+# must match the OAuth redirect URIs you registered with each provider.
+NEXTAUTH_URL=http://localhost
+NEXTAUTH_SECRET=replace-with-a-long-random-string
+
+# ── Host port mapping ─────────────────────────────────────────────────────
+# Port the host binds for the nginx proxy. Behind an ALB you'd typically
+# leave this at 80 and let the ALB terminate TLS.
+PROXY_HOST_PORT=80
+# Useful when running without the proxy overlay; nginx isn't in the picture
+# so the UI is reached directly on this port.
+WEB_HOST_PORT=3000
+
+# ── User management (https://usermanagement.brainkb.org) ────────────────
+# Reached over its own public hostname (terminating TLS at the LB / nginx
+# in front). The OAuth provider redirect URIs registered in GitHub /
+# ORCID / Globus must match this host:
+#       https://usermanagement.brainkb.org/api/auth/<provider>/callback
+# Backend's USERMANAGEMENT_PUBLIC_BASE_URL must also be set to this URL.
+NEXT_PUBLIC_USER_MANAGEMENT_API_BASE=https://usermanagement.brainkb.org
+NEXT_PUBLIC_TOKEN_ENDPOINT_USER_MANAGEMENT_SERVICE=https://usermanagement.brainkb.org/api/token
+NEXT_PUBLIC_CREATE_USER_PROFILE_ENDPOINT_USER_MANAGEMENT_SERVICE=https://usermanagement.brainkb.org/api/users/profile
+NEXT_PUBLIC_GET_ENDPOINT_USER_PROFILE_USER_MANAGEMENT_SERVICE=https://usermanagement.brainkb.org/api/users/profile
+NEXT_PUBLIC_UPDATE_ENDPOINT_USER_PROFILE_USER_MANAGEMENT_SERVICE=https://usermanagement.brainkb.org/api/users/profile
+NEXT_PUBLIC_GET_ENDPOINT_USER_ACTIVITY_USER_MANAGEMENT_SERVICE=https://usermanagement.brainkb.org/api/users/activities
+NEXT_PUBLIC_ENABLE_PAGE_ACCESS_GATE=true
+
+# ── ML service (default port 8007) — SynthScholar, NER, struct.resources ──
+NEXT_PUBLIC_ML_SERVICE_API_BASE=http://localhost:8007
+NEXT_PUBLIC_TOKEN_ENDPOINT_ML_SERVICE=http://localhost:8007/api/token
+
+# WebSockets — switch to wss:// when fronted by TLS.
+NEXT_PUBLIC_API_NER_ENDPOINT=ws://localhost:8007/api/ws/ner
+NEXT_PUBLIC_API_PDF2REPROSCHEMA_ENDPOINT=ws://localhost:8007/api/ws/pdf2reproschema
+NEXT_PUBLIC_API_ADMIN_EXTRACT_STRUCTURED_RESOURCE_ENDPOINT=ws://localhost:8007/api/ws/extract-resources
+
+NEXT_PUBLIC_NER_GET_ENDPOINT=http://localhost:8007/api/ner
+NEXT_PUBLIC_NER_SAVE_ENDPOINT=http://localhost:8007/api/save/ner
+NEXT_PUBLIC_API_ADMIN_SAVE_STRUCTURED_RESOURCE_ENDPOINT=http://localhost:8007/api/save/structured-resource
+NEXT_PUBLIC_API_ADMIN_GET_STRUCTURED_RESOURCE_ENDPOINT=http://localhost:8007/api/structured-resource
+
+# ── Query service (default port 8010) — SPARQL + KG ingest ────────────────
+NEXT_PUBLIC_TOKEN_ENDPOINT_QUERY_SERVICE=http://localhost:8010/api/token
+NEXT_PUBLIC_API_QUERY_ENDPOINT=http://localhost:8010/api/query/sparql/
+NEXT_PUBLIC_API_NAMED_GRAPH_QUERY_ENDPOINT=http://localhost:8010/api/query/registered-named-graphs
+NEXT_PUBLIC_API_ADMIN_INSERT_KGS_JSONLD_TTL_ENDPOINT=http://localhost:8010/api/insert/files/knowledge-graph-triples
+NEXT_PUBLIC_API_ADMIN_INSERT_KGS_JSONLD_TTL_JOB_STATUS_ENDPOINT=http://localhost:8010/api/insert/jobs
+NEXT_PUBLIC_API_ADMIN_INSERT_ALL_KGS_JSONLD_TTL_JOB_STATUS_ENDPOINT=http://localhost:8010/api/insert/user/jobs/detail
+NEXT_PUBLIC_API_ADMIN_INSERT_RECOVERY_JOB_ENDPOINT=http://localhost:8010/api/insert/jobs/recover
+NEXT_PUBLIC_API_ADMIN_INSERT_CHECK_RECOVERABLE_JOB_ENDPOINT=http://localhost:8010/api/insert/jobs/check-recoverable
+
+# ── Chat service (default port 8011, optional) ────────────────────────────
+NEXT_PUBLIC_TOKEN_ENDPOINT_CHAT_SERVICE=http://localhost:8011/api/token
+NEXT_PUBLIC_CHAT_SERVICE_API_ENDPOINT=http://localhost:8011/api/chat?stream=false
+
+# ── Service-account JWT (used by the UI to call backend APIs) ─────────────
+# These are sent in `Authorization: Bearer …` from the UI to backend services
+# and are NOT exposed to end-user browsers — but they ARE inlined by Next.js.
+# Treat the deployment as if the values are public; rotate on the backend if
+# leaked.
+NEXT_PUBLIC_JWT_USER=service@example.com
+NEXT_PUBLIC_JWT_PASSWORD=replace-with-a-strong-secret
+
+# ── Misc ──────────────────────────────────────────────────────────────────
+NEXT_PUBLIC_IPIFY_KEY=

.env.local

@@ -1,14 +1,10 @@
 ########################################################################################################
-######### OAuth Credentials (Optional) ###############################################################
-# Required only if you want to enable login via GitHub or access the admin dashboard.
-# ORCID login is not supported in local development.
+######### NextAuth (this UI) ##########################################################################
+# OAuth provider credentials (GitHub / ORCID / Globus client ID + secret) are
+# NOT read by this UI. They live on the usermanagement_service backend's .env
+# (see BrainKB/.env). The backend exposes /api/auth/providers, which this UI
+# calls to render the sign-in buttons, and handles the full OAuth flow itself.
 ########################################################################################################
-GITHUB_CLIENT_ID=XXXXXX
-GITHUB_CLIENT_SECRET=XXXXXX
-
-ORCID_CLIENT_ID=APP-XXXXXX
-ORCID_CLIENT_SECRET=XXXX
-
 NEXTAUTH_SECRET=ANY_RANDOM_STRING_SECRET
 NEXTAUTH_URL=http://localhost:3000 #FOR LOCAL DEPLOYMENT
 
@@ -38,19 +34,36 @@ NEXT_PUBLIC_API_ADMIN_GET_STRUCTURED_RESOURCE_ENDPOINT=http://localhost:8007/api
 # Common JWT credentials for accessing backend services.
 ########################################################################################################
 
-NEXT_PUBLIC_JWT_USER=XXXXXX
-NEXT_PUBLIC_JWT_PASSWORD=XXXXXX
+NEXT_PUBLIC_JWT_USER=test@example.com
+NEXT_PUBLIC_JWT_PASSWORD=testpassword1
 
 ########################################################################################################
 ######### User Profile Management #####################################################################
-# Endpoints for creating, fetching, and updating user profiles.
+# All four endpoints live on the same usermanagement_service backend (:8004).
+# The historical split across :8008/:8009 was vestigial from when these were
+# separate microservices. Keep these in sync with NEXT_PUBLIC_USER_MANAGEMENT_API_BASE
+# below.
+########################################################################################################
+
+NEXT_PUBLIC_TOKEN_ENDPOINT_USER_MANAGEMENT_SERVICE=http://localhost:8004/api/token
+NEXT_PUBLIC_CREATE_USER_PROFILE_ENDPOINT_USER_MANAGEMENT_SERVICE=http://localhost:8004/api/users/profile
+NEXT_PUBLIC_GET_ENDPOINT_USER_PROFILE_USER_MANAGEMENT_SERVICE=http://localhost:8004/api/users/profile
+NEXT_PUBLIC_UPDATE_ENDPOINT_USER_PROFILE_USER_MANAGEMENT_SERVICE=http://localhost:8004/api/users/profile
+NEXT_PUBLIC_GET_ENDPOINT_USER_ACTIVITY_USER_MANAGEMENT_SERVICE=http://localhost:8004/api/users/activities
+
+########################################################################################################
+######### User Management Backend (RBAC + admin dashboard) ############################################
+# Base URL for usermanagement_service. Powers /api/auth/providers (sign-in
+# dropdown), /api/users/me, /api/admin/*, and /api/access/page/<page_key>
+# RBAC checks.
+#
+# In the backend's compose / start scripts, USERMANAGEMENT_SERVICE_PORT
+# defaults to 8004 (other services on the same stack: API token :8000,
+# query :8010, ML :8007). When running non-docker make sure the service
+# binds to the same port, e.g. `uvicorn core.main:app --reload --port 8004`.
 ########################################################################################################
 
-NEXT_PUBLIC_TOKEN_ENDPOINT_USER_MANAGEMENT_SERVICE=http://localhost:8008/api/token
-NEXT_PUBLIC_CREATE_USER_PROFILE_ENDPOINT_USER_MANAGEMENT_SERVICE=http://localhost:8008/api/users/profile
-NEXT_PUBLIC_GET_ENDPOINT_USER_PROFILE_USER_MANAGEMENT_SERVICE=http://localhost:8009/api/users/profile
-NEXT_PUBLIC_UPDATE_ENDPOINT_USER_PROFILE_USER_MANAGEMENT_SERVICE=http://localhost:8008/api/users/profile
-NEXT_PUBLIC_GET_ENDPOINT_USER_ACTIVITY_USER_MANAGEMENT_SERVICE=http://localhost:8008/api/users/activities
+NEXT_PUBLIC_USER_MANAGEMENT_API_BASE=http://127.0.0.1:8004
 
 
 ########################################################################################################
@@ -79,4 +92,15 @@ NEXT_PUBLIC_API_ADMIN_INSERT_KGS_JSONLD_TTL_JOB_STATUS_ENDPOINT=http://localhost
 NEXT_PUBLIC_API_ADMIN_INSERT_ALL_KGS_JSONLD_TTL_JOB_STATUS_ENDPOINT=http://localhost:8010/api/insert/user/jobs/detail
 #recovery job
 NEXT_PUBLIC_API_ADMIN_INSERT_RECOVERY_JOB_ENDPOINT=http://localhost:8010/api/insert/jobs/recover
-NEXT_PUBLIC_API_ADMIN_INSERT_CHECK_RECOVERABLE_JOB_ENDPOINT=http://localhost:8010/api/insert/jobs/check-recoverable
+NEXT_PUBLIC_API_ADMIN_INSERT_CHECK_RECOVERABLE_JOB_ENDPOINT=http://localhost:8010/api/insert/jobs/check-recoverable
+
+#enable rbac (default true). Set to "false" ONLY for local dev to bypass
+#per-page RBAC for authenticated users. Authentication is always required.
+NEXT_PUBLIC_ENABLE_PAGE_ACCESS_GATE=true
+
+########################################################################################################
+######### SynthScholar (PRISMA literature review) #####################################################
+# Base URL for ml_service. The SynthScholar router lives under /api/synth-scholar
+# and requires a Bearer token from /api/token (uses JWT_USER/JWT_PASSWORD above).
+########################################################################################################
+NEXT_PUBLIC_ML_SERVICE_API_BASE=http://localhost:8007

.github/workflows/deploy-github-pages.yml

@@ -0,0 +1,116 @@
+name: Deploy to GitHub Pages
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, closed]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: gh-pages-deploy
+  cancel-in-progress: false
+
+jobs:
+  build-deploy:
+    if: github.event.action != 'closed'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Compute base path and destination
+        id: ctx
+        run: |
+          REPO_NAME="${GITHUB_REPOSITORY#*/}"
+          OWNER="${GITHUB_REPOSITORY%/*}"
+          if [ "$REPO_NAME" = "${OWNER}.github.io" ]; then
+            ROOT_BASE=""
+          else
+            ROOT_BASE="/$REPO_NAME"
+          fi
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            PR_NUM="${{ github.event.pull_request.number }}"
+            echo "base=$ROOT_BASE/pr-$PR_NUM" >> "$GITHUB_OUTPUT"
+            echo "dest=pr-$PR_NUM" >> "$GITHUB_OUTPUT"
+            echo "preview=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "base=$ROOT_BASE" >> "$GITHUB_OUTPUT"
+            echo "dest=." >> "$GITHUB_OUTPUT"
+            echo "preview=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - run: npm ci
+
+      - name: Build static export
+        env:
+          EXPORT: "true"
+          NEXT_PUBLIC_BASE_PATH: ${{ steps.ctx.outputs.base }}
+        run: npm run build
+
+      - name: Disable Jekyll processing
+        run: touch out/.nojekyll
+
+      - name: Deploy to gh-pages
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./out
+          destination_dir: ${{ steps.ctx.outputs.dest }}
+          keep_files: true
+          commit_message: "Deploy ${{ steps.ctx.outputs.dest }} from ${{ github.sha }}"
+
+      - name: Comment preview URL on PR
+        if: steps.ctx.outputs.preview == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNum = context.payload.pull_request.number;
+            const host = (repo === `${owner}.github.io`)
+              ? `https://${owner}.github.io`
+              : `https://${owner}.github.io/${repo}`;
+            const url = `${host}/pr-${prNum}/`;
+            const marker = '<!-- pages-preview-url -->';
+            const body = `${marker}\n🔎 **Pages preview:** ${url}\n\n_Built from ${context.sha.slice(0, 7)} · updates on each push to this PR._`;
+            const { data: comments } = await github.rest.issues.listComments({
+              owner, repo, issue_number: prNum,
+            });
+            const existing = comments.find(c => c.body?.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number: prNum, body });
+            }
+
+  cleanup:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: gh-pages
+          fetch-depth: 0
+
+      - name: Remove PR preview directory
+        run: |
+          set -e
+          PR_DIR="pr-${{ github.event.pull_request.number }}"
+          if [ -d "$PR_DIR" ]; then
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git rm -rf "$PR_DIR"
+            git commit -m "Cleanup preview for PR #${{ github.event.pull_request.number }}"
+            git push
+          else
+            echo "No preview directory to clean up."
+          fi

Dockerfile

@@ -10,9 +10,84 @@ COPY package*.json ./
 # Install dependencies
 RUN npm install --force
 
+# Local-dev defaults live in .env.local. Next.js loads them at build time
+# and inlines every NEXT_PUBLIC_* into the client bundle, so the URLs the
+# **browser** ends up calling are frozen here. When deploying on a remote
+# host, override these via build args (compose `build.args` or
+# `docker build --build-arg ...`); values written to .env.production.local
+# below take priority over .env.local during `next build`.
+ARG NEXT_PUBLIC_USER_MANAGEMENT_API_BASE=
+ARG NEXT_PUBLIC_ML_SERVICE_API_BASE=
+ARG NEXT_PUBLIC_TOKEN_ENDPOINT_USER_MANAGEMENT_SERVICE=
+ARG NEXT_PUBLIC_TOKEN_ENDPOINT_ML_SERVICE=
+ARG NEXT_PUBLIC_TOKEN_ENDPOINT_QUERY_SERVICE=
+ARG NEXT_PUBLIC_TOKEN_ENDPOINT_CHAT_SERVICE=
+ARG NEXT_PUBLIC_API_QUERY_ENDPOINT=
+ARG NEXT_PUBLIC_API_NAMED_GRAPH_QUERY_ENDPOINT=
+ARG NEXT_PUBLIC_CHAT_SERVICE_API_ENDPOINT=
+ARG NEXT_PUBLIC_API_NER_ENDPOINT=
+ARG NEXT_PUBLIC_NER_GET_ENDPOINT=
+ARG NEXT_PUBLIC_NER_SAVE_ENDPOINT=
+ARG NEXT_PUBLIC_API_PDF2REPROSCHEMA_ENDPOINT=
+ARG NEXT_PUBLIC_API_ADMIN_EXTRACT_STRUCTURED_RESOURCE_ENDPOINT=
+ARG NEXT_PUBLIC_API_ADMIN_SAVE_STRUCTURED_RESOURCE_ENDPOINT=
+ARG NEXT_PUBLIC_API_ADMIN_GET_STRUCTURED_RESOURCE_ENDPOINT=
+ARG NEXT_PUBLIC_API_ADMIN_INSERT_KGS_JSONLD_TTL_ENDPOINT=
+ARG NEXT_PUBLIC_API_ADMIN_INSERT_KGS_JSONLD_TTL_JOB_STATUS_ENDPOINT=
+ARG NEXT_PUBLIC_API_ADMIN_INSERT_ALL_KGS_JSONLD_TTL_JOB_STATUS_ENDPOINT=
+ARG NEXT_PUBLIC_API_ADMIN_INSERT_RECOVERY_JOB_ENDPOINT=
+ARG NEXT_PUBLIC_API_ADMIN_INSERT_CHECK_RECOVERABLE_JOB_ENDPOINT=
+ARG NEXT_PUBLIC_ENABLE_PAGE_ACCESS_GATE=
+ARG NEXTAUTH_URL=
+
 # Copy environment file
 COPY .env.local ./
 
+# NextAuth (next-auth/utils/parse-url.js) calls `new URL(NEXTAUTH_URL)` and
+# uses `??` for the fallback, which does NOT cover the empty-string case.
+# An empty NEXTAUTH_URL → `new URL("")` → ERR_INVALID_URL during prerender.
+# Fall back to the local-dev value here so the build never bakes "" into
+# the bundle.
+ARG _NEXTAUTH_URL_FALLBACK=http://localhost:3000
+RUN if [ -z "$NEXTAUTH_URL" ]; then \
+      echo "[build] NEXTAUTH_URL was empty; defaulting to ${_NEXTAUTH_URL_FALLBACK}"; \
+      echo "[build] override at deploy time via --build-arg or .env.deploy"; \
+    fi
+ENV NEXTAUTH_URL=${NEXTAUTH_URL:-$_NEXTAUTH_URL_FALLBACK}
+
+# Override .env.local with any non-empty build args. Skipping empty values
+# means a partial set of overrides still works — anything you don't pass
+# falls back to .env.local.
+RUN set -e; \
+    : > .env.production.local; \
+    for v in \
+      NEXT_PUBLIC_USER_MANAGEMENT_API_BASE \
+      NEXT_PUBLIC_ML_SERVICE_API_BASE \
+      NEXT_PUBLIC_TOKEN_ENDPOINT_USER_MANAGEMENT_SERVICE \
+      NEXT_PUBLIC_TOKEN_ENDPOINT_ML_SERVICE \
+      NEXT_PUBLIC_TOKEN_ENDPOINT_QUERY_SERVICE \
+      NEXT_PUBLIC_TOKEN_ENDPOINT_CHAT_SERVICE \
+      NEXT_PUBLIC_API_QUERY_ENDPOINT \
+      NEXT_PUBLIC_API_NAMED_GRAPH_QUERY_ENDPOINT \
+      NEXT_PUBLIC_CHAT_SERVICE_API_ENDPOINT \
+      NEXT_PUBLIC_API_NER_ENDPOINT \
+      NEXT_PUBLIC_NER_GET_ENDPOINT \
+      NEXT_PUBLIC_NER_SAVE_ENDPOINT \
+      NEXT_PUBLIC_API_PDF2REPROSCHEMA_ENDPOINT \
+      NEXT_PUBLIC_API_ADMIN_EXTRACT_STRUCTURED_RESOURCE_ENDPOINT \
+      NEXT_PUBLIC_API_ADMIN_SAVE_STRUCTURED_RESOURCE_ENDPOINT \
+      NEXT_PUBLIC_API_ADMIN_GET_STRUCTURED_RESOURCE_ENDPOINT \
+      NEXT_PUBLIC_API_ADMIN_INSERT_KGS_JSONLD_TTL_ENDPOINT \
+      NEXT_PUBLIC_API_ADMIN_INSERT_KGS_JSONLD_TTL_JOB_STATUS_ENDPOINT \
+      NEXT_PUBLIC_API_ADMIN_INSERT_ALL_KGS_JSONLD_TTL_JOB_STATUS_ENDPOINT \
+      NEXT_PUBLIC_API_ADMIN_INSERT_RECOVERY_JOB_ENDPOINT \
+      NEXT_PUBLIC_API_ADMIN_INSERT_CHECK_RECOVERABLE_JOB_ENDPOINT \
+      NEXT_PUBLIC_ENABLE_PAGE_ACCESS_GATE \
+      NEXTAUTH_URL ; do \
+      val=$(eval "echo \"\$$v\""); \
+      if [ -n "$val" ]; then echo "$v=$val" >> .env.production.local; fi; \
+    done
+
 # Copy the rest of the application source code to the working directory
 COPY . .