WBS-11: Hardening BFF Architecture, fix /Index page redirect and JsonDocument ObjectDisposedException in operational-report API

src/dotnet/QuantEngine.Web/Program.cs

@@ -2,6 +2,7 @@ using QuantEngine.Web.Components;
 using QuantEngine.Infrastructure.Data;
 using Microsoft.AspNetCore.Components.Authorization;
 using QuantEngine.Web.Infrastructure;
+using Npgsql;
 using QuantEngine.Infrastructure.Repositories;
 using QuantEngine.Infrastructure.Services;
 using QuantEngine.Core.Interfaces;
@@ -37,7 +38,6 @@ builder.Host.UseSerilog();
 // Add services to the container.
 builder.Services.AddRazorPages();
 builder.Services.AddRazorComponents()
-    .AddInteractiveServerComponents()
     .AddInteractiveWebAssemblyComponents();
 
 // Authentication and Custom State Provider (Shared client components)
@@ -62,7 +62,9 @@ if (!string.Equals(configuredDatabase, "quantenginedb", StringComparison.Ordinal
 {
     throw new InvalidOperationException("QuantEngine must use the quantenginedb PostgreSQL database.");
 }
-builder.Services.AddSingleton<IDbConnectionFactory>(new DbConnectionFactory(connectionString));
+var dataSource = NpgsqlDataSource.Create(connectionString);
+builder.Services.AddSingleton(dataSource);
+builder.Services.AddSingleton<IDbConnectionFactory>(new DbConnectionFactory(dataSource));
 builder.Services.AddSingleton<DbMigrator>();
 builder.Services.AddScoped<IWorkspaceRepository, WorkspaceRepository>();
 builder.Services.AddScoped<IPostgresqlHistoryStore, PostgresqlHistoryStore>();
@@ -248,7 +250,7 @@ app.MapPost("/api/auth/login", async (JsonElement payload, HttpContext httpConte
                 new Microsoft.AspNetCore.Http.CookieOptions
                 {
                     HttpOnly = true,
-                    Secure = httpContext.Request.IsHttps,
+                    Secure = true,
                     SameSite = Microsoft.AspNetCore.Http.SameSiteMode.Lax,
                     Expires = devExpiresAt,
                     Path = "/"
@@ -303,8 +305,8 @@ app.MapPost("/api/auth/login", async (JsonElement payload, HttpContext httpConte
         new Microsoft.AspNetCore.Http.CookieOptions
         {
             HttpOnly = true,
-            Secure = httpContext.Request.IsHttps, // Only secure on HTTPS
-            SameSite = Microsoft.AspNetCore.Http.SameSiteMode.Lax,  // Lax for localhost
+            Secure = true, // Force Secure Cookie for SSL standard
+            SameSite = Microsoft.AspNetCore.Http.SameSiteMode.Lax,
             Expires = expiresAt,
             Path = "/"
         }
@@ -443,7 +445,6 @@ app.MapPost("/api/auth/admin/reset-password", async (HttpContext context, JsonEl
     });
 }).DisableAntiforgery();
 
-// Operational Report serving API (WASM safe file loading substitute)
 app.MapGet("/api/operational-report", async (IWebHostEnvironment env) =>
 {
     var path = Path.GetFullPath(Path.Combine(env.ContentRootPath, "..", "..", "..", "Temp", "operational_report.json"));
@@ -452,8 +453,8 @@ app.MapGet("/api/operational-report", async (IWebHostEnvironment env) =>
         return Results.NotFound(new { gate = "FAIL", error = "operational_report_missing" });
     }
     var json = await File.ReadAllTextAsync(path);
-    using var doc = JsonDocument.Parse(json);
-    return Results.Ok(doc.RootElement);
+    // Directly return raw JSON string with correct Content-Type to bypass using-disposed JSON document serializer issue
+    return Results.Content(json, "application/json");
 });
 
 app.MapGet("/api/history/{domain}", async (string domain, int? limit, IPostgresqlHistorySnapshotReader reader) =>
@@ -505,7 +506,6 @@ app.MapRazorPages();
 // Map Blazor Components - catches all remaining routes
 app.MapRazorComponents<App>()
     .AddInteractiveWebAssemblyRenderMode()
-    .AddInteractiveServerRenderMode()
     .AddAdditionalAssemblies(typeof(QuantEngine.Web.Client._Imports).Assembly);
 
 app.Run();