fix(build): add production API URLs to Docker build

Dockerfile now passes --dart-define flags for CORE_API_URL and
TATLOCK_API_URL pointing to schweitz.net domains. This enables
requiresAuth=true, fixing auth being completely skipped in production.

Also added service port reference table to AGENTS.md.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

AGENTS.md

@@ -22,14 +22,20 @@ This document contains instructions and documentation references for AI assistan
   * Related repos: , `core-api`, `tatlock`, `library-desk`, `scheduler`, `portainer-core`
 
 ### 🐳 Deployment & Infrastructure
+
+**⚠️ IMPORTANT: Service Port Reference**
+| Service | LAN Port | External URL | Notes |
+|---------|----------|--------------|-------|
+| **Core API** | 8083 | `api.schweitz.net` | FastAPI backend for this UI |
+| **Tatlock API** | 8000 | `tatlock.schweitz.net` | Legacy Python API (Ollama proxy) |
+| **Tatlock UI** | 9999 | `home.schweitz.net` | This Flutter app |
+
 * **Full stack documentation**: Available in the `portainer-core` repo
-  * Access: `curl http://localhost:3002/jpmschweitzer/portainer-core/raw/branch/main/CONTAINERS.md`
+  * Access: `curl http://192.168.86.149:3002/jpmschweitzer/portainer-core/raw/branch/main/CONTAINERS.md`
   * Contains: All service ports, URLs, Redis DB allocations, external domains
-* **Tatlock deployment**:
+* **Health checks**:
-  * LAN: `http://192.168.86.149:8000`
+  * Core API: `curl http://192.168.86.149:8083/health`
-  * External: `tatlock.schweitz.net` (behind Authentik SSO)
+  * Tatlock API: `curl http://192.168.86.149:8000/health`
-  * Redis DBs: 1 (memory), 6 (benchmarks)
-* **Health check**: `curl http://192.168.86.149:8000/health`
 
 ### 🛡️ Git Discipline
 * **Commit Messages:** Use the [Conventional Commits](https://www.conventionalcommits.org/) format.

CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.2] - 2026-01-03
+
+### Fixed
+- Production Docker build now uses correct API URLs
+  - Added `--dart-define` flags for `CORE_API_URL` and `TATLOCK_API_URL`
+  - This enables `requiresAuth=true` so authentication is actually triggered
+- Updated AGENTS.md with clear service port reference table
+
+## [1.0.1] - 2026-01-03
+
+### Fixed
+- Web authentication now works correctly with NPM forward auth
+  - Dio client sends cookies with requests via `withCredentials: true`
+  - Added platform-specific adapters (native vs web) for proper cookie handling
+
 ## [1.0.0] - 2026-01-03
 
 ### Added

Dockerfile

@@ -15,8 +15,11 @@ COPY . .
 # Generate code with build_runner
 RUN dart run build_runner build --delete-conflicting-outputs
 
-# Build for web release
+# Build for web release with production configuration
-RUN flutter build web --release
+# These URLs enable authentication (requiresAuth = true when URL contains schweitz.net)
+RUN flutter build web --release \
+    --dart-define=CORE_API_URL=https://api.schweitz.net \
+    --dart-define=TATLOCK_API_URL=https://tatlock.schweitz.net
 
 # Stage 2: Serve with nginx
 FROM nginx:alpine

lib/core/api/api_client.dart

@@ -3,23 +3,26 @@ import 'package:riverpod_annotation/riverpod_annotation.dart';
 import 'package:tatlock_ui/core/api/api_interceptors.dart';
 import 'package:tatlock_ui/core/config/app_config.dart';
 
+import 'api_client_native.dart' if (dart.library.html) 'api_client_web.dart'
+    as platform;
+
 part 'api_client.g.dart';
 
 /// Provides the Dio instance for Core API.
 @riverpod
 Dio coreApiClient(Ref ref) {
-  final dio = Dio(
+  final options = BaseOptions(
-    BaseOptions(
+    baseUrl: AppConfig.coreApiUrl,
-      baseUrl: AppConfig.coreApiUrl,
+    connectTimeout: const Duration(seconds: 10),
-      connectTimeout: const Duration(seconds: 10),
+    receiveTimeout: const Duration(seconds: 30),
-      receiveTimeout: const Duration(seconds: 30),
+    headers: {
-      headers: {
+      'Content-Type': 'application/json',
-        'Content-Type': 'application/json',
+      'Accept': 'application/json',
-        'Accept': 'application/json',
+    },
-      },
-    ),
   );
 
+  final dio = platform.createDio(options);
+
   dio.interceptors.addAll([
     AuthInterceptor(ref),
     LoggingInterceptor(),
@@ -32,18 +35,18 @@ Dio coreApiClient(Ref ref) {
 /// Provides the Dio instance for Tatlock API.
 @riverpod
 Dio tatlockApiClient(Ref ref) {
-  final dio = Dio(
+  final options = BaseOptions(
-    BaseOptions(
+    baseUrl: AppConfig.tatlockApiUrl,
-      baseUrl: AppConfig.tatlockApiUrl,
+    connectTimeout: const Duration(seconds: 10),
-      connectTimeout: const Duration(seconds: 10),
+    receiveTimeout: const Duration(minutes: 5), // Longer for LLM responses
-      receiveTimeout: const Duration(minutes: 5), // Longer for LLM responses
+    headers: {
-      headers: {
+      'Content-Type': 'application/json',
-        'Content-Type': 'application/json',
+      'Accept': 'application/json',
-        'Accept': 'application/json',
+    },
-      },
-    ),
   );
 
+  final dio = platform.createDio(options);
+
   dio.interceptors.addAll([
     AuthInterceptor(ref),
     LoggingInterceptor(),

lib/core/api/api_client_native.dart

@@ -0,0 +1,6 @@
+import 'package:dio/dio.dart';
+
+/// Create a Dio instance for native platforms (mobile, desktop).
+Dio createDio(BaseOptions options) {
+  return Dio(options);
+}

lib/core/api/api_client_web.dart

@@ -0,0 +1,12 @@
+import 'package:dio/dio.dart';
+import 'package:dio_web_adapter/dio_web_adapter.dart';
+
+/// Create a Dio instance for web platform with credentials support.
+///
+/// Enables `withCredentials` to send cookies with requests, which is
+/// required for NPM forward auth to work correctly.
+Dio createDio(BaseOptions options) {
+  final dio = Dio(options);
+  dio.httpClientAdapter = BrowserHttpClientAdapter(withCredentials: true);
+  return dio;
+}

pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.0.0+1
+version: 1.0.2+1
 
 environment:
   sdk: ^3.10.4
@@ -67,6 +67,7 @@ dependencies:
   url_launcher: ^6.3.1
   flutter_code_editor: ^0.3.5
   highlight: ^0.7.0
+  dio_web_adapter: ^2.1.1
 
 dev_dependencies:
   flutter_test: