fix(web): hashed demo bundles + no-cache index.html (menu dead after deploy); no token on static assets (en.json 400)

Merged
EV
12d ago
+76-1

Two demo breakages after #10254 (develop 51e39dc66fe), both root-caused and reproduced:

1. Menu does nothing / Cannot read properties of undefined (reading 'call') / Cannot access 'TasksModule' before initialization. The demo image is a development build with fixed bundle names (runtime.js, 9327.js, …). Cloudflare kept serving the previous deploy's runtime.js and 9327.js (CF-Cache-Status: HIT, Last-Modified 13:17) next to the new main.js/5430.js → webpack module ids from two builds. (Mitigated live by purging the 251 demo files from the CF cache; this PR makes it impossible to recur.)

  • build:gauzy:dev:docker now passes --output-hashing=all — production (app.gauzy.co, stage.gauzy.co) already hashes, so customers were never exposed. Proven locally: all 250 JS files hashed, index.html references the hashed names.
  • Both web nginx configs send Cache-Control: no-cache, must-revalidate for index.html (nginx -t OK with the image's nginx).

2. ./assets/i18n/en.json → 400 "Request Header Or Cookie Too Large" for signed-in users. The bearer token carries every permission of the role (380 for a super admin after #10254 → 11,464 B); the web image's nginx refuses a header line over 8 KB (proven in the pod: 200 with a small header, 400 with 11.5 KB). TokenInterceptor no longer sends the token to the app's own static assets (./assets/…). Red: new token.interceptor.spec.ts asset cases failed (3/6); green 6/6. API requests unchanged.

Follow-up (not in this PR): the API path accepts headers up to ~16 KB (ingress); the 11.5 KB token leaves ~4.5 KB margin and grows ~30 B per permission — move permissions out of the JWT (or shrink them) before it hits the limit.

Lead self-review (owner asked for speed); merging to unblock the demo.

🤖 Generated with Claude Code

Summary by cubic

Fixes two demo breakages: a dead menu caused by cached unhashed bundles mixing with a new deploy, and ./assets/i18n/en.json returning 400 for signed-in users because the token exceeded nginx's 8 KB header limit.

Bug Fixes

  • Demo builds now hash their bundles, and both nginx configs serve index.html with Cache-Control: no-cache, so a deploy can't be served alongside a previous build's cached chunks.
  • TokenInterceptor no longer attaches the token to the app's own static assets, while API requests are unchanged.