auth url fix

Co-authored-by: Copilot <copilot@github.com>

admin_ui/docker-entrypoint.sh

@@ -2,7 +2,7 @@
 set -e
 
 # Create runtime env-config.js for the static app
-cat > /usr/share/nginx/html/env-config.js <<'EOF'
+cat > /usr/share/nginx/html/env-config.js <<EOF
 window.__ENV__ = {
   VITE_AUTH_API: "${VITE_AUTH_API:-http://localhost:5000}",
   VITE_TRANSIT_API: "${VITE_TRANSIT_API:-http://localhost:5001}"

auth_api/index.js

@@ -55,16 +55,10 @@ app.get('/me', async (req, res) => {
   }
 });
 
-// Development helper: issue a token without DB checks when DEV_BYPASS=1
-if (process.env.DEV_BYPASS === '1') {
-  app.post('/dev/token', (req, res) => {
-    const { userId, userCode } = req.body || {};
-    if (!userId || !userCode) return res.status(400).json({ error: 'userId and userCode required' });
-    const payload = { userId: Number(userId), userCode: Number(userCode) };
-    const token = jwt.sign(payload, JWT_SECRET || 'devsecret', { expiresIn: '7d' });
-    res.json({ token, user: payload });
-  });
-}
+// Development helper removed for production safety.
+// The /dev/token endpoint was intentionally removed to prevent accidental
+// issuance of tokens in production builds. Use the real authentication flow
+// (POST /login) or re-enable this code only in local development branches.
 
 const PORT = process.env.PORT || 5000;
 app.listen(PORT, () => console.log(`Auth API listening on ${PORT}`));

docker-compose.yml

@@ -54,8 +54,8 @@ services:
     ports:
       - "5174:80"
     environment:
-      VITE_AUTH_API: http://auth_api:5000
-      VITE_TRANSIT_API: http://transit_api:5001
+      VITE_AUTH_API: http://192.168.2.66:5000
+      VITE_TRANSIT_API: http://192.168.2.66:5001
     depends_on:
       - auth_api
       - transit_api