From bea5cec942e45af822a0ac9bf4c744e314d4ed56 Mon Sep 17 00:00:00 2001
From: "railway-app[bot]" <68434857+railway-app[bot]@users.noreply.github.com>
Date: Tue, 28 Apr 2026 03:21:18 +0000
Subject: [PATCH] fix: use production backend URL when NEXT_PUBLIC_API_BASE_URL
 is unset

---
 frontend/src/lib/api.ts                 | 12 +++++++++++-
 frontend/src/lib/intelligence/client.ts | 12 +++++++++++-
 infra/docker/frontend.Dockerfile        |  4 ++--
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index 150eec1..029ea62 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -43,13 +43,23 @@ interface ApiQueryResult {
   available: boolean;
 }
 
+const PRODUCTION_API_URL = "https://thesphere-production-4aea.up.railway.app";
+
 function getApiBaseUrl() {
   if (process.env.NEXT_PUBLIC_API_BASE_URL) {
     return process.env.NEXT_PUBLIC_API_BASE_URL;
   }
 
+  // In the browser, detect whether we're running in production (i.e. not on
+  // localhost / 127.0.0.1). NEXT_PUBLIC vars are baked at build time, so when
+  // Railway doesn't pass the build arg the env var is empty and we fall through
+  // to this runtime check instead of calling localhost from the user's browser.
   if (typeof window !== "undefined") {
-    return `${window.location.protocol}//${window.location.hostname}:8000`;
+    const host = window.location.hostname;
+    if (host !== "localhost" && host !== "127.0.0.1") {
+      return PRODUCTION_API_URL;
+    }
+    return `${window.location.protocol}//${host}:8000`;
   }
 
   return "http://localhost:8000";
diff --git a/frontend/src/lib/intelligence/client.ts b/frontend/src/lib/intelligence/client.ts
index 41fee44..f420203 100644
--- a/frontend/src/lib/intelligence/client.ts
+++ b/frontend/src/lib/intelligence/client.ts
@@ -82,6 +82,8 @@ export interface IntelligenceClientOptions {
   signal?: AbortSignal;
 }
 
+const PRODUCTION_API_URL = "https://thesphere-production-4aea.up.railway.app";
+
 function resolveBaseUrl(explicit: string | undefined): string {
   if (explicit) {
     return explicit.replace(/\/$/, "");
@@ -89,8 +91,16 @@ function resolveBaseUrl(explicit: string | undefined): string {
   if (typeof process !== "undefined" && process.env?.NEXT_PUBLIC_API_BASE_URL) {
     return process.env.NEXT_PUBLIC_API_BASE_URL.replace(/\/$/, "");
   }
+  // In the browser, detect whether we're running in production (i.e. not on
+  // localhost / 127.0.0.1). NEXT_PUBLIC vars are baked at build time, so when
+  // Railway doesn't pass the build arg the env var is empty and we fall through
+  // to this runtime check instead of calling localhost from the user's browser.
   if (typeof window !== "undefined") {
-    return `${window.location.protocol}//${window.location.hostname}:8000`;
+    const host = window.location.hostname;
+    if (host !== "localhost" && host !== "127.0.0.1") {
+      return PRODUCTION_API_URL;
+    }
+    return `${window.location.protocol}//${host}:8000`;
   }
   return "http://localhost:8000";
 }
diff --git a/infra/docker/frontend.Dockerfile b/infra/docker/frontend.Dockerfile
index d886163..ded50f7 100644
--- a/infra/docker/frontend.Dockerfile
+++ b/infra/docker/frontend.Dockerfile
@@ -7,8 +7,8 @@ WORKDIR /app/frontend
 
 # Build-time args (public env vars baked into the Next.js build).
 # These are visible in the browser bundle — never put secrets here.
-ARG NEXT_PUBLIC_API_BASE_URL=http://localhost:8000
-ARG NEXT_PUBLIC_WS_BASE_URL=ws://localhost:8000
+ARG NEXT_PUBLIC_API_BASE_URL
+ARG NEXT_PUBLIC_WS_BASE_URL
 ARG NEXT_PUBLIC_CESIUM_ION_TOKEN
 
 ENV NEXT_PUBLIC_API_BASE_URL=${NEXT_PUBLIC_API_BASE_URL}