fix(cypress): move CSP frame-ancestors from Next.js middleware to ingress layer (#5025)

Author: rschlaefli

.factory/skills/klicker-cypress-e2e/SKILL.md

@@ -65,6 +65,71 @@ gh run download <run-id> --repo uzh-bf/klicker-uzh --dir /tmp/klicker-cypress-ru
 
 After you identify the failing spec path in logs, reproduce locally with `test:run:one`.
 
+## CI mass-failure triage workflow (Cypress Cloud + GH)
+
+Use this when failures explode across many specs (for example, fail count rising continuously in Cypress Cloud).
+
+### 1) Monitor run completion first
+
+```bash
+# quick status of the two key checks on a PR
+gh pr checks <pr-number> --json name,bucket,state,description,link \
+  --jq '.[] | select(.name=="cypress-run-cloud" or .name=="cypress: default-group (merge)") | [.name,.bucket,.state,(.description//"-"),.link] | @tsv'
+
+# inspect cypress workflow job/step state
+gh run view <run-id> --json jobs \
+  --jq '.jobs[] | select(.name=="cypress-run-cloud") | {status,conclusion,steps:[.steps[]|{n:.number,name:.name,status:.status,conclusion:.conclusion}]}'
+```
+
+Important: `gh run view --log-failed` and `--job ... --log` only work after the run/job has completed.
+
+### 2) Capture logs immediately after completion
+
+```bash
+gh run view <run-id> --log-failed > /tmp/cypress-run-<run-id>-failed.log
+gh run view <run-id> --job <job-id> --log > /tmp/cypress-run-<run-id>-job-<job-id>.log
+```
+
+### 3) Classify failure signatures
+
+```bash
+rg -n "Failed to load static props|unhandled promise rejection|Y\\.prefetch|_next/static/chunks/main" \
+  /tmp/cypress-run-<run-id>-failed.log /tmp/cypress-run-<run-id>-job-<job-id>.log
+```
+
+Buckets:
+
+- prefetch/static-props crash signatures (`Failed to load static props`, `Y.prefetch`, Next chunk stack)
+- broad app-level unhandled promise rejection signatures
+- ordinary selector/timeout/assertion failures
+
+### 4) Decision tree
+
+- If prefetch/static-props signatures appear across many specs:
+  - treat as middleware interception regression
+  - harden middleware in all three apps:
+    - `apps/frontend-manage/src/middleware.ts`
+    - `apps/frontend-control/src/middleware.ts`
+    - `apps/frontend-pwa/src/middleware.ts`
+  - skip CSP mutation on prefetch requests (`next-router-prefetch`, `purpose=prefetch`, equivalent headers)
+  - broaden matcher exclusion from selective `_next/static|_next/image|_next/data` to all `_next`
+  - keep runtime `ALLOWED_FRAME_ANCESTORS` behavior (do not move back to build-time-only CSP config)
+- If signatures are absent and failures are localized:
+  - split by spec and fix as isolated test/app issues instead of a global middleware rollback
+
+### 5) Post-fix validation gate
+
+```bash
+# optional fast local smoke on critical specs
+pnpm --filter @klicker-uzh/cypress test:run:one --spec cypress/e2e/0-baseline-ops.cy.ts
+pnpm --filter @klicker-uzh/cypress test:run:one --spec cypress/e2e/A-login-workflow.cy.ts
+
+# CI must not show the catastrophic signature anymore
+gh run view <new-run-id> --log-failed | rg -n "Failed to load static props|unhandled promise rejection|Y\\.prefetch"
+```
+
+Passing this gate means Cypress can still have isolated flakes, but no suite-wide early-collapse pattern.
+
 ## Cypress debugging cookbook
 
 ### 1) Reduce the problem

AGENTS.md

@@ -205,6 +205,8 @@ Without Traefik, use `http://localhost:<port>` directly. The `*.klicker.com` dom
 - **PR review triage**: Copilot/CodeRabbit/SonarCloud flag many false positives. Always check if guards/fallbacks already exist before "fixing" reported issues. Confirm with the actual code, not the bot summary.
 - **agent-browser via npx**: Always use `npx agent-browser` instead of bare `agent-browser`. Global install conflicts with Volta's Node shim and fails with "Could not execute command".
 - **LTI launch target resolver contract**: Launch targets are resolved in strict precedence `custom claim (klicker_redirect_to)` -> `query redirectTo`; no env fallback is used in resolver logic. Validation fails closed on the first present invalid source and enforces URL hostname exact/subdomain checks against `COOKIE_DOMAIN` and `DF_DOMAIN` (never substring matching). (`apps/lti/src/launchTarget.ts`)
+- **CSP frame-ancestors via ingress, not middleware**: Pages Router apps (manage, pwa, control) must NOT use Next.js middleware for CSP -- it breaks `_next/data` routes in production builds (known Next.js bug). CSP `frame-ancestors` is set at the reverse proxy layer: HAProxy ingress annotations in K8s (`haproxy.org/response-set-header`), Traefik `customResponseHeaders` middleware in local dev. (`deploy/charts/klicker-uzh-v3/templates/ingress-*.yaml`, `util/traefik/rules_docker.yaml`)
+- **Cypress CI signal timing**: `cypress: default-group (merge)` can report an increasing failed-test count while `cypress-run-cloud` is still in progress; wait for `cypress-run-cloud` completion before expecting downloadable GitHub job logs. (`.github/workflows/cypress-testing.yml`)
 - **Infisical + Turbo env sync**: Any Infisical-managed env var used by tasks must be listed in `turbo.json` `globalEnv`; otherwise task runs/cache behavior can become stale or inconsistent across environments.
 - **Participant email uniqueness across auth modes**: Prisma enforces `Participant @@unique([email, isSSOAccount])`, so the same normalized email can exist once as manual and once as SSO. To block new cross-mode duplicates, account creation must explicitly check normalized email collisions in service logic. (`packages/graphql/src/services/accounts.ts`)
 - **Helm v3 secrets are external**: `deploy/charts/klicker-uzh-v3/` deployments reference `envFrom.secretRef` names, but the chart currently defines no `Secret` manifests; secrets must be provisioned out-of-band with matching names. (`deploy/charts/klicker-uzh-v3/templates/`)

apps/frontend-control/src/middleware.ts

@@ -8,6 +8,3 @@ metadata:
 data:
   # SSR-only GraphQL endpoint for Control frontend (internal service DNS)
   API_URL_SSR: "http://{{ include "chart.fullname" . }}-backend-graphql:3000/api/graphql"
-  {{- if .Values.frontendControl.allowedFrameAncestors }}
-  ALLOWED_FRAME_ANCESTORS: {{ .Values.frontendControl.allowedFrameAncestors | quote }}
-  {{- end }}

apps/frontend-manage/src/middleware.ts

@@ -8,6 +8,3 @@ metadata:
 data:
   # SSR-only GraphQL endpoint for Manage frontend (internal service DNS)
   API_URL_SSR: "http://{{ include "chart.fullname" . }}-backend-graphql:3000/api/graphql"
-  {{- if .Values.frontendManage.allowedFrameAncestors }}
-  ALLOWED_FRAME_ANCESTORS: {{ .Values.frontendManage.allowedFrameAncestors | quote }}
-  {{- end }}

apps/frontend-pwa/src/middleware.ts

@@ -8,6 +8,3 @@ metadata:
 data:
   # SSR-only GraphQL endpoint for PWA (internal service DNS)
   API_URL_SSR: "http://{{ include "chart.fullname" . }}-backend-graphql:3000/api/graphql"
-  {{- if .Values.frontendPWA.allowedFrameAncestors }}
-  ALLOWED_FRAME_ANCESTORS: {{ .Values.frontendPWA.allowedFrameAncestors | quote }}
-  {{- end }}

deploy/charts/klicker-uzh-v3/templates/cm-frontend-control.yaml

@@ -12,10 +12,16 @@ metadata:
   name: {{ $fullName }}-chat
   labels:
     {{- include "chart.ingressLabels" . | nindent 4 }}
-  {{- with .Values.chat.ingress.annotations }}
+  {{- if or .Values.chat.ingress.annotations .Values.chat.allowedFrameAncestors }}
   annotations:
+  {{- with .Values.chat.ingress.annotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
+  {{- if .Values.chat.allowedFrameAncestors }}
+    haproxy.org/response-set-header: |
+      Content-Security-Policy "frame-ancestors 'self' {{ .Values.chat.allowedFrameAncestors }}"
+  {{- end }}
+  {{- end }}
 spec:
   ingressClassName: {{ .Values.chat.ingress.className }}
   {{- if .Values.chat.ingress.tls }}

deploy/charts/klicker-uzh-v3/templates/cm-frontend-manage.yaml

@@ -12,10 +12,16 @@ metadata:
   name: {{ $fullName }}-frontend-control
   labels:
     {{- include "chart.ingressLabels" . | nindent 4 }}
-  {{- with .Values.frontendControl.ingress.annotations }}
+  {{- if or .Values.frontendControl.ingress.annotations .Values.frontendControl.allowedFrameAncestors }}
   annotations:
+  {{- with .Values.frontendControl.ingress.annotations }}
     {{- toYaml . | nindent 4 }}
   {{- end }}
+  {{- if .Values.frontendControl.allowedFrameAncestors }}
+    haproxy.org/response-set-header: |
+      Content-Security-Policy "frame-ancestors 'self' {{ .Values.frontendControl.allowedFrameAncestors }}"
+  {{- end }}
+  {{- end }}
 spec:
   ingressClassName: {{ .Values.frontendControl.ingress.className }}
   {{- if .Values.frontendControl.ingress.tls }}