Third-Party Technical Summary — Web Frontend Application

1. Executive summary

Next.js app-route and hybrid-rendered web client integrating a remote REST API (separate codebase and deployment). WebGL-based 3D building configuration, authenticated dashboard workflows (companies, leads, projects, users, dealers, pricing, pipeline), standard identity flows (registration, login, email verification, password recovery).

---

2. Runtime distribution

Browser: UI and WebGL. Server: Next.js middleware, server components where used, Route Handlers (e.g. manifest, image proxy). Persistent data and authorization: backend API over HTTPS.

---

3. Technology inventory

Concern	Implementation
Framework	Next.js 14.2.x, App Router
UI library	React 18
Language	TypeScript (strict: true); JavaScript present in repository
Styling	Tailwind CSS 3.x, Sass, @tailwindcss/forms, Headless UI
Global state	Redux Toolkit, React-Redux
Forms and validation	React Hook Form, Yup, @hookform/resolvers
3D rendering	three.js, @react-three/fiber, @react-three/drei, @react-three/csg
Charts / documents	Highcharts, Highcharts React, jsPDF
Motion	GSAP
Progressive web app	@ducanh2912/next-pwa (PWA build artifacts emitted to public; plugin disabled under NODE_ENV === development)
Abuse mitigation	Google reCAPTCHA v3 (React integration)
Images	next/image, sharp; remote image hosts constrained via remotePatterns in Next configuration
Utilities	lodash, date-fns, bson, nprogress
Static analysis / formatting	ESLint (extends next/core-web-vitals, TypeScript rules, Prettier integration), Prettier with Tailwind class sorting plugin

---

4. Exposed route structure

Segment	Examples	Function
Root	/	HTTP redirect to configured external landing URL
Public configurator	/b/[slug], /b/[slug]/default	Building configuration and visualization
Authentication	/auth/login, /auth/signup, /auth/forgot-password, /auth/reset-password, /auth/verify-email	Identity lifecycle
Authenticated application	/dashboard, nested /dashboard/*	Post-login operations: companies, leads (including status-specific subpaths), projects, users, dealers, pricing, sales pipeline, settings
Internal HTTP endpoints	manifest.webmanifest, api/proxy-image	Ancillary server endpoints

---

5. Technical features

Domain	Capabilities
3D configurator	WebGL scenes (React Three Fiber, Drei, CSG); interactive building visualization; camera control; trims, walls, lean-tos, openings, rigid-frame and structural options; color and finish selection; upgrades and inset bays; dimension and style inputs; estimated pricing in configurator UI
Capture & submission	Multi-view screenshot capture for design submission; capture state coordinated through Redux for upload with lead payloads
PDF generation	Client-side jsPDF lead / design summary documents: sectioned text (customer, colors, building blocks, openings, lean-tos), pagination helpers, optional embedded PNG views
Dashboard analytics	Highcharts bar and spline charts on dashboard surfaces
Pipeline & admin ordering	@hello-pangea/dnd drag-and-drop: sales pipeline board; ordered lists in settings (e.g. windows, insulation types, roll-up door presets)
Progressive web app	Web app manifest via Route Handler; PWA build integration for installable/offline-oriented production bundles
Images	next/image with configured remote patterns; Route Handler image proxy that fetches image assets from the API origin and streams to the client
Typography	next/font (Google Inter) in root layout
Navigation feedback	NProgress top bar on route transitions
Forms & inputs	Schema-backed forms (React Hook Form + Yup); react-datepicker; react-slider; toast notifications (react-hot-toast)
Server-side utilities	Next.js Server Actions for cookie read/write/delete and cache path revalidation where used
Redux domains	Auth, company, sidebar; configurator-related slices (settings, size, style, rigid frame, openings, colors, lean-tos, inset bays, upgrades, pricing, payment calculation, location / environmental factors, camera, capture)

---

6. Middleware and session handling

Condition	Behavior
SERVER_ENV === development	Optional site-wide HTTP Basic Authentication when DEV_SERVER_USER and DEV_SERVER_PASS are set
/auth/login, /auth/signup	If session validates against backend, redirect to /dashboard; otherwise allow page
/dashboard prefix	Session validation; on failure, redirect to login with return URL query parameter
Matcher	Applies broadly; static paths such as _next, favicon.ico, and robots.txt are excluded

REST API: Authorization: Bearer <token>; token from application cookie state on the server path used by the shared HTTP client. Cookie attributes and token lifecycle: implementation and API / identity service.

---

7. Security-relevant integrations

• Dashboard: edge middleware, server-side backend verification.
• reCAPTCHA v3 where NEXT_PUBLIC_RECAPTCHA_SITE_KEY is referenced.
• Development: HTTP Basic Authentication is an environment gate only.

---

8. Out of scope

• Application source, build artifacts, internal algorithms (3D geometry, pricing, configuration rules).
• REST API contracts, database schemas, server-side authorization logic.
• Infrastructure diagrams, production endpoints, credentials, operational runbooks.
• Test plans, coverage metrics, CI/CD definitions (if held separately).

---