Harden frontend static serving

src/backend/src/app.module.ts

@@ -16,6 +16,24 @@ import { AuthGuard } from './shared/auth.guard';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
 import { ArchiveModule } from './archive/archive.module';
 import { OperationsModule } from './operations/operations.module';
+import * as fs from 'fs';
+
+function resolveFrontendRoot(fePath: string | undefined): string {
+  const configuredRoot = resolve(__dirname, fePath || '../frontend/browser');
+  const candidateRoots = [
+    configuredRoot,
+    resolve(configuredRoot, 'browser'),
+    resolve(configuredRoot, '..'),
+  ];
+
+  for (const candidateRoot of candidateRoots) {
+    if (fs.existsSync(resolve(candidateRoot, 'index.html'))) {
+      return candidateRoot;
+    }
+  }
+
+  return configuredRoot;
+}
 
 @Module({
   imports: [
@@ -38,8 +56,7 @@ import { OperationsModule } from './operations/operations.module';
       imports: [ConfigModule],
       useFactory: async (configService: ConfigService) => [
         {
-          rootPath: resolve(
-            __dirname,
+          rootPath: resolveFrontendRoot(
             configService.get<string>(EnvironmentEnum.FE_PATH),
           ),
           exclude: ['/api/(.*)'],