fix(config): use tauth-api.mprlab.com for production auth

ISSUES.md

@@ -120,8 +120,8 @@ Each issue is formatted as `- [ ] [GN-<number>]`. When resolved it becomes -` [x
 - [ ] [GN-31] Persist authenticated sessions across reload by validating stored Google credentials before wiring stores, and add integration coverage without relying on the backend harness.
 - [x] [GN-311] Synchronization doesnt work properly __ ihave added an addition to a note from one browser but when I opened the note later on on a mobile, it was not there.
   Check the logs at @gravity.log and gravity-filtered.log and try to pinpoint the root cause (Resolved by retrying backend sync calls after refreshing expired TAuth sessions; added backend client regression coverage.)
-- [ ] [GN-421] Gravity production runtime config still points authBaseUrl at the old TAuth host, causing nonce/auth client failures after the deployment.
-  Update production defaults/runtime config and align tests.
+- [x] [GN-421] Gravity production runtime config still points authBaseUrl at the old TAuth host, causing nonce/auth client failures after the deployment.
+  Fixed `authBaseUrl` to `tauth-api.mprlab.com` in `runtime.config.production.json`; removed hardcoded production URLs from `environmentConfig.js` so JSON is the single source of truth.
 - [x] [GN-422] Align Gravity's TAuth session flow with auth-client endpoint mapping to avoid CORS/404s after client updates.
   (Resolved by using the auth-client endpoint map and updating tests.)
 - [x] [GN-424] Gravity still loads the legacy TAuth helper at `/static/auth-client.js`, which no longer exists.

frontend/data/runtime.config.production.json

@@ -2,6 +2,6 @@
     "environment": "production",
     "backendBaseUrl": "https://gravity-api.mprlab.com",
     "llmProxyUrl": "https://llm-proxy.mprlab.com/v1/gravity/classify",
-    "authBaseUrl": "https://tauth.mprlab.com",
+    "authBaseUrl": "https://tauth-api.mprlab.com",
     "authTenantId": "gravity"
 }

frontend/js/core/environmentConfig.js

@@ -3,20 +3,17 @@
 export const ENVIRONMENT_PRODUCTION = "production";
 export const ENVIRONMENT_DEVELOPMENT = "development";
 
-export const PRODUCTION_BACKEND_BASE_URL = "https://gravity-api.mprlab.com";
 export const DEVELOPMENT_BACKEND_BASE_URL = "http://localhost:8080";
-export const PRODUCTION_LLM_PROXY_URL = "https://llm-proxy.mprlab.com/v1/gravity/classify";
 export const DEVELOPMENT_LLM_PROXY_URL = "http://computercat:8081/v1/gravity/classify";
-export const PRODUCTION_AUTH_BASE_URL = "https://tauth.mprlab.com";
 export const DEVELOPMENT_AUTH_BASE_URL = "http://localhost:8082";
-export const PRODUCTION_AUTH_TENANT_ID = "gravity";
 export const DEVELOPMENT_AUTH_TENANT_ID = "";
 
+// Production URLs are loaded from runtime.config.production.json - no hardcoded fallbacks
 export const PRODUCTION_ENVIRONMENT_CONFIG = Object.freeze({
-    backendBaseUrl: PRODUCTION_BACKEND_BASE_URL,
-    llmProxyUrl: PRODUCTION_LLM_PROXY_URL,
-    authBaseUrl: PRODUCTION_AUTH_BASE_URL,
-    authTenantId: PRODUCTION_AUTH_TENANT_ID
+    backendBaseUrl: "",
+    llmProxyUrl: "",
+    authBaseUrl: "",
+    authTenantId: ""
 });
 
 export const DEVELOPMENT_ENVIRONMENT_CONFIG = Object.freeze({

frontend/tests/config.runtime.test.js

@@ -36,12 +36,12 @@ test(TEST_LABELS.DEVELOPMENT_DEFAULTS, () => {
 });
 
 test(TEST_LABELS.PRODUCTION_DEFAULTS, () => {
-    const appConfig = createAppConfig({ environment: ENVIRONMENT_PRODUCTION });
-
-    assert.equal(appConfig.environment, ENVIRONMENT_PRODUCTION);
-    assert.equal(appConfig.backendBaseUrl, PRODUCTION_ENVIRONMENT_CONFIG.backendBaseUrl);
-    assert.equal(appConfig.authBaseUrl, PRODUCTION_ENVIRONMENT_CONFIG.authBaseUrl);
-    assert.equal(appConfig.authTenantId, PRODUCTION_ENVIRONMENT_CONFIG.authTenantId);
+    // Production config requires runtime overrides from runtime.config.production.json
+    // Empty defaults should throw when no override is provided
+    assert.throws(
+        () => createAppConfig({ environment: ENVIRONMENT_PRODUCTION }),
+        { message: "app_config.invalid_backend_base_url" }
+    );
 });
 
 test(TEST_LABELS.BACKEND_OVERRIDE, () => {
@@ -57,13 +57,24 @@ test(TEST_LABELS.LLM_OVERRIDE, () => {
 });
 
 test(TEST_LABELS.AUTH_BASE_OVERRIDE, () => {
-    const appConfig = createAppConfig({ environment: ENVIRONMENT_PRODUCTION, authBaseUrl: AUTH_BASE_URL_OVERRIDE });
+    // Production requires backendBaseUrl override as well
+    const appConfig = createAppConfig({
+        environment: ENVIRONMENT_PRODUCTION,
+        backendBaseUrl: BACKEND_URL_OVERRIDE,
+        authBaseUrl: AUTH_BASE_URL_OVERRIDE
+    });
 
     assert.equal(appConfig.authBaseUrl, AUTH_BASE_URL_OVERRIDE);
 });
 
 test(TEST_LABELS.AUTH_TENANT_OVERRIDE, () => {
-    const appConfig = createAppConfig({ environment: ENVIRONMENT_PRODUCTION, authTenantId: AUTH_TENANT_OVERRIDE });
+    // Production requires backendBaseUrl and authBaseUrl overrides as well
+    const appConfig = createAppConfig({
+        environment: ENVIRONMENT_PRODUCTION,
+        backendBaseUrl: BACKEND_URL_OVERRIDE,
+        authBaseUrl: AUTH_BASE_URL_OVERRIDE,
+        authTenantId: AUTH_TENANT_OVERRIDE
+    });
 
     assert.equal(appConfig.authTenantId, AUTH_TENANT_OVERRIDE);
 });

frontend/tests/runtimeConfig.initialize.test.js

@@ -34,7 +34,8 @@ const FETCH_OPTIONS = Object.freeze({
 
 const REMOTE_ENDPOINTS = Object.freeze({
     BACKEND: "https://api.example.com/v1",
-    LLM_PROXY: "https://llm.example.com/v1/classify"
+    LLM_PROXY: "https://llm.example.com/v1/classify",
+    AUTH: "https://auth.example.com"
 });
 
 const REMOTE_AUTH_TENANT_ID = "gravity";
@@ -71,6 +72,7 @@ test.describe(SUITE_LABELS.INITIALIZE_RUNTIME_CONFIG, () => {
                         environment: ENVIRONMENT_PRODUCTION,
                         backendBaseUrl: REMOTE_ENDPOINTS.BACKEND,
                         llmProxyUrl: REMOTE_ENDPOINTS.LLM_PROXY,
+                        authBaseUrl: REMOTE_ENDPOINTS.AUTH,
                         authTenantId: REMOTE_AUTH_TENANT_ID
                     };
                 }
@@ -94,6 +96,7 @@ test.describe(SUITE_LABELS.INITIALIZE_RUNTIME_CONFIG, () => {
         assert.equal(appConfig.environment, ENVIRONMENT_PRODUCTION);
         assert.equal(appConfig.backendBaseUrl, REMOTE_ENDPOINTS.BACKEND);
         assert.equal(appConfig.llmProxyUrl, REMOTE_ENDPOINTS.LLM_PROXY);
+        assert.equal(appConfig.authBaseUrl, REMOTE_ENDPOINTS.AUTH);
         assert.equal(appConfig.authTenantId, REMOTE_AUTH_TENANT_ID);
         assert.equal(errorNotifications.length, 0);
     });