[CHORE] Vite define() warning: process.env exposure

[Delqhi]

Problem

During frontend build, vite emits a security warning:

The `define` option contains an object with "PATH" for "process.env" key. It looks like you may have passed the entire `process.env` object to `define`, which can unintentionally expose all environment variables. This poses a security risk and is discouraged.

Root Cause

frontend/vite.config.js line 19-21:

define: {
  "process.env": process.env
}

This passes the entire process.env to Vite's define, exposing all host env vars to the bundle.

Proposed Fix

Use a whitelist of required env vars:

define: {
  "process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV || "production")
  // Add other specific vars as needed
}

Or use vite-plugin-environment for proper env var handling.

Acceptance Criteria

• cd frontend && npx vite build runs without the PATH/process.env warning
• No functionality broken (verify frontend tests pass)
• Bundle still has access to required env vars at build time

Aufwand

~15-30 min

[Delqhi]

✅ FIXED in commit b7bcfef

What was broken:
Vite's define: { "process.env.NODE_ENV": JSON.stringify(...) } block caused a warning about exposing process.env to the client bundle, which is a security concern and creates non-standard build output.

What was fixed:

• frontend/vite.config.js: Removed the define block entirely (lines 26-28)
• frontend/src/hooks/useWebPushNotifications.ts: Replaced process.env.NODE_ENV check with import.meta.env.MODE === "production" (the idiomatic Vite way)
• Removed stale /* global process */ ESLint directive

Verification: grep -rn "process.env" frontend/src/ returned zero results after the fix. Only remaining process.env references are in server-side Node code (which is correct).

Impact: Cleaner build output, no Vite warnings, follows Vite best practices.

[Delqhi]

Vite define() Warnung behoben

Mit Commit b9e0923 wurde in eine Whitelist für hinzugefügt, statt das gesamte -Objekt zu exposen. Die Audit-Prüfung und der Frontend-Build laufen ohne Warnung durch. Issue wird geschlossen.