[Bug] Hardcoded Deployment URL in Base.Class.js

[swindar-zhou]

Summary

• WebAPP/Classes/Base.Class.js contains a static HEROKU = 0 flag that, when set to 1, hardcodes the API target to https://osemosys.herokuapp.com/
• No configuration mechanism exists. Contributors must edit source code to change the deployment target
• Violates 12-factor app principles; blocks cloud and multi-user deployments

Expected behavior

• The API base URL should be configurable without touching source code
• Deployments to AWS, GCP, Azure, or any custom server should work by setting an environment variable
• Local development should require zero config changes and fall back to window.location.origin

Reproduction steps

1. Open WebAPP/Classes/Base.Class.js:6 and set static HEROKU = 1
2. Deploy the app to any server other than osemosys.herokuapp.com
3. Open the browser network tab and observe all API calls targeting osemosys.herokuapp.com instead of the actual server
4. All requests return errors or wrong data silently

Environment

• Affects all deployment environments (Docker, AWS, GCP, Azure, any Heroku app other than the hardcoded one)
• Browser-agnostic: the issue is in JS source, not a browser quirk
• Reproduced on current main branch at commit 3ddecdf

Logs or screenshots

The bug is directly visible at WebAPP/Classes/Base.Class.js:11-16:

static apiUrl() {
if (this.HEROKU == 1) {
return "https://osemosys.herokuapp.com/"; // hardcoded, no override possible
}
return ${window.location.origin}/;
}

Related work checked

• Searched codebase for API_BASE_URL, window.API_BASE_URL, config.js — none exist
• No existing issue or PR addresses this
• The window.location.origin fallback already works correctly for standard deployments — only the HEROKU code path is broken
• README does not document how to configure the API URL for non-local deployments

Proposed track

None

[Cypher-CP0]

Hi! I'd like to work on this fix. My approach is to remove the HEROKU flag and update apiUrl() to read from window.API_BASE_URL with a fallback to window.location.origin, and document this in the README. Could you confirm the approach before I open a PR? I also noticed PR #387, is that still in progress or can I take this up?