From fba56bf8f3c6176589ef5c3775c6e1c9a11b7ac1 Mon Sep 17 00:00:00 2001
From: Conan Scott <conanscott@gmail.com>
Date: Thu, 2 Jul 2026 19:20:53 +1000
Subject: [PATCH] feat(ui): point the portal at Fusion via ui_gateway_url

Add var.ui_gateway_url so config.js can target the Fusion listener instead of the
backend /demo. Set to the Fusion /tokenize endpoint; the browser now runs the
full flow through the gateway (guardrail -> tokenize -> agent -> restore).
Requires Fusion to return CORS for the CloudFront origin (done).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 terraform/ui.tf        | 11 ++++++++---
 terraform/variables.tf |  8 ++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/terraform/ui.tf b/terraform/ui.tf
index 361aef4..6584572 100644
--- a/terraform/ui.tf
+++ b/terraform/ui.tf
@@ -73,13 +73,18 @@ resource "aws_s3_object" "index" {
   content_type = "text/html"
 }
 
-# Injected config: the demo orchestrator endpoint the UI calls.
+# Injected config: the endpoint the UI posts to. Defaults to the backend /demo
+# round trip; set var.ui_gateway_url to point the browser at Fusion instead.
+locals {
+  ui_endpoint = var.ui_gateway_url != "" ? var.ui_gateway_url : "${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo"
+}
+
 resource "aws_s3_object" "config" {
   bucket       = aws_s3_bucket.ui.id
   key          = "config.js"
-  content      = "window.DEMO_ENDPOINT = \"${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo\";\n"
+  content      = "window.DEMO_ENDPOINT = \"${local.ui_endpoint}\";\n"
   content_type = "application/javascript"
-  etag         = md5("${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo")
+  etag         = md5(local.ui_endpoint)
 }
 
 output "ui_url" { value = "https://${aws_cloudfront_distribution.ui.domain_name}" }
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 8f50150..9f8fb99 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -50,3 +50,11 @@ variable "agent_runtime_arn" {
   type        = string
   default     = ""
 }
+
+# Where the browser UI posts. Empty -> backend /demo. Set to the Fusion endpoint
+# to run the portal through the gateway (Fusion must return CORS for the UI origin).
+variable "ui_gateway_url" {
+  description = "Endpoint the UI posts to (empty = backend /demo round trip)."
+  type        = string
+  default     = ""
+}