fix(cli): harden Angular project selection and proxy.conf rewrite

Throw E_VALIDATION when angular.json has several projects and no
defaultProject instead of wiring the proxy into an arbitrary one. Provide the
prefix strip in both the http-proxy-middleware form (pathRewrite) and the Vite
form (rewrite) via a shared stripPrefix, mirroring the dual bearer hooks, so
the prefix is stripped whichever proxy layer Angular's dev server uses.

Author: mridang

apps/cli/src/lib/orca/patchers/rule/angular/angular-json.ts

@@ -7,7 +7,9 @@ import { isObject, parseJsonObject } from "../../../../json";
  * `serve` target. The project name is discovered from the file (`defaultProject`,
  * else the sole project) rather than hardcoded, since it varies per app.
  * Idempotent — already-set values are left as-is. Throws `E_VALIDATION` when the
- * file is absent or the project/serve target cannot be located.
+ * file is absent, the project/serve target cannot be located, or the workspace
+ * has several projects with no `defaultProject` to disambiguate (rather than
+ * guessing and wiring the proxy into an arbitrary one).
  */
 export function angularProxyEdit(opts: {
   proxyConfig: string;
@@ -23,10 +25,21 @@ export function angularProxyEdit(opts: {
     const projects = isObject(root.projects)
       ? (root.projects as Record<string, unknown>)
       : undefined;
-    const projectName =
-      typeof root.defaultProject === "string"
-        ? root.defaultProject
-        : Object.keys(projects ?? {})[0];
+    const projectNames = Object.keys(projects ?? {});
+    let projectName: string | undefined;
+    if (typeof root.defaultProject === "string") {
+      projectName = root.defaultProject;
+    } else if (projectNames.length === 1) {
+      projectName = projectNames[0];
+    } else if (projectNames.length > 1) {
+      throw new ZitadelError(
+        "E_VALIDATION",
+        "angular.json has multiple projects and no defaultProject to choose from",
+        {
+          hint: `Set "defaultProject" in angular.json, or add "proxyConfig" to the right project's serve target manually. Projects: ${projectNames.join(", ")}.`,
+        },
+      );
+    }
     const project = projects && projectName ? projects[projectName] : undefined;
     if (!isObject(project)) {
       throw new ZitadelError("E_VALIDATION", "No project found in angular.json", {

apps/cli/src/lib/orca/patchers/rule/angular/templates.ts

@@ -57,11 +57,12 @@ export function appTemplateHtml(): string {
 }
 
 /**
- * The managed `proxy.conf.cjs` for `ng serve` (Angular's Vite-based dev server).
- * `proxy.conf.cjs` for `ng serve`: forwards `/__nextgen/*` to the backend (from
- * `zitadel.json`), strips the prefix, and attaches the project's `sk_<project_id>`
- * bearer to every proxied request. Both `onProxyReq` (http-proxy-middleware) and
- * `configure` (Vite) hooks are set so whichever Angular's dev server honors fires.
+ * The managed `proxy.conf.cjs` for `ng serve`: forwards `/__nextgen/*` to the
+ * backend (from `zitadel.json`), strips the prefix, and attaches the project's
+ * `sk_<project_id>` bearer to every proxied request. The prefix strip and the
+ * bearer are each provided in both the http-proxy-middleware form
+ * (`pathRewrite`/`onProxyReq`) and the Vite form (`rewrite`/`configure`), so
+ * both fire whichever proxy layer Angular's dev server uses.
  */
 export function proxyConfTemplate(): string {
   return `${MANAGED_MARKER}
@@ -74,11 +75,16 @@ function setBearer(proxyReq) {
   proxyReq.setHeader("authorization", bearer);
 }
 
+function stripPrefix(path) {
+  return path.replace(/^\\${PROXY_PATH}/, "") || "/";
+}
+
 module.exports = {
   "${PROXY_PATH}": {
     target: config.server,
     changeOrigin: false,
-    pathRewrite: (path) => path.replace(/^\\${PROXY_PATH}/, "") || "/",
+    pathRewrite: stripPrefix,
+    rewrite: stripPrefix,
     onProxyReq: setBearer,
     configure: (proxy) => proxy.on("proxyReq", setBearer),
   },

apps/cli/tests/unit/lib/orca/patchers/rule/angular/angular-json.test.ts

@@ -40,6 +40,19 @@ describe("angularProxyEdit", () => {
     expect(() => edit(JSON.stringify({ projects: {} }))).toThrowError(/No project/);
   });
 
+  it("throws on multiple projects with no defaultProject instead of guessing", () => {
+    expect(() =>
+      edit(
+        JSON.stringify({
+          projects: {
+            web: { architect: { serve: { options: {} } } },
+            admin: { architect: { serve: { options: {} } } },
+          },
+        }),
+      ),
+    ).toThrowError(/multiple projects/);
+  });
+
   it("throws when there is no serve target", () => {
     expect(() => edit(ng({ architect: {} }))).toThrowError(/serve/);
   });