[Bug]: Bootstrap endpoints break on Azure Static Web Apps when Azure Functions are used

[jake-mahon-netwrix]

Describe the bug

Co-authored with Claude

Azure Static Web Apps (SWA) reserves the /api/* URL prefix exclusively for Azure Functions. Once any Azure Function is registered against a SWA resource (via api_location in the deploy action), SWA routes all /api/* requests to the Functions runtime, including Evidence's bootstrap fetch calls that are hardcoded in the built JS bundle. The SPA crashes on load.

Root Cause

Evidence's built bundle hardcodes these three fetch calls:

• /api/pagesManifest.json
• /api/customFormattingSettings.json/GET.json
• /api/${id}/evidencemeta.json

On Azure SWA, /api/* is a reserved namespace that bypasses all static file routing and staticwebapp.config.json rewrites, routing directly to the Azure Functions runtime instead.

Expected Behavior

Evidence's bootstrap files are served as static JSON regardless of whether Azure Functions are also deployed to the same SWA resource.

Actual Behavior

The bootstrap fetches return a Functions runtime error (404 or 500). The SPA crashes immediately:

TypeError: Cannot read properties of undefined (reading '')
  at qie (0.xxx.js:1:7566)

Workaround

Post-build, patch the bundle to rename Evidence's bootstrap paths to a non-reserved prefix:

BUILD_DIR=".evidence/template/build/_app/immutable"
for f in $(grep -rl '"/api/pagesManifest\|"/api/customFormattingSettings\|/api/${' "$BUILD_DIR"); do
  sed -i \
    's|"/api/pagesManifest\.json"|"/_evidence/pagesManifest.json"|g;
     s|"/api/customFormattingSettings\.json/GET\.json"|"/_evidence/customFormattingSettings.json/GET.json"|g;
     s|"/api/customFormattingSettings\.json"|"/_evidence/customFormattingSettings.json"|g;
     s|`/api/\${|`/_evidence/${|g;
     s|"/api/settings\.json"|"/_evidence/settings.json"|g' "$f"
done
mv .evidence/template/build/api .evidence/template/build/_evidence

This is fragile. It targets specific minified string literals and will break silently if the bundle output changes.

Suggested Fix

Make the bootstrap API base path configurable in evidence.config.yaml:

# Before (hardcoded)
# /api/pagesManifest.json

# After (configurable)
deployment:
  apiBasePath: "/_evidence"  # default: "/api"

Or simply rename the internal bootstrap path from /api/ to /__evidence/ by default — this prefix is unlikely to conflict with any hosting platform's reserved namespaces.

Steps to Reproduce

1. Deploy Evidence to Azure Static Web Apps (works fine)
2. Add any Azure Function alongside it by setting api_location in the SWA deploy action
3. Redeploy - Evidence's bootstrap endpoints now fail and the SPA is broken

Note: this is also permanent once triggered. Deploying with api_location registers Functions against the SWA resource. Removing api_location in a subsequent deploy does not deregister them — Azure continues routing /api/* to the Functions runtime.

Logs

System Info

Evidence version: 40.1.6
Deployment target: Azure Static Web Apps
Node: 20

Severity

serious, but I can work around it

Additional Information, or Workarounds

Azure SWA is a common deployment target given Evidence's positioning as a lightweight BI tool. The /api/ reservation is documented by Microsoft but easy to run into unexpectedly when extending a working deployment.