approvals-viewer: serve public/ static assets so /nav-agent/* resolves (was 404)

528c44e0fa518ea89b2587fa454a49c210caa858 · 2026-08-13 11:52:48 -0700 · Steve Abrams

Raw Node http server had no static route; nav-agent.js/.css 404'd. Added a
path-traversal-guarded static handler for public/ before the 404 fallback.
Additive + reversible; asset stays behind Basic auth.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 528c44e0fa518ea89b2587fa454a49c210caa858
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Aug 13 11:52:48 2026 -0700

    approvals-viewer: serve public/ static assets so /nav-agent/* resolves (was 404)
    
    Raw Node http server had no static route; nav-agent.js/.css 404'd. Added a
    path-traversal-guarded static handler for public/ before the 404 fallback.
    Additive + reversible; asset stays behind Basic auth.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index 440a109..9151547 100644
--- a/server.js
+++ b/server.js
@@ -41,5 +41,10 @@ http.createServer((req,res)=>{
    if(fs.existsSync(src))fs.renameSync(src,path.join(QUEUE,file));
    fs.appendFileSync(LOG,JSON.stringify({ts:new Date().toISOString(),file,decision:'undo:'+decision})+'\n');send(res,200,'{"ok":true}');
  }catch(e){send(res,400,JSON.stringify({error:String(e.message)}));}});return;}
+ // static assets under public/ (e.g. /nav-agent/nav-agent.js|css) — additive, path-traversal-guarded
+ {const MIME={'.js':'text/javascript','.css':'text/css','.html':'text/html','.json':'application/json','.png':'image/png','.jpg':'image/jpeg','.svg':'image/svg+xml','.ico':'image/x-icon','.woff2':'font/woff2'};
+  const pub=path.join(__dirname,'public'),urlPath=decodeURIComponent(req.url.split('?')[0]),fp=path.normalize(path.join(pub,urlPath));
+  if(fp.startsWith(pub+path.sep)&&fs.existsSync(fp)&&fs.statSync(fp).isFile())
+    return send(res,200,fs.readFileSync(fp),MIME[path.extname(fp).toLowerCase()]||'application/octet-stream');}
  send(res,404,'nf','text/plain');
 }).listen(process.env.PORT||9795,'127.0.0.1',function(){const port=this.address().port;fs.writeFileSync(path.join(__dirname,'.port'),String(port));console.log('approvals-viewer http://127.0.0.1:'+port+' (admin/DW2024!)');});

← af6b411 nav-agent: universal grid-controls drop-in on internal dashb · back to Approvals Viewer · approvals-viewer: add star ratings (1-5) + sort-by-rating/ca 69d3d3a →