feat: add .bak/.pre- 404 guard + clean-URL routes for nav

2c79e2471ee95bf50f0b012d19d379d72465afe4 · 2026-05-25 20:51:05 -0700 · SteveStudio2

- Express middleware now returns 404 for any path matching *.bak,
  *.bak.*, or *.pre-* so untracked snapshot files in public/ (or
  accidentally tracked ones in the future) never serve.
- Adds clean-URL routes /care, /history, /vocabulary, /sourcing, /trade
  that sendFile the matching .html. Every interior nav already links
  to these extensionless paths but Express static was 404-ing them.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 2c79e2471ee95bf50f0b012d19d379d72465afe4
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Mon May 25 20:51:05 2026 -0700

    feat: add .bak/.pre- 404 guard + clean-URL routes for nav
    
    - Express middleware now returns 404 for any path matching *.bak,
      *.bak.*, or *.pre-* so untracked snapshot files in public/ (or
      accidentally tracked ones in the future) never serve.
    - Adds clean-URL routes /care, /history, /vocabulary, /sourcing, /trade
      that sendFile the matching .html. Every interior nav already links
      to these extensionless paths but Express static was 404-ing them.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/server.js b/server.js
index 48b11f6..207404b 100644
--- a/server.js
+++ b/server.js
@@ -156,6 +156,17 @@ try {
 }
 require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
+// Defense-in-depth: never serve snapshot files (*.bak, *.bak.*, *.pre-*) from
+// the static root even if one slips into public/ untracked.
+app.use((req, res, next) => {
+  if (/\.(bak)(\.|$)|\.pre-/.test(req.path)) return res.status(404).end();
+  next();
+});
+// Clean-URL routes for extension-less nav links used across interior pages.
+const CLEAN_URLS = ['care', 'history', 'sourcing', 'trade', 'vocabulary'];
+for (const slug of CLEAN_URLS) {
+  app.get('/' + slug, (req, res) => res.sendFile(path.join(__dirname, 'public', slug + '.html')));
+}
 app.use(express.static(path.join(__dirname, 'public')));
 
 app.get('/api/products', (req, res) => {

← 5a7d21b fix: /api/facets total now reflects niche-filtered list serv · back to Architecturalwallcoverings · chore: add noreferrer to Facebook external link d70c8be →