smoke: 6 snapshot-path 404-guard checks (.bak / .bak.N / .pre- / .orig / .rej / ~)

c5fae609886d52db1e4cec7fd99133046a3275bd · 2026-05-19 17:31:43 -0700 · SteveStudio2

Guard middleware lives in server.js and runs before express.static. Until now
no smoke check covered it, so a regression that disabled the guard would have
shipped silently. 158 checks pass against a live server on :9700.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M test/smoke.js

Diff

commit c5fae609886d52db1e4cec7fd99133046a3275bd
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 17:31:43 2026 -0700

    smoke: 6 snapshot-path 404-guard checks (.bak / .bak.N / .pre- / .orig / .rej / ~)
    
    Guard middleware lives in server.js and runs before express.static. Until now
    no smoke check covered it, so a regression that disabled the guard would have
    shipped silently. 158 checks pass against a live server on :9700.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 test/smoke.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/test/smoke.js b/test/smoke.js
index b60baaa..c31f3c7 100644
--- a/test/smoke.js
+++ b/test/smoke.js
@@ -300,6 +300,14 @@ function check(name, cond, hint = '') {
     check(`facet ${facet}: field`,  new RegExp(`"${facet}":`).test(r.body));
   }
 
+  // 13d. snapshot-path 404 guard — *.bak / *.bak.N / *.pre-* / *.orig / *.rej / ~
+  // Editor backups must never serve from any public mount. The guard runs before
+  // express.static and returns 404 with empty body so probes don't learn the path.
+  for (const p of ['/css/site.css.bak', '/css/site.css.bak.1', '/css/site.css.pre-refactor', '/css/site.css.orig', '/css/site.css.rej', '/css/site.css~']) {
+    r = await fetch(p);
+    check(`snapshot-guard ${p}: 404`, r.status === 404);
+  }
+
   // 14. cross-project search (round-robin merge + per-project breakdown + ?since=)
   r = await fetch('/api/search?q=whisper&limit=10');
   check('search: 200',             r.status === 200);

← 07bd1a8 server: 404-guard for *.bak / *.pre-* snapshot paths before · back to build-pages · Add per-site favicon (kills /favicon.ico 404) ff6ee37 →