harden static layer: ignore + 404-guard editor/refactor snapshot files

e7fededd1df6f2255a83d322e1d78e9a27aa6b6d · 2026-05-19 21:14:22 -0700 · Steve Abrams

Broadens .gitignore to cover *.bak / *.bak.* / *.pre-* / *.orig / *.rej /
*.swp / *~ so refactor-pass leftovers never land in the repo, and adds an
Express middleware ahead of express.static that 404s any request whose
path matches the same pattern. Defends against the case where one of those
files does end up in public/ — it still can't serve to the public.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit e7fededd1df6f2255a83d322e1d78e9a27aa6b6d
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:14:22 2026 -0700

    harden static layer: ignore + 404-guard editor/refactor snapshot files
    
    Broadens .gitignore to cover *.bak / *.bak.* / *.pre-* / *.orig / *.rej /
    *.swp / *~ so refactor-pass leftovers never land in the repo, and adds an
    Express middleware ahead of express.static that 404s any request whose
    path matches the same pattern. Defends against the case where one of those
    files does end up in public/ — it still can't serve to the public.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore | 9 +++++++++
 server.js  | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/.gitignore b/.gitignore
index 4a0b3ea..feff0b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,12 @@ tmp/
 dist/
 build/
 .next/
+
+# editor / refactor snapshot files — never commit
+*.bak
+*.bak.*
+*.pre-*
+*.orig
+*.rej
+*.swp
+*~
diff --git a/server.js b/server.js
index 593a29f..8c3ef49 100644
--- a/server.js
+++ b/server.js
@@ -28,6 +28,15 @@ fs.watchFile(DATA_FILE, { interval: 5000 }, () => loadEvents());
 app.set('view engine', 'ejs');
 app.set('views', path.join(__dirname, 'views'));
 app.use(compression());
+
+// Snapshot-file 404 guard — refactor/editor leftovers must never serve from
+// the static root even if one accidentally lands in public/.
+const SNAPSHOT_PATH_RE = /\.(bak|orig|rej|swp)(\..*)?$|\.pre-|~$/i;
+app.use((req, res, next) => {
+  if (SNAPSHOT_PATH_RE.test(req.path)) return res.status(404).end();
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public'), { maxAge: '1h' }));
 
 app.use((req, res, next) => {

← 4b9a7a9 polish: editorial-bold hero + Field Guide section (3-card 'H · back to Designtradelive · clean-URL routes: /about + /contact -> /#about anchor acd885d →