marketing.dw: expose /collections/<slug> pages + assets publicly (Graduate go-live)

6426992057a4f8a5ab6da410b6460cedf84c3979 · 2026-07-30 10:23:56 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 6426992057a4f8a5ab6da410b6460cedf84c3979
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 30 10:23:56 2026 -0700

    marketing.dw: expose /collections/<slug> pages + assets publicly (Graduate go-live)
---
 server.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/server.js b/server.js
index a3b0b0a..0ce6146 100644
--- a/server.js
+++ b/server.js
@@ -111,9 +111,10 @@ async function serveFile(fp, req, res) {
 // Finished reel MP4s are marketing assets meant to be posted publicly, and Meta/TikTok
 // must be able to fetch them — so GET /reels/*.mp4 is the ONE unauthenticated path.
 // Everything else (console, APIs, data) stays Basic-Auth gated.
-const PUBLIC_MEDIA = /^\/reels\/[^/]+\.mp4$/;
-// Public legal pages must be readable without auth (Meta app review fetches them).
-const PUBLIC_PAGES = /^\/(privacy|terms|showcase)$/;
+// Reel MP4s + published collection-page assets (banner/poster) are public marketing media.
+const PUBLIC_MEDIA = /^\/reels\/[^/]+\.mp4$|^\/public\/collections\/[a-z0-9-]+\.(?:jpg|jpeg|png|webp)$/;
+// Public legal pages + published collection landing pages must be readable without auth.
+const PUBLIC_PAGES = /^\/(privacy|terms|showcase|collections\/[a-z0-9-]+)$/;
 const isPublicMedia = req => (req.method === 'GET' || req.method === 'HEAD') && (PUBLIC_MEDIA.test(new URL(req.url, 'http://localhost').pathname) || PUBLIC_PAGES.test(new URL(req.url, 'http://localhost').pathname));
 
 const server = http.createServer(async (req, res) => {

← fb34647 Graduate collection page: banner header to 50vh · back to Dw Marketing Reels · Graduate flipbook: settlement cleanup — regen from 23 clean fd0b2c0 →