fix: wire sort param through grid fetch, correct /api/facets total, block .bak/.pre- static paths

e621f105bdfd9d03acb793f4b83e9a04424cb884 · 2026-05-19 07:52:07 -0700 · Steve Abrams

- loadGridPage now sends state.sort so the sort <select> actually re-orders the API result
- /api/facets total counts PRODUCTS_NICHE (the filtered list served) not the raw PRODUCTS array
- new middleware 404s any .bak/.pre- path before express.static

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M public/index.html
M server.js

Diff

commit e621f105bdfd9d03acb793f4b83e9a04424cb884
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 07:52:07 2026 -0700

    fix: wire sort param through grid fetch, correct /api/facets total, block .bak/.pre- static paths
    
    - loadGridPage now sends state.sort so the sort <select> actually re-orders the API result
    - /api/facets total counts PRODUCTS_NICHE (the filtered list served) not the raw PRODUCTS array
    - new middleware 404s any .bak/.pre- path before express.static
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 public/index.html | 1 +
 server.js         | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/public/index.html b/public/index.html
index d6f0a60..9426265 100644
--- a/public/index.html
+++ b/public/index.html
@@ -540,6 +540,7 @@ async function loadGridPage() {
   const params = new URLSearchParams({ page:state.page, limit:24 });
   if (state.q) params.set('q', state.q);
   if (state.facet !== 'all') params.set('aesthetic', state.facet);
+  if (state.sort) params.set('sort', state.sort);
   let data;
   try {
     const r = await fetch('/api/products?' + params);
diff --git a/server.js b/server.js
index ddeed8f..c55db50 100644
--- a/server.js
+++ b/server.js
@@ -138,6 +138,12 @@ app.use(express.json({ limit: '256kb' }));
 require('./_universal-contact')(app, { siteName: "Fabric Wallpaper", zdColor: "#b89060", zdPosition: 'right' });
 require('./_universal-auth')(app, { siteName: "fabricwallpaper" });
 
+// Never serve snapshot/backup files from the static root.
+app.use((req, res, next) => {
+  if (/(\.bak(\.|$)|\.pre-)/i.test(req.path)) return res.status(404).send('Not found');
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public')));
 
 app.get('/api/products', (req, res) => {
@@ -174,7 +180,7 @@ app.get('/api/facets', (req, res) => {
     aesthetics[p.aesthetic] = (aesthetics[p.aesthetic] || 0) + 1;
     vendors[p.vendor] = (vendors[p.vendor] || 0) + 1;
   }
-  res.json({ aesthetics, vendors, total: PRODUCTS.length });
+  res.json({ aesthetics, vendors, total: PRODUCTS_NICHE.length });
 });
 
 app.get('/api/health', (req, res) => res.json({ status: 'ok', count: PRODUCTS_NICHE.length, dropped: DROPPED }));

← ac4a8cb hero-4grid: relocate json from data/ to public/ for Express · back to Fabricwallpaper · chore: untrack snapshot .bak/.pre- files, broaden .gitignore 5a9dfc6 →