fix: add .bak/.pre-* 404 guard and correct /api/facets total

2bdb4aa10c3489092fe02d50a19388a9c68337c2 · 2026-05-19 15:22:48 -0700 · Steve Abrams

- Express middleware before express.static returns 404 for any path
  matching .bak / .bak.* / .pre-* so leftover local snapshots never
  serve from public/.
- /api/facets total now reflects PRODUCTS_NICHE (the filtered list
  served by /api/products) instead of the raw PRODUCTS array, so the
  footer/header counts match what users can actually see.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 2bdb4aa10c3489092fe02d50a19388a9c68337c2
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 15:22:48 2026 -0700

    fix: add .bak/.pre-* 404 guard and correct /api/facets total
    
    - Express middleware before express.static returns 404 for any path
      matching .bak / .bak.* / .pre-* so leftover local snapshots never
      serve from public/.
    - /api/facets total now reflects PRODUCTS_NICHE (the filtered list
      served by /api/products) instead of the raw PRODUCTS array, so the
      footer/header counts match what users can actually see.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 1abed6d..993043d 100644
--- a/server.js
+++ b/server.js
@@ -89,6 +89,13 @@ app.use(express.json({ limit: '256kb' }));
 require('./_universal-contact')(app, { siteName: "FFE Purchasing", zdColor: "#d4a847", zdPosition: 'right' });
 require('./_universal-auth')(app, { siteName: "ffepurchasing" });
 
+// 404-guard: never serve local snapshot files (.bak, .bak.*, .pre-*) even if
+// one accidentally lands in public/. Fires before express.static.
+app.use((req, res, next) => {
+  if (/\.(bak)(\.|$)|\.pre-/i.test(req.path)) return res.status(404).type('text/plain').send('Not found');
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public')));
 
 app.get('/api/products', (req, res) => {
@@ -124,7 +131,8 @@ app.get('/api/facets', (req, res) => {
     aesthetics[p.aesthetic] = (aesthetics[p.aesthetic] || 0) + 1;
     vendors[p.vendor] = (vendors[p.vendor] || 0) + 1;
   }
-  res.json({ aesthetics, vendors, total: PRODUCTS.length });
+  // total must match the niche-filtered list actually served, not the raw unfiltered array.
+  res.json({ aesthetics, vendors, total: PRODUCTS_NICHE.length });
 });
 
 app.get('/api/health', (req, res) => res.json({ status: 'ok', count: PRODUCTS_NICHE.length, dropped: DROPPED }));

← 8a7784b chore: untrack .bak/.pre-* snapshots and broaden .gitignore · back to Ffepurchasing · WIP: partial sort hydration from killed agent — finish in ne 084f9b5 →