server: fix facets total, add .bak 404-guard, clean-URL static routes

e17fe8c89687dd02d7e0af9d6c9f10796e957035 · 2026-05-19 08:05:49 -0700 · Steve

- /api/facets total now counts PRODUCTS_NICHE (the filtered list actually
  served), not the raw PRODUCTS array.
- Middleware 404-guards any .bak/.pre-/.orig path so snapshot files never
  serve from the static root.
- express.static gets extensions:['html'] so extension-less nav links
  (/care, /history, /trade, /sourcing) resolve instead of 404ing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit e17fe8c89687dd02d7e0af9d6c9f10796e957035
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 19 08:05:49 2026 -0700

    server: fix facets total, add .bak 404-guard, clean-URL static routes
    
    - /api/facets total now counts PRODUCTS_NICHE (the filtered list actually
      served), not the raw PRODUCTS array.
    - Middleware 404-guards any .bak/.pre-/.orig path so snapshot files never
      serve from the static root.
    - express.static gets extensions:['html'] so extension-less nav links
      (/care, /history, /trade, /sourcing) resolve instead of 404ing.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 00c0fb3..4730920 100644
--- a/server.js
+++ b/server.js
@@ -134,7 +134,15 @@ app.use(express.json({ limit: "256kb" }));
 const cfg = require('../_shared/site-config').load(__dirname);
 require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
-app.use(express.static(path.join(__dirname, 'public')));
+// Guard: never serve snapshot/backup files from the static root.
+app.use((req, res, next) => {
+  if (/\.(bak|pre-[\w-]*|orig)(\.|$)|\.bak$|\.pre-/i.test(req.path)) {
+    return res.status(404).send('Not found');
+  }
+  next();
+});
+// extensions:['html'] gives clean URLs — /care -> care.html, /history -> history.html, etc.
+app.use(express.static(path.join(__dirname, 'public'), { extensions: ['html'] }));
 
 app.get('/api/products', (req, res) => {
   const { q, aesthetic, vendor, page = 1, limit = 24, sort = 'newest'} = req.query;
@@ -170,7 +178,7 @@ app.get('/api/facets', (req, res) => {
     aesthetics[p.aesthetic] = (aesthetics[p.aesthetic] || 0) + 1;
     vendors[p.vendor] = (vendors[p.vendor] || 0) + 1;
   }
-  res.json({ aesthetics, vendors, total: PRODUCTS.length });
+  res.json({ aesthetics, vendors, total: PRODUCTS_NICHE.length });
 });
 
 app.get('/api/health', (req, res) => res.json({ status: 'ok', count: PRODUCTS_NICHE.length, dropped: DROPPED }));

← b844bf1 chore: untrack .bak/.pre- snapshots, broaden .gitignore · back to Madagascarwallpaper · index: wire sort select to API, hydrate saved sort before fi dd75db7 →