harden static root: 404-guard .bak/.pre- paths + broaden gitignore

1eaaf46f0d263e10d72f12485d033dc20dd665be · 2026-05-19 17:25:26 -0700 · Steve Abrams

Fleet-refactor sweep tick — Express middleware drops any request whose
path contains .bak or .pre- with a hard 404 before express.static runs,
so accidentally-dropped snapshot files can never be served. .gitignore
now also covers *.bak.* and *.pre-* variants.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 1eaaf46f0d263e10d72f12485d033dc20dd665be
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 17:25:26 2026 -0700

    harden static root: 404-guard .bak/.pre- paths + broaden gitignore
    
    Fleet-refactor sweep tick — Express middleware drops any request whose
    path contains .bak or .pre- with a hard 404 before express.static runs,
    so accidentally-dropped snapshot files can never be served. .gitignore
    now also covers *.bak.* and *.pre-* variants.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore | 2 ++
 server.js  | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/.gitignore b/.gitignore
index 7e6a9c3..1140724 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,5 @@ dist/
 build/
 .next/
 *.bak
+*.bak.*
+*.pre-*
diff --git a/server.js b/server.js
index 382f4a1..a279605 100644
--- a/server.js
+++ b/server.js
@@ -14,6 +14,13 @@ const pool = new Pool({
 });
 
 app.use(express.json());
+
+// Hard 404 for snapshot / backup files so they never serve from the static root.
+app.use((req, res, next) => {
+  if (/\.(bak|pre-)/i.test(req.path)) return res.status(404).end();
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public')));
 
 // Basic auth

← 8453ee6 snapshot: 1 file(s) changed, ~1 modified · back to Vendor Discount Agent · security: strip hardcoded dw_admin DSN password -> env-first 73ea192 →