`server.js`

41 lines
/**
 * wallpaperdistributors.com — thin trade bridge.
 *
 * DTD verdict B + Steve 2026-05-31: do NOT run the standalone distributor
 * directory (its content was vendor-brand names = a hard violation of the
 * "never DW vendors in public UI" rule). Instead this is a thin, vendor-free
 * DW-branded trade lander that routes qualified buyers into the Designer
 * Wallcoverings trade program. The legacy directory build is preserved under
 * _legacy-directory/ (NOT served, NOT deployed).
 */
const express = require('express');
const helmet = require('helmet');
const path = require('path');

const PORT = process.env.PORT || 9932;
const SITE = 'wallpaperdistributors';

const app = express();
app.use(helmet({ contentSecurityPolicy: false }));

app.use((req, res, next) => {
  res.setHeader('Cache-Control', 'no-store, must-revalidate');
  next();
});

// 404-guard: never serve snapshot/backup files from the static root.
app.use((req, res, next) => {
  if (/\.(bak|orig|swp|tmp)$|\.bak\.|\.pre-/i.test(req.path)) {
    return res.status(404).send('Not found');
  }
  next();
});

app.use(express.static(path.join(__dirname, 'public'), { extensions: ['html'] }));

app.get('/healthz', (_req, res) => res.json({ ok: true, site: SITE, port: PORT }));

app.listen(PORT, '0.0.0.0', () => {
  console.log(`[${SITE}] thin trade bridge listening on :${PORT}`);
});