Merge pull request 'Fix error codes for missing static files' (#7850) from shibao/pleroma:static-fix into develop

Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/7850
Reviewed-by: Phantasm <phnt@noreply.git.pleroma.social>

changelog.d/missing-static-file.fix

@@ -0,0 +1 @@
+Fix 404 error codes for missing static files

lib/pleroma/web/plugs/instance_static.ex

@@ -4,7 +4,7 @@
 
 defmodule Pleroma.Web.Plugs.InstanceStatic do
   require Pleroma.Constants
-  import Plug.Conn, only: [put_resp_header: 3]
+  import Plug.Conn, only: [put_resp_header: 3, put_status: 2, send_resp: 3, halt: 1]
 
   @moduledoc """
   This is a shim to call `Plug.Static` but with runtime `from` configuration.
@@ -51,10 +51,37 @@ defmodule Pleroma.Web.Plugs.InstanceStatic do
       |> Map.put(:from, from)
       |> Map.put(:content_types, false)
 
-    conn = set_content_type(conn, conn.request_path)
+    conn =
+      conn
+      |> set_content_type(conn.request_path)
+      |> Plug.Static.call(opts)
 
-    # Call Plug.Static with our sanitized content-type
-    Plug.Static.call(conn, opts)
+    if conn.halted do
+      conn
+    else
+      path = String.trim_leading(conn.request_path, "/")
+
+      if not File.exists?(file_path(path)) do
+        conn
+        |> put_status(:not_found)
+        |> send_404()
+        |> halt()
+      else
+        conn
+      end
+    end
+  end
+
+  defp send_404(conn) do
+    if String.ends_with?(String.downcase(conn.request_path), ".json") do
+      conn
+      |> put_resp_header("content-type", "application/json")
+      |> send_resp(404, Jason.encode!(%{error: "not found"}))
+    else
+      conn
+      |> put_resp_header("content-type", "text/plain")
+      |> send_resp(404, "Not found")
+    end
   end
 
   defp set_content_type(conn, "/emoji/" <> filepath) do

test/pleroma/web/plugs/instance_static_test.exs

@@ -137,4 +137,47 @@ defmodule Pleroma.Web.Plugs.InstanceStaticTest do
     # It should be preserved because "image" is in the allowed_mime_types list
     assert content_type == "image/jpeg"
   end
+
+  describe "404s for missing files in static-only paths" do
+    test "returns 404 for non-existent static-only JSON files" do
+      conn = get(build_conn(), "/static/non-existent.json")
+
+      assert conn.status == 404
+      assert ["application/json"] = get_resp_header(conn, "content-type")
+      assert Jason.decode!(conn.resp_body) == %{"error" => "not found"}
+    end
+
+    test "returns 404 for non-existent static-only non-JSON files" do
+      conn = get(build_conn(), "/static/non-existent.txt")
+
+      assert conn.status == 404
+      assert conn.resp_body == "Not found"
+      assert ["text/plain"] = get_resp_header(conn, "content-type")
+    end
+
+    test "returns 404 for non-existent .css files" do
+      conn = get(build_conn(), "/static/non-existent.css")
+
+      assert conn.status == 404
+      assert conn.resp_body == "Not found"
+      # Verifies that we forced text/plain for the error body, even though the path was .css
+      assert ["text/plain"] = get_resp_header(conn, "content-type")
+    end
+
+    test "returns 404 for non-existent files without an extension" do
+      conn = get(build_conn(), "/static/non-existent")
+
+      assert conn.status == 404
+      assert conn.resp_body == "Not found"
+      assert ["text/plain"] = get_resp_header(conn, "content-type")
+    end
+
+    test "returns 200 (falls through to SPA) for non-static-only paths" do
+      # /some-route is NOT in static_only_files, so it should still fall through to the SPA.
+      conn = get(build_conn(), "/some-route")
+
+      assert conn.status == 200
+      assert ["text/html; charset=utf-8"] = get_resp_header(conn, "content-type")
+    end
+  end
 end