From 4e1ba489ec087b980e61ad705ab966953946ee90 Mon Sep 17 00:00:00 2001
From: shibao <shibao@shibao.dev>
Date: Sun, 8 Mar 2026 11:16:33 +0000
Subject: [PATCH 1/2] fix 404s for missing static files

---
 lib/pleroma/web/plugs/instance_static.ex      | 35 +++++++++++++--
 .../web/plugs/instance_static_test.exs        | 43 +++++++++++++++++++
 2 files changed, 74 insertions(+), 4 deletions(-)

diff --git a/lib/pleroma/web/plugs/instance_static.ex b/lib/pleroma/web/plugs/instance_static.ex
index d2a674d39..948188287 100644
--- a/lib/pleroma/web/plugs/instance_static.ex
+++ b/lib/pleroma/web/plugs/instance_static.ex
@@ -4,7 +4,7 @@
 
 defmodule Pleroma.Web.Plugs.InstanceStatic do
   require Pleroma.Constants
-  import Plug.Conn, only: [put_resp_header: 3]
+  import Plug.Conn, only: [put_resp_header: 3, put_status: 2, send_resp: 3, halt: 1]
 
   @moduledoc """
   This is a shim to call `Plug.Static` but with runtime `from` configuration.
@@ -51,10 +51,37 @@ defmodule Pleroma.Web.Plugs.InstanceStatic do
       |> Map.put(:from, from)
       |> Map.put(:content_types, false)
 
-    conn = set_content_type(conn, conn.request_path)
+    conn =
+      conn
+      |> set_content_type(conn.request_path)
+      |> Plug.Static.call(opts)
 
-    # Call Plug.Static with our sanitized content-type
-    Plug.Static.call(conn, opts)
+    if conn.halted do
+      conn
+    else
+      path = String.trim_leading(conn.request_path, "/")
+
+      if not File.exists?(file_path(path)) do
+        conn
+        |> put_status(:not_found)
+        |> send_404()
+        |> halt()
+      else
+        conn
+      end
+    end
+  end
+
+  defp send_404(conn) do
+    if String.ends_with?(String.downcase(conn.request_path), ".json") do
+      conn
+      |> put_resp_header("content-type", "application/json")
+      |> send_resp(404, Jason.encode!(%{error: "not found"}))
+    else
+      conn
+      |> put_resp_header("content-type", "text/plain")
+      |> send_resp(404, "Not found")
+    end
   end
 
   defp set_content_type(conn, "/emoji/" <> filepath) do
diff --git a/test/pleroma/web/plugs/instance_static_test.exs b/test/pleroma/web/plugs/instance_static_test.exs
index b5a5a3334..017c49d1e 100644
--- a/test/pleroma/web/plugs/instance_static_test.exs
+++ b/test/pleroma/web/plugs/instance_static_test.exs
@@ -137,4 +137,47 @@ defmodule Pleroma.Web.Plugs.InstanceStaticTest do
     # It should be preserved because "image" is in the allowed_mime_types list
     assert content_type == "image/jpeg"
   end
+
+  describe "404s for missing files in static-only paths" do
+    test "returns 404 for non-existent static-only JSON files" do
+      conn = get(build_conn(), "/static/non-existent.json")
+
+      assert conn.status == 404
+      assert ["application/json"] = get_resp_header(conn, "content-type")
+      assert Jason.decode!(conn.resp_body) == %{"error" => "not found"}
+    end
+
+    test "returns 404 for non-existent static-only non-JSON files" do
+      conn = get(build_conn(), "/static/non-existent.txt")
+
+      assert conn.status == 404
+      assert conn.resp_body == "Not found"
+      assert ["text/plain"] = get_resp_header(conn, "content-type")
+    end
+
+    test "returns 404 for non-existent .css files" do
+      conn = get(build_conn(), "/static/non-existent.css")
+
+      assert conn.status == 404
+      assert conn.resp_body == "Not found"
+      # Verifies that we forced text/plain for the error body, even though the path was .css
+      assert ["text/plain"] = get_resp_header(conn, "content-type")
+    end
+
+    test "returns 404 for non-existent files without an extension" do
+      conn = get(build_conn(), "/static/non-existent")
+
+      assert conn.status == 404
+      assert conn.resp_body == "Not found"
+      assert ["text/plain"] = get_resp_header(conn, "content-type")
+    end
+
+    test "returns 200 (falls through to SPA) for non-static-only paths" do
+      # /some-route is NOT in static_only_files, so it should still fall through to the SPA.
+      conn = get(build_conn(), "/some-route")
+
+      assert conn.status == 200
+      assert ["text/html; charset=utf-8"] = get_resp_header(conn, "content-type")
+    end
+  end
 end

From bceb28b9416c34e066c31d5bbf4dac4366aa98ff Mon Sep 17 00:00:00 2001
From: shibao <shibao@shibao.dev>
Date: Sun, 8 Mar 2026 11:19:14 +0000
Subject: [PATCH 2/2] add changelog note for missing static files fix

---
 changelog.d/missing-static-file.fix | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/missing-static-file.fix

diff --git a/changelog.d/missing-static-file.fix b/changelog.d/missing-static-file.fix
new file mode 100644
index 000000000..c7ef805aa
--- /dev/null
+++ b/changelog.d/missing-static-file.fix
@@ -0,0 +1 @@
+Fix 404 error codes for missing static files