From a30298c1eb174858fd9aa8a5919e90349f35670c Mon Sep 17 00:00:00 2001
From: Phantasm <phantasm@centrum.cz>
Date: Wed, 20 May 2026 20:58:41 +0200
Subject: [PATCH] StaticNotFoundPlug: Move 404 on non-existing static files to
 a new plug

This fixes preferred frontends not working (returning 404 on most static
frontend files).
---
 changelog.d/fix-preferred-frontend.fix        |  1 +
 lib/pleroma/web/endpoint.ex                   |  8 ++++
 lib/pleroma/web/plugs/instance_static.ex      | 35 ++---------------
 .../web/plugs/static_not_found_plug.ex        | 38 +++++++++++++++++++
 4 files changed, 51 insertions(+), 31 deletions(-)
 create mode 100644 changelog.d/fix-preferred-frontend.fix
 create mode 100644 lib/pleroma/web/plugs/static_not_found_plug.ex

diff --git a/changelog.d/fix-preferred-frontend.fix b/changelog.d/fix-preferred-frontend.fix
new file mode 100644
index 000000000..07bf4d0c6
--- /dev/null
+++ b/changelog.d/fix-preferred-frontend.fix
@@ -0,0 +1 @@
+Fix preferred frontend not working due to InstanceStatic plug prematurely returning HTTP 404
diff --git a/lib/pleroma/web/endpoint.ex b/lib/pleroma/web/endpoint.ex
index 07b33f866..4582fd0fd 100644
--- a/lib/pleroma/web/endpoint.ex
+++ b/lib/pleroma/web/endpoint.ex
@@ -139,6 +139,14 @@ defmodule Pleroma.Web.Endpoint do
     from: {:pleroma, "priv/static/adminfe/"}
   )
 
+  plug(Pleroma.Web.Plugs.StaticNotFoundPlug,
+    at: "/",
+    cache_control_for_etags: @static_cache_disabled,
+    headers: %{
+      "cache-control" => @static_cache_disabled
+    }
+  )
+
   # Code reloading can be explicitly enabled under the
   # :code_reloader configuration of your endpoint.
   if code_reloading? do
diff --git a/lib/pleroma/web/plugs/instance_static.ex b/lib/pleroma/web/plugs/instance_static.ex
index 948188287..d2a674d39 100644
--- a/lib/pleroma/web/plugs/instance_static.ex
+++ b/lib/pleroma/web/plugs/instance_static.ex
@@ -4,7 +4,7 @@
 
 defmodule Pleroma.Web.Plugs.InstanceStatic do
   require Pleroma.Constants
-  import Plug.Conn, only: [put_resp_header: 3, put_status: 2, send_resp: 3, halt: 1]
+  import Plug.Conn, only: [put_resp_header: 3]
 
   @moduledoc """
   This is a shim to call `Plug.Static` but with runtime `from` configuration.
@@ -51,37 +51,10 @@ defmodule Pleroma.Web.Plugs.InstanceStatic do
       |> Map.put(:from, from)
       |> Map.put(:content_types, false)
 
-    conn =
-      conn
-      |> set_content_type(conn.request_path)
-      |> Plug.Static.call(opts)
+    conn = set_content_type(conn, conn.request_path)
 
-    if conn.halted do
-      conn
-    else
-      path = String.trim_leading(conn.request_path, "/")
-
-      if not File.exists?(file_path(path)) do
-        conn
-        |> put_status(:not_found)
-        |> send_404()
-        |> halt()
-      else
-        conn
-      end
-    end
-  end
-
-  defp send_404(conn) do
-    if String.ends_with?(String.downcase(conn.request_path), ".json") do
-      conn
-      |> put_resp_header("content-type", "application/json")
-      |> send_resp(404, Jason.encode!(%{error: "not found"}))
-    else
-      conn
-      |> put_resp_header("content-type", "text/plain")
-      |> send_resp(404, "Not found")
-    end
+    # Call Plug.Static with our sanitized content-type
+    Plug.Static.call(conn, opts)
   end
 
   defp set_content_type(conn, "/emoji/" <> filepath) do
diff --git a/lib/pleroma/web/plugs/static_not_found_plug.ex b/lib/pleroma/web/plugs/static_not_found_plug.ex
new file mode 100644
index 000000000..e2e7a622c
--- /dev/null
+++ b/lib/pleroma/web/plugs/static_not_found_plug.ex
@@ -0,0 +1,38 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2026 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Plugs.StaticNotFoundPlug do
+  @moduledoc """
+  A small plug that enforces returning 404 on static files when they don't exist.
+  """
+  @behaviour Plug
+
+  require Pleroma.Constants
+  import Plug.Conn, only: [put_resp_header: 3, send_resp: 3, halt: 1]
+
+  def init(opts), do: opts
+
+  for only <- Pleroma.Constants.static_only_files() do
+    def call(%{request_path: "/" <> unquote(only) <> _} = conn, _opts) do
+      send_404(conn)
+    end
+  end
+
+  def call(conn, _) do
+    conn
+  end
+
+  defp send_404(conn) do
+    if String.ends_with?(String.downcase(conn.request_path), ".json") do
+      conn
+      |> put_resp_header("content-type", "application/json")
+      |> send_resp(404, Jason.encode!(%{error: "not found"}))
+    else
+      conn
+      |> put_resp_header("content-type", "text/plain")
+      |> send_resp(404, "Not found")
+    end
+    |> halt()
+  end
+end