StaticNotFoundPlug: Move 404 on non-existing static files to a new plug

This fixes preferred frontends not working (returning 404 on most static
frontend files).

lib/pleroma/web/endpoint.ex

@@ -139,6 +139,14 @@ defmodule Pleroma.Web.Endpoint do
     from: {:pleroma, "priv/static/adminfe/"}
   )
 
+  plug(Pleroma.Web.Plugs.StaticNotFoundPlug,
+    at: "/",
+    cache_control_for_etags: @static_cache_disabled,
+    headers: %{
+      "cache-control" => @static_cache_disabled
+    }
+  )
+
   # Code reloading can be explicitly enabled under the
   # :code_reloader configuration of your endpoint.
   if code_reloading? do

lib/pleroma/web/plugs/instance_static.ex

@@ -4,7 +4,7 @@
 
 defmodule Pleroma.Web.Plugs.InstanceStatic do
   require Pleroma.Constants
-  import Plug.Conn, only: [put_resp_header: 3, put_status: 2, send_resp: 3, halt: 1]
+  import Plug.Conn, only: [put_resp_header: 3]
 
   @moduledoc """
   This is a shim to call `Plug.Static` but with runtime `from` configuration.
@@ -51,37 +51,10 @@ defmodule Pleroma.Web.Plugs.InstanceStatic do
       |> Map.put(:from, from)
       |> Map.put(:content_types, false)
 
-    conn =
-      conn
-      |> set_content_type(conn.request_path)
-      |> Plug.Static.call(opts)
+    conn = set_content_type(conn, conn.request_path)
 
-    if conn.halted do
-      conn
-    else
-      path = String.trim_leading(conn.request_path, "/")
-
-      if not File.exists?(file_path(path)) do
-        conn
-        |> put_status(:not_found)
-        |> send_404()
-        |> halt()
-      else
-        conn
-      end
-    end
-  end
-
-  defp send_404(conn) do
-    if String.ends_with?(String.downcase(conn.request_path), ".json") do
-      conn
-      |> put_resp_header("content-type", "application/json")
-      |> send_resp(404, Jason.encode!(%{error: "not found"}))
-    else
-      conn
-      |> put_resp_header("content-type", "text/plain")
-      |> send_resp(404, "Not found")
-    end
+    # Call Plug.Static with our sanitized content-type
+    Plug.Static.call(conn, opts)
   end
 
   defp set_content_type(conn, "/emoji/" <> filepath) do

lib/pleroma/web/plugs/static_not_found_plug.ex

@@ -0,0 +1,38 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2026 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Plugs.StaticNotFoundPlug do
+  @moduledoc """
+  A small plug that enforces returning 404 on static files when they don't exist.
+  """
+  @behaviour Plug
+
+  require Pleroma.Constants
+  import Plug.Conn, only: [put_resp_header: 3, send_resp: 3, halt: 1]
+
+  def init(opts), do: opts
+
+  for only <- Pleroma.Constants.static_only_files() do
+    def call(%{request_path: "/" <> unquote(only) <> _} = conn, _opts) do
+      send_404(conn)
+    end
+  end
+
+  def call(conn, _) do
+    conn
+  end
+
+  defp send_404(conn) do
+    if String.ends_with?(String.downcase(conn.request_path), ".json") do
+      conn
+      |> put_resp_header("content-type", "application/json")
+      |> send_resp(404, Jason.encode!(%{error: "not found"}))
+    else
+      conn
+      |> put_resp_header("content-type", "text/plain")
+      |> send_resp(404, "Not found")
+    end
+    |> halt()
+  end
+end