fix(server): register SPA catch-all last so /api GET routes are reachable

The static/SPA fallback (app.get('*')) was registered before the Caddy
routes, so every GET /api/caddy/* request was swallowed by the catch-all and
returned index.html instead of JSON. POST/PUT/DELETE still worked because
app.get('*') only matches GET — which is why adding routes worked but the
list was always empty. Move the static block to just before app.listen, and
add Cache-Control: no-store on /api so stale HTML can't be served via 304.
This commit is contained in:
Brückner
2026-06-08 14:37:33 +02:00
parent d429b2d252
commit 6f621067b9

View File

@ -160,6 +160,13 @@ async function startServer() {
app.use(express.json());
// API responses must never be cached by the browser — otherwise a stale
// (or HTML fallback) response can get served from cache via a 304.
app.use('/api', (_req, res, next) => {
res.set('Cache-Control', 'no-store');
next();
});
// -------------------------------------------------------------
// AUTH API
// -------------------------------------------------------------
@ -871,23 +878,6 @@ async function startServer() {
}
);
// -------------------------------------------------------------
// VITE / STATIC SERVING
// -------------------------------------------------------------
if (process.env.NODE_ENV !== 'production') {
const vite = await createViteServer({
server: { middlewareMode: true },
appType: 'spa',
});
app.use(vite.middlewares);
} else {
const distPath = path.join(process.cwd(), 'dist');
app.use(express.static(distPath));
app.get('*', (_req, res) => {
res.sendFile(path.join(distPath, 'index.html'));
});
}
// -------------------------------------------------------------
// CYCLIC CHECKMK STATUS SYNC
// Looks up each device by IP address in CheckMK's host_config collection,
@ -1244,6 +1234,24 @@ async function startServer() {
pushCaddyConfig().catch(err => console.warn('[Caddy] Could not push config on startup:', err.message));
// -------------------------------------------------------------
// VITE / STATIC SERVING — registered LAST so the SPA catch-all ('*')
// never shadows the /api routes registered above it.
// -------------------------------------------------------------
if (process.env.NODE_ENV !== 'production') {
const vite = await createViteServer({
server: { middlewareMode: true },
appType: 'spa',
});
app.use(vite.middlewares);
} else {
const distPath = path.join(process.cwd(), 'dist');
app.use(express.static(distPath));
app.get('*', (_req, res) => {
res.sendFile(path.join(distPath, 'index.html'));
});
}
app.listen(PORT, '0.0.0.0', () => {
console.log(`[Server] Core Server running at http://0.0.0.0:${PORT}`);
});