fix(server-root): skip landing-page seeding in --public mode (#578) - #579
Merged
Conversation
--public bypasses WAC, so the seeded /.acl and /index.html.acl are never consulted, and the page's HEAD-adaptive Sign up/Sign in (#435) is meaningless without auth. Seeding also wrote three files into the served directory for the serve-a-directory use case --public was created for (#107, servejss), regressing its 'like npx serve' behaviour. Skip seedServerRoot when options.public is set, alongside the existing read-only skip. Operators can still hand-create /index.html (skip-if-exists honours it).
There was a problem hiding this comment.
Pull request overview
This pull request fixes --public mode behavior by preventing the server-root landing page seeding logic from writing index.html and ACL files into the served directory, aligning --public with its “serve a directory without mutating it” use case.
Changes:
- Skip the
seedServerRootonReadyhook whenoptions.publicis enabled (in addition to the existingreadOnlyskip). - Add regression tests ensuring public mode does not seed
/index.html,/.acl, or/index.html.acl. - Add a public-mode test asserting
GET /returns a container listing and existing files remain readable.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
src/server.js |
Gates server-root landing page seeding on !options.public to avoid mutating the served tree in public mode. |
test/server-root.test.js |
Adds a dedicated suite verifying public mode skips seeding and still serves container listings and files. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
melvincarvalho
added a commit
that referenced
this pull request
Jul 2, 2026
Changes since 0.0.210: - fix(nostr): reconcile JWK key path to accept both Y-parities (#571) (#577) - fix(server-root): skip landing-page seeding in --public mode — --public no longer writes /index.html, /.acl, /index.html.acl into the served directory, restoring serve-like behaviour for servejss (#578) (#579)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #578.
Problem
Since #433/#435, startup seeds
/index.html,/.acl, and/index.html.aclinto DATA_ROOT — including in--publicmode, where WAC is bypassed (the seeded ACLs are never consulted) and the page's HEAD-adaptive Sign up / Sign in is meaningless without auth. For the serve-a-directory use case--publicwas created for (#107, the servejss foundation), this wrote three files into the user's project directory, regressing servejss's "likenpx serve" behaviour.Fix
Gate the
seedServerRootonReady hook on!options.public, alongside the existing read-only skip. Operators who want a landing page in public mode can still hand-create/index.html— skip-if-exists already honours it. Non-public modes are unchanged.Tests
New suite in
test/server-root.test.js:/index.html,/.acl,/index.html.aclinto the served treeGET /serves the container listing and existing files remain readableVerified end-to-end with
jss start --root <dir> --public: served directory stays untouched, PUT still works. Full suite: 991 pass / 0 fail.