order spa fallback

Author: Frooodle

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -5,22 +5,26 @@
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.List;
 import java.util.Set;
 import java.util.regex.Pattern;
 
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
+import org.springframework.core.Ordered;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.core.io.FileSystemResource;
 import org.springframework.core.io.Resource;
 import org.springframework.http.CacheControl;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
+import org.springframework.http.converter.StringHttpMessageConverter;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.servlet.function.RouterFunction;
 import org.springframework.web.servlet.function.RouterFunctions;
 import org.springframework.web.servlet.function.ServerResponse;
+import org.springframework.web.servlet.function.support.RouterFunctionMapping;
 import org.springframework.web.util.HtmlUtils;
 import org.springframework.web.util.JavaScriptUtils;
 
@@ -60,6 +64,10 @@ public class ReactRoutingController {
                     "og_images",
                     "samples");
 
+    // After the annotated controllers (order 0), before the resource chain
+    // (LOWEST_PRECEDENCE - 1).
+    private static final int SPA_FALLBACK_ORDER = Ordered.LOWEST_PRECEDENCE - 2;
+
     @Value("${server.servlet.context-path:/}")
     private String contextPath;
 
@@ -286,26 +294,40 @@ public ResponseEntity<String> forwardNestedPaths(HttpServletRequest request)
 
     // The regex mappings above only cover 1- and 2-segment paths (Spring path variables cannot
     // span '/'), so deep SPA links like /processor/pipelines/new 404d on direct navigation.
+    //
+    // Registered as its own mapping rather than exposed as a bare RouterFunction @Bean:
+    // Spring's own RouterFunctionMapping is ordered -1, ahead of the annotated controllers at
+    // order 0, so a plain bean would shadow every dot-free backend route the denylist below
+    // does not name (/v1/api-docs, /error, /actuator, ...). LOWEST_PRECEDENCE - 2 puts it after
+    // the controllers and before the resource chain (LOWEST_PRECEDENCE - 1), which is the only
+    // position where a catch-all fallback is safe.
     @Bean
-    public RouterFunction<ServerResponse> spaDeepLinkFallback() {
-        return RouterFunctions.route(
-                request -> {
-                    HttpServletRequest servletRequest = request.servletRequest();
-                    return "GET".equals(servletRequest.getMethod())
-                            && isSpaFallbackRoute(
-                                    stripContextPath(
-                                            servletRequest.getContextPath(),
-                                            servletRequest.getRequestURI()));
-                },
-                request ->
-                        ServerResponse.ok()
-                                .cacheControl(CacheControl.noCache().mustRevalidate())
-                                .contentType(MediaType.TEXT_HTML)
-                                .body(serveIndexHtml(request.servletRequest()).getBody()));
+    public RouterFunctionMapping spaDeepLinkFallbackMapping() {
+        RouterFunction<ServerResponse> fallback =
+                RouterFunctions.route(
+                        request -> {
+                            HttpServletRequest servletRequest = request.servletRequest();
+                            return "GET".equals(servletRequest.getMethod())
+                                    && isSpaFallbackRoute(
+                                            stripContextPath(
+                                                    servletRequest.getContextPath(),
+                                                    servletRequest.getRequestURI()));
+                        },
+                        request ->
+                                ServerResponse.ok()
+                                        .cacheControl(CacheControl.noCache().mustRevalidate())
+                                        .contentType(MediaType.TEXT_HTML)
+                                        .body(serveIndexHtml(request.servletRequest()).getBody()));
+        RouterFunctionMapping mapping = new RouterFunctionMapping(fallback);
+        mapping.setOrder(SPA_FALLBACK_ORDER);
+        mapping.setMessageConverters(
+                List.of(new StringHttpMessageConverter(StandardCharsets.UTF_8)));
+        return mapping;
     }
 
-    // Runs after annotated controllers but before the static-resource chain. Dot-free paths
-    // only, so requests for real files still fall through to the resource handlers.
+    // Dot-free paths only, so requests for real files still fall through to the resource
+    // handlers. This is a denylist, so it is only safe because the mapping above runs after
+    // the annotated controllers - see spaDeepLinkFallbackMapping.
     static boolean isSpaFallbackRoute(String path) {
         if (path == null || path.isEmpty() || "/".equals(path) || path.indexOf('.') >= 0) {
             return false;

app/core/src/test/java/stirling/software/SPDF/controller/web/ReactRoutingControllerTest.java

@@ -9,6 +9,7 @@
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.springframework.core.Ordered;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -19,6 +20,7 @@
 import org.springframework.web.servlet.function.RouterFunction;
 import org.springframework.web.servlet.function.ServerRequest;
 import org.springframework.web.servlet.function.ServerResponse;
+import org.springframework.web.servlet.function.support.RouterFunctionMapping;
 import org.springframework.web.util.ServletRequestPathUtils;
 
 import jakarta.servlet.http.HttpServletRequest;
@@ -213,7 +215,7 @@ void isSpaFallbackRoute_rejectsBackendStaticAndFilePaths() {
     @Test
     void spaDeepLinkFallback_servesIndexForDeepRoute() throws Exception {
         controller.init();
-        RouterFunction<ServerResponse> router = controller.spaDeepLinkFallback();
+        RouterFunction<ServerResponse> router = routerOf(controller.spaDeepLinkFallbackMapping());
 
         ServerRequest deepRequest = serverRequest("GET", "/processor/pipelines/new");
         Optional<HandlerFunction<ServerResponse>> handler = router.route(deepRequest);
@@ -229,13 +231,33 @@ void spaDeepLinkFallback_servesIndexForDeepRoute() throws Exception {
     @Test
     void spaDeepLinkFallback_ignoresApiFilesAndNonGet() {
         controller.init();
-        RouterFunction<ServerResponse> router = controller.spaDeepLinkFallback();
+        RouterFunction<ServerResponse> router = routerOf(controller.spaDeepLinkFallbackMapping());
 
         assertTrue(router.route(serverRequest("GET", "/api/v1/policies/run")).isEmpty());
         assertTrue(router.route(serverRequest("GET", "/branding/sub/logo.png")).isEmpty());
         assertTrue(router.route(serverRequest("POST", "/processor/pipelines/new")).isEmpty());
     }
 
+    @Test
+    void spaDeepLinkFallback_runsAfterControllersAndBeforeResources() {
+        controller.init();
+        int order = controller.spaDeepLinkFallbackMapping().getOrder();
+
+        // A catch-all denylist is only safe below every annotated controller; Spring's own
+        // RouterFunctionMapping sits at -1, which would shadow /v1/api-docs, /error and friends.
+        assertTrue(order > 0, "SPA fallback must run after annotated controllers");
+        assertTrue(
+                order < Ordered.LOWEST_PRECEDENCE - 1,
+                "SPA fallback must run before the static-resource chain");
+    }
+
+    private static RouterFunction<ServerResponse> routerOf(RouterFunctionMapping mapping) {
+        @SuppressWarnings("unchecked")
+        RouterFunction<ServerResponse> router =
+                (RouterFunction<ServerResponse>) mapping.getRouterFunction();
+        return router;
+    }
+
     private static ServerRequest serverRequest(String method, String uri) {
         MockHttpServletRequest servletRequest = new MockHttpServletRequest(method, uri);
         ServletRequestPathUtils.parseAndCache(servletRequest);