🐛 fix(ui): avoid throttling static assets with the spa fallback limiter

Author: s-b-e-n-s-o-n

app/api/ui.test.ts

@@ -12,6 +12,10 @@ vi.mock('express', () => ({
   },
 }));
 
+vi.mock('express-rate-limit', () => ({
+  default: vi.fn(() => 'rate-limit-middleware'),
+}));
+
 vi.mock('../runtime/paths', () => ({
   resolveUiDirectory: vi.fn(() => '/app/ui'),
 }));
@@ -27,12 +31,27 @@ describe('UI Router', () => {
     const router = uiRouter.init();
     expect(router).toBeDefined();
     expect(router.use).toHaveBeenCalledWith('static-middleware');
-    expect(router.get).toHaveBeenCalledWith('/{*path}', expect.any(Function));
+    expect(router.get).toHaveBeenCalledWith(
+      '/{*path}',
+      'rate-limit-middleware',
+      expect.any(Function),
+    );
+  });
+
+  test('should apply rate limiting only to SPA document fallback requests', () => {
+    uiRouter.init();
+
+    expect(mockRouter.use).not.toHaveBeenCalledWith('rate-limit-middleware');
+    expect(mockRouter.get).toHaveBeenCalledWith(
+      '/{*path}',
+      'rate-limit-middleware',
+      expect.any(Function),
+    );
   });
 
   test('catch-all should send index.html', () => {
     uiRouter.init();
-    const catchAllHandler = mockRouter.get.mock.calls.find((c) => c[0] === '/{*path}')[1];
+    const catchAllHandler = mockRouter.get.mock.calls.find((c) => c[0] === '/{*path}')[2];
 
     const res = { sendFile: vi.fn() };
     catchAllHandler({}, res);

app/api/ui.ts

@@ -17,12 +17,11 @@ export function init() {
     legacyHeaders: false,
     validate: { xForwardedForHeader: false },
   });
-  router.use(uiLimiter);
   router.use(express.static(uiDirectory));
 
   // Redirect all 404 to index.html (for vue history mode)
   const indexFile = path.resolve(path.join(uiDirectory, 'index.html'));
-  router.get('/{*path}', (req, res) => {
+  router.get('/{*path}', uiLimiter, (req, res) => {
     res.sendFile(indexFile);
   });
   return router;