safe-global / safe-events-service / 26814527636 / 1

87%

main: 87%

push

github

fix: serve AdminJS static assets under pnpm (PLA-1573) (#526)

* fix: serve AdminJS static assets under pnpm (PLA-1573)

AdminJS's express adapter serves its frontend bundles with
res.sendFile(path.resolve(asset.src)) and no options. Under pnpm these
live in node_modules/.pnpm/..., and the ".pnpm" dotfile segment trips
Express 5 / send's default `dotfiles: 'ignore'`, turning every asset
into a spurious 404 — the admin login page rendered blank and flooded
the logs with NotFoundError.

Patch res.sendFile on the admin layer to force `dotfiles: 'allow'` for
AdminJS's (fixed, package-internal) asset paths. Runs unconditionally,
unlike the proxy-prefix rewrites which are gated on x-forwarded-prefix.

* refactor: simplify AdminJS response patching (PLA-1573)

Two non-behavioral cleanups on top of the dotfile fix:

- Collapse patchAdminAssetDotfiles to the single sendFile(path) shape
  that @adminjs/express actually uses, dropping the defensive handling
  of call shapes it never produces.
- Consolidate the three admin response patches behind one
  patchAdminResponse(req, res): Location-header rewriting (extracted
  from ReverseProxyMiddleware as the reusable patchLocationHeader),
  body rewriting, and the sendFile dotfile fix. main.ts now wraps the
  admin layer with a single call instead of nesting an ad-hoc
  ReverseProxyMiddleware instance, and installAdminProxyBodyRewrite is
  renamed installAdminResponsePatch to match.

The per-request x-forwarded-prefix rewriting is unchanged (the prefix
is dynamic per request, so it must stay).

106 of 277 branches covered (38.27%)

Branch coverage included in aggregate %.

850 of 1312 relevant lines covered (64.79%)

1.81 hits per line