/** * @file send-file.js * @description `res.sendFile` / `res.download` for an absolute path the server * chose itself, with Express 4's dotfile rule. Express 5 (send 1.x) refuses * with 404 any absolute path that has a dot-segment ANYWHERE — `~/.claude/…` * (the plugin cache, the default data dir), `~/.local/…` — where Express 4 * looked only at the file's own name. Sending the basename against its * directory as `root` makes send check that name alone again, so a dotfile is * still refused and a dotted parent directory is not. * @author Nguyễn Ngọc Trí Vĩ */ const path = require("path"); /** `res.sendFile(abs, opts, cb)` with only the basename subject to `dotfiles`. */ function sendFile(res, abs, opts, cb) { if (typeof opts === "function") [cb, opts] = [opts, undefined]; return res.sendFile(path.basename(abs), { ...opts, root: path.dirname(abs) }, cb); } /** `res.download(abs, name)` with only the basename subject to `dotfiles`. */ function download(res, abs, name, cb) { return res.download(path.basename(abs), name, { root: path.dirname(abs) }, cb); } module.exports = { sendFile, download };