fix(routing): enforce slashless public URLs

www/tools/phase10-release-rehearsal.mjs

@@ -23,9 +23,15 @@ await fs.symlink(releaseA, current);
 const contentTypes = { '.html': 'text/html', '.xml': 'application/xml', '.txt': 'text/plain', '.css': 'text/css', '.js': 'text/javascript', '.svg': 'image/svg+xml', '.webp': 'image/webp', '.png': 'image/png', '.jpg': 'image/jpeg', '.woff2': 'font/woff2' };
 const server = http.createServer(async (request, response) => {
   try {
-    const pathname = decodeURIComponent(new URL(request.url ?? '/', 'http://127.0.0.1').pathname);
-    const clean = pathname.replace(/^\/+/, '');
-    const candidates = [clean, clean.endsWith('/') ? `${clean}index.html` : `${clean}/index.html`, clean === '' ? 'index.html' : null].filter(Boolean);
+    const requestUrl = new URL(request.url ?? '/', 'http://127.0.0.1');
+    const pathname = requestUrl.pathname;
+    if (pathname !== '/' && /\/+$/u.test(pathname)) {
+      response.writeHead(308, { location: `${pathname.replace(/\/+$/u, '')}${requestUrl.search}`, 'cache-control': 'no-store' });
+      response.end();
+      return;
+    }
+    const clean = decodeURIComponent(pathname).replace(/^\/+/, '');
+    const candidates = [clean, clean === '' ? 'index.html' : `${clean}/index.html`, clean === '' ? null : `${clean}.html`].filter(Boolean);
     let target;
     for (const candidate of candidates) {
       const candidatePath = path.resolve(current, candidate);
@@ -41,7 +47,7 @@ await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
 const address = server.address();
 const origin = `http://127.0.0.1:${address.port}`;
 const request = (pathname) => new Promise((resolve, reject) => {
-  const req = http.get(origin + pathname, (res) => { const chunks = []; res.on('data', (chunk) => chunks.push(chunk)); res.on('end', () => resolve({ status: res.statusCode, type: res.headers['content-type'], cache: res.headers['cache-control'], body: Buffer.concat(chunks).toString('utf8') })); });
+  const req = http.get(origin + pathname, (res) => { const chunks = []; res.on('data', (chunk) => chunks.push(chunk)); res.on('end', () => resolve({ status: res.statusCode, type: res.headers['content-type'], cache: res.headers['cache-control'], location: res.headers.location, body: Buffer.concat(chunks).toString('utf8') })); });
   req.on('error', reject);
 });
 const checks = [];
@@ -49,7 +55,20 @@ const check = async (name, fn) => { await fn(); checks.push(name); };
 await check('staging artifact verifier', async () => assert.equal((await verifyArtifact(releaseA, 'staging')).passed, true));
 await check('root route', async () => assert.equal((await request('/')).status, 200));
 await check('locale route', async () => assert.equal((await request('/es')).status, 200));
-await check('slashless and trailing-slash routes', async () => { assert.equal((await request('/library')).status, 200); assert.equal((await request('/library/')).status, 200); });
+await check('slashless routes serve and trailing-slash variants redirect', async () => {
+  assert.equal((await request('/library')).status, 200);
+  const libraryTrailing = await request('/library/');
+  assert.equal(libraryTrailing.status, 308);
+  assert.equal(libraryTrailing.location, '/library');
+  const landingTrailing = await request('/lp/aba-therapy/');
+  assert.equal(landingTrailing.status, 308);
+  assert.equal(landingTrailing.location, '/lp/aba-therapy');
+});
+await check('trailing-slash redirects preserve query strings', async () => {
+  const response = await request('/search/?term=aba&lang=es');
+  assert.equal(response.status, 308);
+  assert.equal(response.location, '/search?term=aba&lang=es');
+});
 await check('query strings preserved by static serving', async () => assert.equal((await request('/search?term=aba&lang=es')).status, 200));
 await check('asset MIME type', async () => assert.match((await request('/assets/images/favicon.svg')).type, /image\/svg/));
 await check('robots and empty staging sitemap', async () => { const robots = await request('/robots.txt'); const sitemap = await request('/sitemap.xml'); assert.equal(robots.status, 200); assert.equal((sitemap.body.match(/<url>/g) ?? []).length, 0); });