feat(api): protect static assets endpoint from symlink traversal

[crenshaw-dev]

Taking advantage of new os.Root tool, building on ideas from here: #22932

[bunnyshell]

❌ Preview Environment deleted from Bunnyshell

Available commands (reply to this comment):

• 🚀 /bns:deploy to deploy the environment

[todaywasawesome]

Great addition, simple and focused.

[todaywasawesome]

I don't know why these tests failed, I'd try rerunning.

[crenshaw-dev]

Interesting, looks like fs.Root doesn't like it when the directory doesn't exist. I'll add code to check if it exists and then just log a warning if not (to match current behavior):

15:25:52                api-server | �[m{"level":"fatal","msg":"open /shared/app: no such file or directory","time":"2025-05-12T15:25:52Z"}

[codecov]

Codecov Report

❌ Patch coverage is 40.00000% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.08%. Comparing base (610523b) to head (ad5647f).
⚠️ Report is 470 commits behind head on master.

Files with missing lines	Patch %	Lines
server/server.go	40.00%	5 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #22936      +/-   ##
==========================================
+ Coverage   60.03%   60.08%   +0.05%     
==========================================
  Files         344      344              
  Lines       57781    57795      +14     
==========================================
+ Hits        34689    34729      +40     
+ Misses      20333    20316      -17     
+ Partials     2759     2750       -9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[crenshaw-dev]

That got it. :-)