"""Serves the built React SPA.

With hash-based routing, client-side routes never reach the server
(e.g. /#/boards/123 arrives as GET /). The only paths ever requested are:

  1. "/"          -> the SPA entry point (index.html)
  2. "/<static>"  -> real files in the built static/ folder (JS, CSS, icons)

Everything else is a scanner probe (e.g. /.env, /cgi-bin/status,
/xmlrpc.php) and correctly gets 404. There is deliberately NO catch-all
that returns index.html for arbitrary paths.
"""

import os

from flask import Blueprint, abort
from flask import current_app as app
from flask import send_from_directory

home_bp = Blueprint("home", __name__)


@home_bp.route("/")
def serve_root():
    return send_from_directory(app.static_folder, "index.html")


@home_bp.route("/<path:path>")
def serve_static(path):
    if os.path.exists(os.path.join(app.static_folder, path)):
        return send_from_directory(app.static_folder, path)
    return abort(404)