fix: start server when rest_api is enabled and gate static file servi… (#801)

* fix: start server when rest_api is enabled and gate static file serving behind serve flag

* Rename WebServer serve flag, restore rate-limit ordering, log startup mode

- IWebServerConfig.serve -> IWebServerConfig.serveStatic. The field only
  toggles static file serving / the homepage route; the WebServer's HTTP
  listener is always started when the instance is constructed. The
  previous name read like it gated server startup, which was confusing
  for a public API. No external consumers depended on the old name yet.
- Register the rate limiter before the static / homepage handlers so the
  homepage route and any later-registered routes are all rate-limited.
  The earlier patch moved static+homepage ahead of the limiter, which
  silently removed rate-limiting from the homepage route.
- Log at startup which mode Wilbur is running in so operators can tell
  REST-only installs from full ones at a glance.
- Fold serveStatic into the IWebServerConfig object literal instead of
  setting it after construction.

* Add changeset for REST API startup fix

---------

Co-authored-by: Matthew.Cotton <matt@tensorworks.com.au>

Author: CollegeRideOut

.changeset/silent-lemons-shine.md

@@ -0,0 +1,6 @@
+---
+"@epicgames-ps/wilbur": patch
+"@epicgames-ps/lib-pixelstreamingsignalling-ue5.7": minor
+---
+
+Make the REST API reachable when Wilbur is started with `--rest_api` but without `--serve`. Previously the Express app that hosts the `/api/*` routes was only bound to an HTTP listener inside the `serve` branch, so with `--serve=false --rest_api=true` the listener never started and requests were answered by the WebSocket upgrade handler on the player port (`426 Upgrade Required`). The HTTP listener now starts whenever `rest_api` or `serve` is set. Static file serving and the homepage route are gated by a new `IWebServerConfig.serveStatic` flag (the port listener runs independently of static serving), and the rate limiter is registered before any route handlers so the homepage and any downstream-registered routes are all rate-limited. Wilbur logs at startup which mode it is running in.

Signalling/src/WebServer.ts

@@ -39,6 +39,12 @@ export interface IWebServerConfig {
 
     // If true, connections to http will be redirected to https.
     https_redirect?: boolean;
+
+    // If true, serve static content from `root` and a homepage handler at `/`.
+    // Defaults to false. When false, the HTTP listener still runs (so routes
+    // registered by other subsystems, such as a REST API, remain reachable),
+    // but no static files are served.
+    serveStatic?: boolean;
 }
 
 /**
@@ -111,32 +117,36 @@ export class WebServer {
             }
         }
 
-        app.use(express.static(config.root));
-
         const limiter = RateLimit({
             windowMs: 60 * 1000, // 1 minute
             max: config.perMinuteRateLimit ? config.perMinuteRateLimit : 3000
         });
 
-        // apply rate limiter to all requests
+        // apply rate limiter to all requests. Registered before any route
+        // handler so that static files, the homepage route, and any routes
+        // registered on `app` by downstream code are all subject to it.
         app.use(limiter);
 
-        // Request has been sent to site root, send the homepage file
-        app.get('/', function (req: any, res: any) {
-            // Try a few paths, see if any resolve to a homepage file the user has set
-            const p = path.resolve(path.join(config.root, config.homepageFile));
-            if (fs.existsSync(p)) {
-                // Send the file for browser to display it
-                res.sendFile(p);
+        if (config.serveStatic) {
+            app.use(express.static(config.root));
+
+            // Request has been sent to site root, send the homepage file
+            app.get('/', function (req: any, res: any) {
+                // Try a few paths, see if any resolve to a homepage file the user has set
+                const p = path.resolve(path.join(config.root, config.homepageFile));
+                if (fs.existsSync(p)) {
+                    // Send the file for browser to display it
+                    res.sendFile(p);
+                    return;
+                }
+
+                // Catch file doesn't exist, and send back 404 if not
+                const error = 'Unable to locate file ' + config.homepageFile;
+                Logger.error(error);
+                res.status(404).send(error);
                 return;
-            }
-
-            // Catch file doesn't exist, and send back 404 if not
-            const error = 'Unable to locate file ' + config.homepageFile;
-            Logger.error(error);
-            res.status(404).send(error);
-            return;
-        });
+            });
+        }
 
         /* eslint-enable @typescript-eslint/no-unsafe-call,@typescript-eslint/no-unsafe-member-access */
     }

SignallingWebServer/src/index.ts

@@ -248,12 +248,21 @@ const serverOpts: IServerConfig = {
     maxSubscribers: options.max_players
 };
 
-if (options.serve) {
+const shouldServerStart = options.serve || options.rest_api;
+if (shouldServerStart) {
     const webserverOptions: IWebServerConfig = {
         httpPort: options.player_port,
         root: options.http_root,
-        homepageFile: options.homepage
+        homepageFile: options.homepage,
+        serveStatic: options.serve
     };
+
+    if (options.serve) {
+        Logger.info('Static file serving enabled.');
+    } else if (options.rest_api) {
+        Logger.info('REST API enabled; static file serving disabled.');
+    }
+
     if (options.https) {
         webserverOptions.httpsPort = options.https_port;
         const sslKeyPath = path.join(__dirname, '..', options.ssl_key_path);