fix(backend): return HTTP 404 for any unknown api endpoint paths (#10130)

* fix(backend): return HTTP 400 for any invalid api endpoint paths

* 404

cypress/e2e/api.cy.js

@@ -0,0 +1,11 @@
+describe('API', () => {
+	it('returns HTTP 404 to unknown API endpoint paths', () => {
+		cy.request({
+			url: '/api/foo',
+			failOnStatusCode: false,
+		}).then((response) => {
+			expect(response.status).to.eq(404);
+			expect(response.body.error.code).to.eq('UNKNOWN_API_ENDPOINT');
+		});
+	});
+});

packages/backend/src/server/api/ApiServerService.ts

@@ -79,7 +79,7 @@ export class ApiServerService {
 						reply.send();
 						return;
 					}
-		
+
 					this.apiCallService.handleMultipartRequest(ep, request, reply);
 				});
 			} else {
@@ -93,7 +93,7 @@ export class ApiServerService {
 						reply.send();
 						return;
 					}
-		
+
 					this.apiCallService.handleRequest(ep, request, reply);
 				});
 			}
@@ -160,6 +160,22 @@ export class ApiServerService {
 			}
 		});
 
+		// Make sure any unknown path under /api returns HTTP 404 Not Found,
+		// because otherwise ClientServerService will return the base client HTML
+		// page with HTTP 200.
+		fastify.get('*', (request, reply) => {
+			reply.code(404);
+			// Mock ApiCallService.send's error handling
+			reply.send({
+				error: {
+					message: 'Unknown API endpoint.',
+					code: 'UNKNOWN_API_ENDPOINT',
+					id: '2ca3b769-540a-4f08-9dd5-b5a825b6d0f1',
+					kind: 'client',
+				},
+			});
+		});
+
 		done();
 	}
 }