updated .static jsvm docs

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 - Updated the Discord `AuthUser.Name` field to use `global_name` ([#7603](https://github.com/pocketbase/pocketbase/pull/7603); thanks @HansHans135).
 
+- (@todo) Bumped min Go GitHub action version to 1.26.2 because it comes with several [minor security fixes](https://github.com/golang/go/issues?q=milestone%3AGo1.26.2).
+
+- Other minor improvements _(updated `$apis.static` JSVM documentation, (@todo) added extra OAuth2 checks to prevent internal network probing requests in case of a malicious/vulnerable vendor, etc.)_.
+
 
 ## v0.36.8
 

apis/base.go

@@ -86,7 +86,7 @@ func MustSubFS(fsys fs.FS, dir string) fs.FS {
 
 // Static is a handler function to serve static directory content from fsys.
 //
-// If a file resource is missing and indexFallback is set, the request
+// If a file resource is missing and indexFallback is true, the request
 // will be forwarded to the base index.html (useful for SPA with pretty urls).
 //
 // NB! Expects the route to have a "{path...}" wildcard parameter.
@@ -94,7 +94,7 @@ func MustSubFS(fsys fs.FS, dir string) fs.FS {
 // Special redirects:
 //   - if "path" is a file that ends in index.html, it is redirected to its non-index.html version (eg. /test/index.html -> /test/)
 //   - if "path" is a directory that has index.html, the index.html file is rendered,
-//     otherwise if missing - returns 404 or fallback to the root index.html if indexFallback is set
+//     otherwise if missing - returns 404 or fallback to the root index.html if indexFallback is true
 //
 // Example:
 //

plugins/jsvm/internal/types/types.go

@@ -1162,10 +1162,28 @@ declare namespace $apis {
   /**
    * Route handler to serve static directory content (html, js, css, etc.).
    *
-   * If a file resource is missing and indexFallback is set, the request
-   * will be forwarded to the base index.html (useful for SPA).
+   * If a file resource is missing and indexFallback is true, the request
+   * will be forwarded to the base index.html (useful for SPA with pretty urls).
+   *
+   * NB! Expects the route to have a "{path...}" wildcard parameter.
+   *
+   * Special redirects:
+   *
+   * - if "path" is a file that ends in index.html, it is redirected to its non-index.html version (eg. /test/index.html -> /test/)
+   * - if "path" is a directory that has index.html, the index.html file is rendered,
+   *   otherwise if missing - returns 404 or fallback to the root index.html if indexFallback is true
+   *
+   * Example:
+   *
+   * ` + "```" + `js
+   * // serves static files from the provided dir string path (it will be wrapped in $os.dirFS())
+   * routerAdd("GET", "/{path...}", $apis.static("/path/to/public", false))
+   *
+   * // serves static files from the explicit fs.FS value ($os.dirFS(), $os.openRoot().fs(), etc.)
+   * routerAdd("GET", "/{path...}", $apis.static($os.dirFS("/path/to/public"), false))
+   * ` + "```" + `
    */
-  function static(dir: string, indexFallback: boolean): (e: core.RequestEvent) => void
+  function static(dirOrFS: string|fs.FS, indexFallback: boolean): (e: core.RequestEvent) => void
 
   let requireGuestOnly:              apis.requireGuestOnly
   let requireAuth:                   apis.requireAuth