fix(realtime): noindex every response, not just the 404

Setting the header only on the 404 fallback covered the one response that
crawlers already drop on status code alone, while /health — the sole route
returning 200 with a body, and so the only indexable surface on the socket
hostnames — stayed uncovered, with a test pinning it that way.

Set it once on the handler instead. Node merges setHeader values into
writeHead and no branch sets X-Robots-Tag, so it reaches every response.

Author: waleedlatif1

apps/realtime/src/routes/http.test.ts

@@ -4,6 +4,7 @@ import type { IRoomManager } from '@/rooms'
 import { createHttpHandler } from '@/routes/http'
 
 function createMocks(req: Partial<IncomingMessage>) {
+  const setHeader = vi.fn()
   const writeHead = vi.fn()
   const end = vi.fn()
   const logger = { info: vi.fn(), error: vi.fn(), debug: vi.fn(), warn: vi.fn() }
@@ -15,26 +16,42 @@ function createMocks(req: Partial<IncomingMessage>) {
   return {
     handler: createHttpHandler(roomManager, logger),
     req: { headers: {}, ...req } as IncomingMessage,
-    res: { writeHead, end } as unknown as ServerResponse,
+    res: { setHeader, writeHead, end } as unknown as ServerResponse,
+    setHeader,
     writeHead,
     end,
   }
 }
 
 describe('createHttpHandler', () => {
-  it('marks unmatched routes noindex so crawlers drop the socket hostnames', async () => {
+  /**
+   * `/health` is the only route on this server that returns 200 with a body, so
+   * it is the only genuinely indexable surface on the `sockets.*` hostnames.
+   * Node merges `setHeader` values into `writeHead`, and no branch here sets
+   * `X-Robots-Tag`, so the handler-level call reaches every response.
+   */
+  it.each([
+    ['health check', { method: 'GET', url: '/health' }],
+    ['unmatched route', { method: 'GET', url: '/' }],
+    ['unauthenticated internal API call', { method: 'POST', url: '/api/workflow-deleted' }],
+  ])('marks the %s noindex', async (_label, req) => {
+    const { handler, req: request, res, setHeader } = createMocks(req)
+
+    await handler(request, res)
+
+    expect(setHeader).toHaveBeenCalledWith('X-Robots-Tag', 'noindex, nofollow')
+  })
+
+  it('still serves the unmatched-route 404 unchanged', async () => {
     const { handler, req, res, writeHead, end } = createMocks({ method: 'GET', url: '/' })
 
     await handler(req, res)
 
-    expect(writeHead).toHaveBeenCalledWith(404, {
-      'Content-Type': 'application/json',
-      'X-Robots-Tag': 'noindex, nofollow',
-    })
+    expect(writeHead).toHaveBeenCalledWith(404, { 'Content-Type': 'application/json' })
     expect(end).toHaveBeenCalledWith(JSON.stringify({ error: 'Not found' }))
   })
 
-  it('does not mark the health check noindex', async () => {
+  it('still serves the health check as 200', async () => {
     const { handler, req, res, writeHead } = createMocks({ method: 'GET', url: '/health' })
 
     await handler(req, res)

apps/realtime/src/routes/http.ts

@@ -59,6 +59,8 @@ function sendError(res: ServerResponse, message: string, status = 500): void {
  */
 export function createHttpHandler(roomManager: IRoomManager, logger: Logger) {
   return async (req: IncomingMessage, res: ServerResponse) => {
+    res.setHeader('X-Robots-Tag', 'noindex, nofollow')
+
     // Health check doesn't require auth
     if (req.method === 'GET' && req.url === '/health') {
       try {
@@ -150,10 +152,7 @@ export function createHttpHandler(roomManager: IRoomManager, logger: Logger) {
       return
     }
 
-    res.writeHead(404, {
-      'Content-Type': 'application/json',
-      'X-Robots-Tag': 'noindex, nofollow',
-    })
+    res.writeHead(404, { 'Content-Type': 'application/json' })
     res.end(JSON.stringify({ error: 'Not found' }))
   }
 }