Remove dead migration-audit routes that 500 on bot probes

config/routes.rb

@@ -1,21 +1,7 @@
 Rails.application.routes.draw do
-  # temporary direct routes to images for migration audit
-  resources :attachments, only: [ :show ]
-  resources :media_files, only: [ :show ]
-  # namespace :assets do
-  #   resources :primary_assets, only: [ :show ]
-  #   resources :gallery_assets, only: [ :show ]
-  # end
   resources :primary_assets
   resources :rich_text_assets
 
-  namespace :images do
-    resources :primary_images, only: [ :show ]
-    resources :gallery_images, only: [ :show ]
-    resources :rich_texts, only: [ :show ]
-  end
-  resources :images, only: [ :show ]
-
   # mount Ckeditor::Engine, at: '/admin/ckeditor', as: 'ckeditor'
   authenticate :user, ->(user) { user.super_user? } do
     mount Blazer::Engine, at: "blazer"

spec/requests/dead_migration_audit_routes_spec.rb

@@ -0,0 +1,24 @@
+require "rails_helper"
+
+# Leftover "migration audit" routes pointed at controllers that never existed
+# (ImagesController, AttachmentsController, MediaFilesController, Images::*).
+# A bot probing GET /images/index.php matched `resources :images` and dispatched
+# to the missing ImagesController, raising ActionDispatch::MissingController (a
+# 500) instead of a plain 404. These paths must be unrouted, i.e. raise a
+# routing error rather than a missing-controller error.
+RSpec.describe "Removed migration-audit routes", type: :request do
+  [
+    "/images/index.php",
+    "/images/1",
+    "/images/primary_images/1",
+    "/images/gallery_images/1",
+    "/images/rich_texts/1",
+    "/attachments/1",
+    "/media_files/1"
+  ].each do |path|
+    it "404s for GET #{path} instead of erroring on a missing controller" do
+      get path
+      expect(response).to have_http_status(:not_found)
+    end
+  end
+end