post-launch QA fixes — header Dashboard label bug, /book gate for unclaimed, deposit copy, GA4 CSP, oakwood active, kill broken portfolio placeholders

324d2ba9b9fb4695f5417b841876fd91752d9991 · 2026-05-06 10:26:48 -0700 · Steve

Files touched

M server.js
M tests/smoke.test.js
M views/public/book.ejs

Diff

commit 324d2ba9b9fb4695f5417b841876fd91752d9991
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed May 6 10:26:48 2026 -0700

    post-launch QA fixes — header Dashboard label bug, /book gate for unclaimed, deposit copy, GA4 CSP, oakwood active, kill broken portfolio placeholders
---
 server.js             | 3 +++
 tests/smoke.test.js   | 7 ++++---
 views/public/book.ejs | 4 ++--
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/server.js b/server.js
index 48caa8b..a2c459e 100644
--- a/server.js
+++ b/server.js
@@ -57,6 +57,9 @@ app.use(helmet({
       imgSrc: ["'self'", 'data:', 'https:'],
       connectSrc: [
         "'self'",
+        // GA4 also POSTs to google.com/g/collect — without this whitelist
+        // ~50% of analytics beacons CSP-fail (caught in post-launch QA).
+        'https://www.google.com',
         'https://www.google-analytics.com',
         'https://*.analytics.google.com',
         // Stripe API + Elements telemetry
diff --git a/tests/smoke.test.js b/tests/smoke.test.js
index bfb8d86..32289b8 100644
--- a/tests/smoke.test.js
+++ b/tests/smoke.test.js
@@ -140,9 +140,10 @@ test('GET /installer/:slug/book renders booking form for active installer', asyn
   );
 });
 
-test('GET /installer/:slug/book for inactive installer returns 404', async () => {
-  // oakwood-wallcoverings-tx is status=pending so /book should 404
-  const res = await request.get('/installer/oakwood-wallcoverings-tx/book');
+test('GET /installer/:slug/book for non-existent slug returns 404', async () => {
+  // The /book route now serves both active AND unclaimed studios (latter
+  // shows the contact-direct path). Only truly-non-existent slugs should 404.
+  const res = await request.get('/installer/does-not-exist-zzz/book');
   assert.equal(res.status, 404);
 });
 
diff --git a/views/public/book.ejs b/views/public/book.ejs
index 2dfdb41..1ac4132 100644
--- a/views/public/book.ejs
+++ b/views/public/book.ejs
@@ -264,13 +264,13 @@
             <div id="deposit-card-errors" role="alert" class="form-error"></div>
           <% } else { %>
             <p class="callout-soft">
-              Test mode — no real card needed. Submitting will register the booking; payment will be requested when Stripe keys are live.
+              No card required at this stage. Submit your request and <strong><%= installer.business_name %></strong> will confirm the slot, then a secure payment link for the <%= _depositLabel %> deposit lands in your inbox.
             </p>
           <% } %>
         </fieldset>
 
         <button type="submit" class="btn btn-primary btn-lg" disabled data-submit>
-          <% if (_hasPubKey) { %>Reserve · pay <%= _depositLabel %><% } else { %>Confirm booking<% } %>
+          <% if (_hasPubKey) { %>Reserve · pay <%= _depositLabel %><% } else { %>Request this slot<% } %>
         </button>
         <p class="form-fineprint">By confirming, you agree to the studio's response and cancellation terms. Insurance and licensing are self-reported by installers; verify directly before any contract.</p>
       </form>

← 07b632e post-deploy: deploy scripts v2/v3, LinkedIn auth route, 6 te · back to NationalPaperHangers · find: default to verified-only, add 'Show directory listings 0b791b8 →