`Designer-Wallcoverings/review.md`

36 lines

## Snapshot
- Operational workspace for Designer Wallcoverings Shopify automation: product enrichment, admin tools, Slack/MCP agents, vendor scrapers, and storefront snippets.
- Stack: JavaScript/TypeScript, Node/Express, Shopify Admin APIs, Slack/Gmail/Twilio/Anthropic integrations, PostgreSQL/Prisma, SQLite/JSON files, Python utility scripts, Liquid/static HTML.
- How it's run: mixed PM2 (`DW-Agents/*ecosystem*.js`), npm scripts, shell/cron-like scripts, manual.
- Status: live: recent files plus production PM2 configs.

## Top Risks (P0 — fix this week)
- `DW-Agents/ecosystem.config.js:45`, `:72`, `:92`, `:134`, `:176`, `:494`; `brand-router/server.js:11`; `DW-Websites/shop-by-color/server.js:9`: real-looking Shopify/Slack/Anthropic/Zendesk/Postgres secrets are hardcoded. Rotate every exposed credential, purge from files/history/backups, load only from env/secret store.
- `.env:1`, `shopify/.env:1`, `DW-MCP/.env:1`, `DW-Agents/.env:1`: live secret-bearing env files sit inside the project tree. Confirm whether they are tracked/backed up; rotate and move to an untracked secrets location.
- `DW-Agents/dw-agents/agent-legal-team/legal-agent.ts:248-284`, `:1894`, `:2151`: auth middleware is not applied, while unauthenticated routes can run Claude analysis and set Shopify products to draft. Add global auth before routes and separately verify Shopify webhook HMAC.
- `admin/server.ts:19`, `:30`, `:61`, `:421-424`: admin interface falls back to `admin123`, uses `Math.random()` bearer tokens, allows `Access-Control-Allow-Origin: *`, and prints the admin password. Require `ADMIN_PASSWORD`, use `crypto.randomBytes`, restrict CORS, never log secrets.
- `DW-MCP/src/index.js:300-345`: Shopify OAuth callback has no state validation and logs/displays the new access token. Add OAuth `state` validation, authenticate token-generation flow, and never render/log tokens.
- `DW-Agents/dw-agents/agent-slack/slack-agent.ts:275-280`: Slack events endpoint accepts unsigned JSON; `SLACK_SIGNING_SECRET` is defined but unused. Verify Slack request signatures before calling Claude or posting replies.
- `DW-MCP/src/index.js:369-375`: Shopify order webhook reads HMAC but does not verify it. Reject unsigned/invalid webhooks before posting customer/order data to Slack.

## Notable Issues (P1 — fix this month)
- `admin/server.ts:362-385`: `/api/process/history/:sessionId/failed` ignores `sessionId` and returns all failed products. Add `WHERE session_id = $1`.
- `DW-Agents/dw-agents/in-parallel-agent.ts:610-613`: `message` is referenced before it is declared, so `/api/chat` can throw before entering the try block. Destructure `const { message } = req.body` first and validate it.
- `brand-router/server.js:158-159`: GraphQL query interpolates user input directly. Use Shopify GraphQL variables or strict escaping for search text.
- `DW-MCP/monitor-new-orders.js:14`, `:41`, `:66-99`: order polling fetches only 5 orders and updates state after posting; bursts or crashes can skip/duplicate notifications. Page by `created_at_min`/cursor and persist each processed order transactionally.
- `brand-router/server.js:35-38`: synchronous read/write of `brands-data.json` on request paths can block the server and lose concurrent edits. Cache with guarded writes or use a small datastore.

## Polish (P2 — when convenient)
- `package.json:5-8`: root scripts do not explain the many runnable subprojects; add a short runbook.
- Repo contains backups, old databases, generated outputs, and many app folders in one tree; split live services from archives or add an index.
- Add focused tests for destructive Shopify routes, auth middleware, OAuth callback, and webhook signature validation.

## Strengths
- `shopify/src/server.ts:81-94`: metafield write endpoint validates numeric inputs before calling Shopify.
- `admin/server.ts:133-152`: batch size validation is explicit and bounded.
- `DW-Agents/package.json:17-24`: DW-Agents has a real Jest test setup with coverage thresholds.

## Open questions for the owner
- Which services are actually internet-facing today: `admin`, `DW-MCP`, `DW-Agents`, `brand-router`, or all?
- Are the exposed Shopify/Slack/Anthropic/Zendesk tokens still active?
- Is this directory backed up or synced anywhere public/private beyond the local machine?