remove dead Places photo proxy route — no key since TK-11615 rotation, no callers (all photos are local media/real/* paths)

df557a0b69e44208f502fd2296e0bc15fc198ec3 · 2026-09-20 04:03:49 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit df557a0b69e44208f502fd2296e0bc15fc198ec3
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Sep 20 04:03:49 2026 -0700

    remove dead Places photo proxy route — no key since TK-11615 rotation, no callers (all photos are local media/real/* paths)
---
 server.js | 20 +++++---------------
 1 file changed, 5 insertions(+), 15 deletions(-)

diff --git a/server.js b/server.js
index 2e8a286..8542424 100644
--- a/server.js
+++ b/server.js
@@ -450,21 +450,11 @@ app.get('/api/wait', (req, res) => {
 });
 
 // ---- static + clean URLs ---------------------------------------------------
-// Google Place photo proxy — fetches photo media with the server-side key and streams
-// it, so the key never reaches the browser. Cached to avoid re-billing on every view.
-app.get('/api/places/photo/:i', async (req, res) => {
-  const key = process.env.GOOGLE_PLACES_API_KEY;
-  const name = (places().photos || [])[parseInt(req.params.i, 10)];
-  if (!key || !name) return res.status(404).end();
-  const w = Math.min(1600, Math.max(100, parseInt(req.query.w, 10) || 800));
-  try {
-    const r = await fetch(`https://places.googleapis.com/v1/${name}/media?maxWidthPx=${w}&key=${key}`);
-    if (!r.ok) return res.status(502).end();
-    res.set('Content-Type', r.headers.get('content-type') || 'image/jpeg');
-    res.set('Cache-Control', 'public, max-age=86400');
-    res.end(Buffer.from(await r.arrayBuffer()));
-  } catch { res.status(502).end(); }
-});
+// NOTE: The Google Place photo proxy route (/api/places/photo/:i) was removed
+// 2026-09-20 (TK-11850). All photos in places.json are local media/real/* paths,
+// so the proxy was never called. The key was also rotated in TK-11615 and the new
+// restricted key was never set, meaning every call returned 404 regardless.
+// Restore via: git revert <sha> if a future places.json update adds places/* refs.
 
 // Inline SVG favicon (avoids a 404 on the browser's automatic request).
 app.get('/favicon.svg', (req, res) => res.type('image/svg+xml').send(

← 59d77fc creds-safe fetch guard: resolve relative fetch vs credential · back to Prestige Car Wash · (newest)