`CODEX_POKE.md`

62 lines
## Failure mode
Starting/importing `server.py` fails before `/` or `/api/resize` can run when `SPOONFLOWER_EMAIL` or `SPOONFLOWER_PASSWORD` is unset. The local resize path does not use Spoonflower credentials, but import-time validation blocks it anyway. `server.py:23-34`, `server.py:41-67`

## Root cause
`server.py:33-34` — the module raises `RuntimeError` during import if either Spoonflower env var is missing. That code runs before route handlers are usable, while the local upload/resize handler only shells out to `scripts/resize_image.py` and does not need those credentials. `server.py:23-34`, `server.py:41-67`

## Origin
REGRESSION — `CHANGES.md:2` says the recent patch removed hardcoded Spoonflower defaults and made startup fail fast when env vars are missing. `CODEX_REREVIEW.md:5` and `CODEX_REREVIEW.md:20` identify that as broken because unrelated local resize usage is blocked.

## Proposed patch
`server.py:26-34`
```diff
- missing_env = [
+ def missing_spoonflower_env():
+     return [
-     name for name, value in {
-         'SPOONFLOWER_EMAIL': SPOONFLOWER_EMAIL,
-         'SPOONFLOWER_PASSWORD': SPOONFLOWER_PASSWORD,
-     }.items()
-     if not value
- ]
- if missing_env:
-     raise RuntimeError(f"Missing required environment variables: {', '.join(missing_env)}")
+         name for name, value in {
+             'SPOONFLOWER_EMAIL': SPOONFLOWER_EMAIL,
+             'SPOONFLOWER_PASSWORD': SPOONFLOWER_PASSWORD,
+         }.items()
+         if not value
+     ]
```

`server.py:119-124`
```diff
  data = request.get_json(silent=True)
  if data is None:
      return jsonify({'error': 'Invalid or missing JSON body'}), 400
+ missing_env = missing_spoonflower_env()
+ if missing_env:
+     return jsonify({'error': f"Missing required environment variables: {', '.join(missing_env)}"}), 500

  design_url = data.get('designUrl')
```

`server.py:174-178`
```diff
  data = request.get_json(silent=True)
  if data is None:
      return jsonify({'error': 'Invalid or missing JSON body'}), 400
+ missing_env = missing_spoonflower_env()
+ if missing_env:
+     return jsonify({'error': f"Missing required environment variables: {', '.join(missing_env)}"}), 500

  url = data.get('url')
```

## Side-effects to handle
- `server.py:115-155` and `server.py:170-198` are the only routes that pass `SPOONFLOWER_EMAIL` / `SPOONFLOWER_PASSWORD` to subprocesses, so credential validation should live there.
- `server.py:39` still serves `web-interface.html` from `'.'`; that is a separate missed checkout-relative call-site noted in `CODEX_REREVIEW.md:24-25`.
- `server.py:123` and `server.py:178` can still 500 if JSON is non-object, as noted in `CODEX_REREVIEW.md:9`.

## Risks of the patch
This changes missing Spoonflower credentials from startup failure to endpoint-time failure, so deployments that relied on fail-fast startup would no longer catch misconfiguration until a Spoonflower route is called. Existing `.env` files are still ignored because no dotenv loader is present.