fix: digital-for-sale also unpublishes spoon_all_designs (prod leak root cause)

5dc7d6a91e2956f515d1e10facd618adf4c0ffdb · 2026-06-03 21:23:17 -0700 · Steve Abrams

The /api/designs/bulk-action 'digital' branch wrote only all_designs; on prod
spoon_all_designs is a separate base table the storefront/PDP reads, so items
marked digital-for-sale stayed visible. Mirror the 'unpublish' spoon-write so
digital actually drops the item from the live site on prod. No-op echo on Mac2
(spoon is a view there). NOT deployed — run ./deploy-kamatera.sh to ship.

Files touched

M server.js

Diff

commit 5dc7d6a91e2956f515d1e10facd618adf4c0ffdb
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jun 3 21:23:17 2026 -0700

    fix: digital-for-sale also unpublishes spoon_all_designs (prod leak root cause)
    
    The /api/designs/bulk-action 'digital' branch wrote only all_designs; on prod
    spoon_all_designs is a separate base table the storefront/PDP reads, so items
    marked digital-for-sale stayed visible. Mirror the 'unpublish' spoon-write so
    digital actually drops the item from the live site on prod. No-op echo on Mac2
    (spoon is a view there). NOT deployed — run ./deploy-kamatera.sh to ship.
---
 server.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server.js b/server.js
index 2b69442..3499956 100644
--- a/server.js
+++ b/server.js
@@ -4989,6 +4989,13 @@ app.post('/api/designs/bulk-action', express.json({ limit: '64kb' }), (req, res)
         SET is_published=FALSE, web_viewer=FALSE, digital_file_at=now(),
             tags = array_remove(COALESCE(tags, ARRAY[]::text[]), 'digital-file') || ARRAY['digital-file']::text[]
         WHERE id IN (${idList});`);
+      // PROD spoon_all_designs is a SEPARATE base table the storefront/PDP reads;
+      // on Mac2 it's a VIEW over all_designs so this is a harmless echo. The
+      // 'unpublish' action already writes spoon — 'digital' must too, or on prod
+      // the item stays visible on its PDP after being marked digital-for-sale
+      // (the all_designs-only write doesn't reach the table the live site reads).
+      // This is the root cause of the digital-for-sale leak. Steve 2026-06-03.
+      psqlExecLocal(`UPDATE spoon_all_designs SET is_published=FALSE WHERE id IN (${idList});`);
       affected = ids.length;
       // Drop from in-memory catalog so it leaves the live feed immediately.
       for (const id of ids) {

← b4013ff pdp: room-size mural preview block (web previews + API field · back to Wallco Ai · pdp: universal room-size-mural injector for theme variants ( d9c4f54 →