wallco PDP: gate unpublished /design/:id from public direct-link (404 for public, admin preview preserved)

851af257c2ce99c6fae458d825579f08a8e8e956 · 2026-05-29 22:32:17 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 851af257c2ce99c6fae458d825579f08a8e8e956
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri May 29 22:32:17 2026 -0700

    wallco PDP: gate unpublished /design/:id from public direct-link (404 for public, admin preview preserved)
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 373a7ab..a07f03d 100644
--- a/server.js
+++ b/server.js
@@ -11465,6 +11465,14 @@ app.get('/design/:id', (req, res) => {
   }
   if (!design) return res.status(404).type('html').send(renderDesignNotFound(req, id));
 
+  // 2026-05-30: gate unpublished designs from public direct-link view. The hot-path
+  // fallback above synthesizes a design from spoon_all_designs regardless of is_published,
+  // so an unpublished design (e.g. needs-fixing) was reachable by URL even though browse/
+  // search exclude it. Admins/curators keep preview access via _isAdmin.
+  if (design && design.is_published === false && !_isAdmin) {
+    return res.status(404).type('html').send(renderDesignNotFound(req, id));
+  }
+
   // Safety net: if the in-memory DESIGNS entry is a stub from another route
   // (e.g., the by-id image route's lazy push) and is missing title/category,
   // backfill from PG so the page doesn't render "undefined".

← c72fe45 id-collision resolutions 1..14999 (134 rows): 106 Mac2 re-pu · back to Wallco Ai · PDP Generated-rooms gallery: tile src uses /designs/room/des be7e221 →