PDP coordinates: route color-swatch pairs lookup through same-origin /api/coordinates/pairs proxy (was cross-origin → CORS-blocked off-prod) [yolo D2]

90147831bb0d55c1d144229ce30a09abbd0713b0 · 2026-06-02 11:30:13 -0700 · Steve

Files touched

M server.js
M yolo-queue/yolo-loop-2026-06-02.md

Diff

commit 90147831bb0d55c1d144229ce30a09abbd0713b0
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Jun 2 11:30:13 2026 -0700

    PDP coordinates: route color-swatch pairs lookup through same-origin /api/coordinates/pairs proxy (was cross-origin → CORS-blocked off-prod) [yolo D2]
---
 server.js                          | 2 +-
 yolo-queue/yolo-loop-2026-06-02.md | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index a8458ae..7507d25 100644
--- a/server.js
+++ b/server.js
@@ -14395,7 +14395,7 @@ try {
 
           document.getElementById('cs-dots').innerHTML = palette.map(function(h){ return dotHtml(h); }).join('');
 
-          var ep = 'https://pairs.designerwallcoverings.com/api/pairs?palette=' +
+          var ep = '/api/coordinates/pairs?palette=' +
                    encodeURIComponent(palette.join(',')) + '&limit=1';
           fetch(ep, { credentials: 'omit' })
             .then(function(r){ return r.ok ? r.json() : Promise.reject(r.status); })
diff --git a/yolo-queue/yolo-loop-2026-06-02.md b/yolo-queue/yolo-loop-2026-06-02.md
index 5e07a0c..dc026cd 100644
--- a/yolo-queue/yolo-loop-2026-06-02.md
+++ b/yolo-queue/yolo-loop-2026-06-02.md
@@ -12,7 +12,7 @@ DTD verdict: **B** (bug-hunt + audit all user-facing surfaces, fix locally) + gr
 
 ## Defect queue (from tick-1 audit sweep)
 - [x] **D1 · /samples dead form JS** — `Unexpected identifier 'll'`: unescaped apostrophe `'We\'ll'` collapsed in the res.send template literal → killed the sample-request submit handler (form did nothing). Fixed → `\\'` (matches working L19535). 10/10 scripts parse clean. **commit a805dc0** (tick 1).
-- [ ] **D2 · PDP "pairs well with" CORS-blocked** — PDP fetches `https://pairs.designerwallcoverings.com/api/pairs?...` → CORS error from the wallco.ai origin (seen on both variant + monolith). Verify whether prod origin is whitelisted; if not, proxy via a local `/api/pairs` passthrough so the feature works same-origin. (Reversible code fix; no deploy.)
+- [x] **D2 · PDP "pairs well with" CORS-blocked** — root cause: a same-origin proxy already existed (`/api/coordinates/pairs`, server.js:458) but the color-swatch→paint lookup at L14398 still hit the cross-origin `pairs.designerwallcoverings.com/api/pairs` DIRECTLY. Upstream only whitelists `https://wallco.ai` (works on prod, breaks on localhost/previews — brittle). Fix: point L14398 at the existing same-origin proxy. Verified (Playwright): 0 CORS errors, 0 direct cross-origin calls, 1 proxy call → 200. **commit (tick 2).**
 - [ ] **D3 · front page `localhost:9935/widget.js` ERR_CONNECTION_REFUSED** — a widget `<script>` points at a dead local port. Check what URL prod emits; if it's a dev leftover / dead service, guard or remove. (Possibly the retired Big-Red widget pattern — see [[reference_dw_bigred_widget_fleet_removal]].)
 - [ ] **D4 · /studio serves the /designs page** — `/studio` returns title "All Designs" + byte-identical body (5490) to `/designs`, not the studio composer. Confirm whether that's an intentional alias/redirect or a routing regression; the YOLO_BACKLOG R0a–R0d studio payoff work implies /studio should be its own surface.
 - [ ] **D5 · /moodboard near-empty (bodyLen 379)** — likely just needs pinned data, but confirm it's not a broken render. Low priority.
@@ -28,3 +28,4 @@ DTD verdict: **B** (bug-hunt + audit all user-facing surfaces, fix locally) + gr
 
 ## Ledger
 - T1 · 2026-06-02 10:5x · audit sweep (8 routes) + D1 fix · commit a805dc0 · /samples form JS restored
+- T2 · 2026-06-02 11:2x · D2 PDP pairs CORS → same-origin proxy · verified 0 CORS / proxy 200 · commit (below)

← c725798 yolo loop tick 2: kind/category misclassification audit (198 · back to Wallco Ai · joint-fix-gallery: add Density slider + persist Sort & Densi a67d6b2 →