/api/designs: strip local_path from public output (no /Users//root/ path leak)

a0203ad77b2b2633dd123076e72b6f62300dcbe9 · 2026-06-03 12:08:53 -0700 · Steve

Defensive output sanitization — runtime-added in-memory rows (generator/curator/recolor) carry local_path which the shallow-copy emit leaked on prod (146 rows, ids 39290-57342). Hard rule: public API must never expose filesystem paths.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit a0203ad77b2b2633dd123076e72b6f62300dcbe9
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Jun 3 12:08:53 2026 -0700

    /api/designs: strip local_path from public output (no /Users//root/ path leak)
    
    Defensive output sanitization — runtime-added in-memory rows (generator/curator/recolor) carry local_path which the shallow-copy emit leaked on prod (146 rows, ids 39290-57342). Hard rule: public API must never expose filesystem paths.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 08e9ff1..e7e4bb8 100644
--- a/server.js
+++ b/server.js
@@ -21145,7 +21145,7 @@ app.get('/api/designs', (req, res) => {
   // grid name matches the PDP (which does the same in /api/design/:id). Copies,
   // not the shared DESIGNS objects — never mutate the in-memory catalog.
   const items = filtered.slice((page-1)*PER, page*PER)
-    .map(d => applyHexConsistentNaming(Object.assign({}, d)));
+    .map(d => { const o = applyHexConsistentNaming(Object.assign({}, d)); delete o.local_path; return o; });
   res.json({ ok: true, total, page, pages, items });
 });

← ecf309b loop tick6: regression check steady (0 new blocks, 658 uncha · back to Wallco Ai · loop tick7: regression check steady (no change) 0170086 →