promote(decode): opaque candidate keys + slim decode response #122

Merged
root merged 2 commits from promote-decode into main 2026-06-10 12:04:20 +03:00
Owner

Cherry-picks 2077a97 + 02c8321 from dev (verified on dev.sase.tr): decode-source details stay server-side (Redis candidate stash, opaque keys), decode response slimmed to {id, brandName, model, year} — drops rawData (p95 ~127KB) and provider name from every decode.

🤖 Generated with Claude Code

Cherry-picks 2077a97 + 02c8321 from dev (verified on dev.sase.tr): decode-source details stay server-side (Redis candidate stash, opaque keys), decode response slimmed to {id, brandName, model, year} — drops rawData (p95 ~127KB) and provider name from every decode. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
root added 2 commits 2026-06-10 12:04:10 +03:00
The multi-candidate decode response leaked provider internals (source name,
pcat car ids, EMEX _ssd/_vid/_quickGroupsUrl/catalogId) and made the client
carry them between requests: the frontend stored candidateSource and echoed
pcatCarId/emexCarIndex back on selection.

Now the candidate list returned to the client carries only display fields
(name, description, parameters) plus an opaque key, and the provider mapping
is stashed in Redis (vin:candidates:*, 30m TTL, resolve-cache fallback). The
pick request sends just { vin, candidate }. Legacy pcatCarId/emexCarIndex
body params still work for already-loaded bundles.

Also drops `source` from the public /vehicles/preview response — no consumer
used it, and provider names must never be public (same policy as
teaser-stats).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 2077a9724a)
perf(decode): slim decode response to id + display summary
Some checks failed
QA Gate (P0/P1) / Test affected app (pull_request) Has been cancelled
7aafdc92b6
POST /vehicles/decode returned the full vehicles row while every consumer
(search, landing, service-test) only navigates by id and re-fetches via
GET /vehicles/:id. That shipped the raw upstream decode payload to the
client on every decode — rawData is 19KB avg / 127KB p95 / 207KB max in
prod — plus the provider name, for nothing.

The response is now { id, brandName, model, year } on both the DB-hit and
fresh-decode paths. Frontend drops the (now absent) source property from
the vin_decode_success event; decode source remains queryable server-side
via query_logs.source.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 02c8321023)
root merged commit 0652fb3a18 into main 2026-06-10 12:04:20 +03:00
Sign in to join this conversation.
No Reviewers
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: root/sase.tr#122