This was a series of decisions with good intentions that went poorly in the long run.

Our customer wanted us to setup a system so their users could track their products from their site from a variety of carriers; but their backend was very old and difficult to work with, and their network very locked down.

We were struggling to setup a single carrier, so we eventually decided to setup a new server with modern tooling on our own network so we could develop this and other “complicated” features with less pain, and they would only have to make a single exception to their firewall.

Fast forward a year and:

• They didn’t request any more “difficult” features, so the server was serving a single API
• One of our carrier’s API keys had expired and nobody noticed because they weren’t using it, and they didn’t request support for additional carriers either
• Somebody on their security team noticed the strange calls to our servers and demanded we moved the API to their infrastructure anyway

But that way they cannot charge you for the storage you don’t use

There is also a limit to the number of files the browser can download in parallel, so if many files have to be fetched, they have to wait until the previous downloads are finished. This slows down performance even more

The code is such a tangled mess that trying to update one place has no effect on others, or straight up fails because it was expecting a different response