wire api-vendor-redact middleware (close vendors-facet leak)

4b9975c0794bb0d8af02883a67afb9d9c9206755 · 2026-05-26 07:19:43 -0700 · Steve

Files touched

M server.js

Diff

commit 4b9975c0794bb0d8af02883a67afb9d9c9206755
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 26 07:19:43 2026 -0700

    wire api-vendor-redact middleware (close vendors-facet leak)
---
 server.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server.js b/server.js
index 2c2718d..fa8f0fd 100644
--- a/server.js
+++ b/server.js
@@ -124,6 +124,10 @@ const app = express();
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));
 
+// Fleet-wide DW vendor-name redactor on /api/* (drops `vendors` facet, replaces
+// any `vendor` field with "Designer Wallcoverings", strips `?vendor=` query).
+app.use(require('../_shared/api-vendor-redact'));
+
 // Never serve snapshot/backup files from the static root.
 app.use((req, res, next) => {
   if (/\.(bak|pre-[\w.-]*)/i.test(req.path) || /\.pre-/i.test(req.path)) {

← a3248f3 Remove vendor name leak from product card overlay · back to Bestwallpaperplace · homepage: insert Browse-by-style rails section (textured/con 1c009de →