condos api: explicit column projection (drop SELECT *, satisfies pre-deploy PII lint)

10edd44c2010d814fd2a84d22e3db51380a9d911 · 2026-07-04 12:56:37 -0700 · steve@designerwallcoverings.com

Files touched

M scripts/serve.js

Diff

commit 10edd44c2010d814fd2a84d22e3db51380a9d911
Author: steve@designerwallcoverings.com <steve@designerwallcoverings.com>
Date:   Sat Jul 4 12:56:37 2026 -0700

    condos api: explicit column projection (drop SELECT *, satisfies pre-deploy PII lint)
---
 scripts/serve.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/serve.js b/scripts/serve.js
index 6da3a0f..10729d6 100644
--- a/scripts/serve.js
+++ b/scripts/serve.js
@@ -276,8 +276,11 @@ app.get('/api/condos', async (req, res) => {
     try {
       const args = []; let where = '';
       if (status && status !== 'all') { args.push(status); where = 'WHERE warrantable_status = $1'; }
+      // Explicit card-safe column projection (condo_card is a curated view; keep it tight, no wildcard).
       const r = await brokerdb.pool.query(
-        `SELECT * FROM condo_card ${where} ORDER BY created_at DESC LIMIT 1000`, args);
+        `SELECT id, address, city, zip, price, hoa, beds, baths, sqft, year_built, project_name,
+                warrantable_status, warrant_source, warrant_signals, broker_name, firm_name, source, created_at
+           FROM condo_card ${where} ORDER BY created_at DESC LIMIT 1000`, args);
       if (r.rows.length) return res.json({ condos: r.rows, label: CONDO_LABEL, source: 'db' });
     } catch (_) { /* fall through to snapshot */ }
   }

← a665e5c condos: Amazon-rail UI live + /api/condos snapshot fallback · back to Commercialrealestate · fha-loans: Amazon left-rail + field toggles + grid/list via 1117168 →