CRCP: /api/brokers/all honors ?asset_class=commercial (agent_type filter) so RENTV CRE desk can't surface residential brokers (TK-10535 leak fix)

acf2903aa10e95942c84c288dbd832674f0b6955 · 2026-08-14 10:30:43 -0700 · Steve Abrams

Files touched

M scripts/serve.js

Diff

commit acf2903aa10e95942c84c288dbd832674f0b6955
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Aug 14 10:30:43 2026 -0700

    CRCP: /api/brokers/all honors ?asset_class=commercial (agent_type filter) so RENTV CRE desk can't surface residential brokers (TK-10535 leak fix)
---
 scripts/serve.js | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/scripts/serve.js b/scripts/serve.js
index c107bca..bfcb9ef 100644
--- a/scripts/serve.js
+++ b/scripts/serve.js
@@ -451,7 +451,14 @@ app.get('/api/brokers/all', async (req, res) => {
   // the California-only cut (state='CA' or still-unknown; hides the 22 confirmed out-of-state).
   const scope = String(req.query.scope || 'all');
   if (!brokerdb) return serveBrokerSnapshot(res, scope, 'no db module');
-  const caFilter = scope === 'ca' ? `WHERE (b.state = 'CA' OR b.state IS NULL)` : '';
+  // Optional agent_type filter (TK-10535): ?asset_class=commercial restricts to commercial brokers
+  // so the RENTV CRE desk never surfaces residential agents. Whitelisted literals (no SQL injection);
+  // default (no param) is unchanged — CRCP's own broker-grid keeps listing all agent_types.
+  const ac = String(req.query.asset_class || req.query.type || '').toLowerCase();
+  const acCond = (ac === 'commercial' || ac === 'residential') ? `b.agent_type = '${ac}'` : '';
+  const scopeCond = scope === 'ca' ? `(b.state = 'CA' OR b.state IS NULL)` : '';
+  const _conds = [scopeCond, acCond].filter(Boolean);
+  const caFilter = _conds.length ? 'WHERE ' + _conds.join(' AND ') : '';
   try {
     const rows = (await brokerdb.pool.query(
       `SELECT b.id, b.name, f.name firm, b.agent_type, b.phone, b.email, b.website, b.linkedin,
@@ -462,7 +469,7 @@ app.get('/api/brokers/all', async (req, res) => {
          FROM broker b LEFT JOIN firm f ON f.id=b.firm_id
          ${caFilter}
          ORDER BY listings DESC NULLS LAST, b.name`)).rows;
-    res.json({ brokers: rows, total: rows.length, scope, note: scope === 'all' ? 'all states' : 'California-scoped (CA + unknown; 22 confirmed out-of-state hidden — use ?scope=all to see them)' });
+    res.json({ brokers: rows, total: rows.length, scope, asset_class: ac || 'all', note: scope === 'all' ? 'all states' : 'California-scoped (CA + unknown; 22 confirmed out-of-state hidden — use ?scope=all to see them)' });
   } catch (e) { return serveBrokerSnapshot(res, scope, String(e.message).split('\n')[0]); }
 });

← a4fac77 auto-data-snapshot: 2026-08-14T09:20:46 (2 data files) — dat · back to Commercialrealestate · CRCP: apply asset_class=commercial filter on the snapshot pa 69b35cf →