wire api-vendor-redact middleware (close vendors-facet leak)

0afc08a6ee1073a90f94401d6d51c8d56c57d288 · 2026-05-26 07:19:42 -0700 · Steve

Files touched

M server.js

Diff

commit 0afc08a6ee1073a90f94401d6d51c8d56c57d288
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 26 07:19:42 2026 -0700

    wire api-vendor-redact middleware (close vendors-facet leak)
---
 server.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server.js b/server.js
index 726af29..9d89ffd 100644
--- a/server.js
+++ b/server.js
@@ -55,6 +55,10 @@ const app = express();
 // Security headers via helmet (added 2026-05-04 overnight YOLO loop)
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));
+
+// Fleet-wide DW vendor-name redactor on /api/* (drops `vendors` facet, replaces
+// any `vendor` field with "Designer Wallcoverings", strips `?vendor=` query).
+app.use(require('../_shared/api-vendor-redact'));
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js
 require('./_universal-contact')(app, { siteName: "Cork Wallcovering", zdColor: "#a87030", zdPosition: 'right' });
 require('./_universal-auth')(app, { siteName: "corkwallcovering" });

← 5c69aee redact p.vendor in rail-card (Ideas rails) — show Designer W · back to Corkwallcovering · rails: editorial labels for firing aesthetic buckets 5f805b5 →