wire api-vendor-redact middleware (close vendors-facet leak)

6a59c3e79f3a8e7c40cd8afcefd2a2b3457e24af · 2026-05-26 07:19:42 -0700 · Steve

Files touched

M server.js

Diff

commit 6a59c3e79f3a8e7c40cd8afcefd2a2b3457e24af
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 26 07:19:42 2026 -0700

    wire api-vendor-redact middleware (close vendors-facet leak)
---
 server.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server.js b/server.js
index a0fac13..517922f 100644
--- a/server.js
+++ b/server.js
@@ -137,6 +137,10 @@ function sortProducts(list, mode) {
 
 
 app.use(express.json({ limit: "256kb" }));
+
+// Fleet-wide DW vendor-name redactor on /api/* (drops `vendors` facet, replaces
+// any `vendor` field with "Designer Wallcoverings", strips `?vendor=` query).
+app.use(require('../_shared/api-vendor-redact'));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.
 let cfg;

← fb521b9 server: add catch-all 404 guard (JSON for /api/*, plain text · back to Embroideredwallpaper · rails: repoint at real aesthetic buckets so rails fire + edi f6733f2 →