wire api-vendor-redact middleware: strip vendor field + vendors facet + ?vendor= query from /api/*

50784ee0f9b241dc5e9bd14dd639477c700e1854 · 2026-05-25 21:06:12 -0700 · Steve

Files touched

M server.js

Diff

commit 50784ee0f9b241dc5e9bd14dd639477c700e1854
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:06:12 2026 -0700

    wire api-vendor-redact middleware: strip vendor field + vendors facet + ?vendor= query from /api/*
---
 server.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server.js b/server.js
index 5eed479..13b7736 100644
--- a/server.js
+++ b/server.js
@@ -135,6 +135,10 @@ function sortProducts(list, mode) {
 }
 
 
+// DW fleet middleware: strip `vendor` field + `vendors` facet from all /api/* JSON
+// responses + drop ?vendor= query before downstream handlers. Defense-in-depth so
+// the customer-facing API surface never leaks vendor names even if a route forgets.
+try { app.use(require('../_shared/api-vendor-redact')); } catch (_) {}
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← 6a267e1 fix: /api/facets total counts filtered list (q/aesthetic/ven · back to Greenwallcoverings · redact: rail card meta — replace p.vendor with 'Designer Wal e625c42 →