wire api-vendor-redact middleware — strips vendor field and vendors facet from /api/* JSON responses

b52f48c30564886153d03eaeef4b6f5cc3762e9c · 2026-05-25 21:11:45 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit b52f48c30564886153d03eaeef4b6f5cc3762e9c
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:11:45 2026 -0700

    wire api-vendor-redact middleware — strips vendor field and vendors facet from /api/* JSON responses
---
 server.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/server.js b/server.js
index cc5a0b5..60ab78c 100644
--- a/server.js
+++ b/server.js
@@ -138,6 +138,8 @@ function sortProducts(list, mode) {
 
 
 app.use(helmet({ contentSecurityPolicy: false }));
+// Strip `vendor` field + `vendors` facet from JSON API responses (DW standing rule).
+app.use(require('../_shared/api-vendor-redact'));
 app.use(express.json({ limit: '256kb' }));
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js
 require('./_universal-contact')(app, { siteName: "Hospitality Wallcoverings", zdColor: "#d4a847", zdPosition: 'right' });

← 762efdd remove p.vendor render on rail cards; replace with Designer · back to Hospitalitywallcoverings · /api/facets total now reflects filtered (niche) list, not ra 1373dbd →