wire api-vendor-redact middleware (top of stack, defense-in-depth on /api/facets vendors + /api/products ?vendor=)

7c6f0d281d361094d36f3aa095a9e4dd07544ae9 · 2026-05-25 21:12:12 -0700 · Steve

Files touched

M server.js

Diff

commit 7c6f0d281d361094d36f3aa095a9e4dd07544ae9
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:12:12 2026 -0700

    wire api-vendor-redact middleware (top of stack, defense-in-depth on /api/facets vendors + /api/products ?vendor=)
---
 server.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server.js b/server.js
index a274f39..d9a5a2c 100644
--- a/server.js
+++ b/server.js
@@ -53,6 +53,12 @@ let PRODUCTS_NICHE = [];
 
 
 const app = express();
+// DW STANDARD: strip `vendor` field + `vendors` facet from any /api/* response
+// before downstream handlers see them. MUST be the first middleware so it
+// wraps res.json before route handlers register their own JSON responses.
+try { app.use(require('../_shared/api-vendor-redact')); } catch (e) {
+  console.error(`[${__SITE}] api-vendor-redact unavailable (${e.message}) — proceeding without`);
+}
 // Security headers via helmet (added 2026-05-04 overnight YOLO loop)
 // DW STANDARD: sort by color/style/sku/title for any product-rendering site.
 const COLOR_RANK = {

← 4c88b87 retag aesthetic from PG: 598 rows updated · back to Hospitalitywallpaper · fix /api/facets total: count the niche-filtered list users s 06046ea →