wire api-vendor-redact middleware as first app.use (fleet-wide vendor redaction at /api/*)

302cec38e1a6093397e263b90182a88cffcfed9c · 2026-05-25 21:15:23 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 302cec38e1a6093397e263b90182a88cffcfed9c
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:15:23 2026 -0700

    wire api-vendor-redact middleware as first app.use (fleet-wide vendor redaction at /api/*)
---
 server.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server.js b/server.js
index 7a19657..4d74c35 100644
--- a/server.js
+++ b/server.js
@@ -138,6 +138,12 @@ function sortProducts(list, mode) {
 }
 
 
+// Fleet-wide vendor redaction at the API surface — strips `vendor` field +
+// `vendors` facet from every /api/* JSON response and drops `?vendor=`. Must
+// be the FIRST app.use so it wraps every downstream route. See standing rule
+// "DW vendor names NEVER in customer-facing UI".
+app.use(require('../_shared/api-vendor-redact'));
+
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js

← 5221241 retag aesthetic from PG: 585 rows updated · back to Hotelwallcoverings · 404-guard: block .bak / .pre-* requests at HTTP surface (def 998d748 →