wire api-vendor-redact middleware as first app.use — strips vendor field + vendors facet from /api/*

6bb55e323e0d2f2e5d2de15c759cebdce0075925 · 2026-05-25 21:16:34 -0700 · Steve

Files touched

M server.js

Diff

commit 6bb55e323e0d2f2e5d2de15c759cebdce0075925
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:16:34 2026 -0700

    wire api-vendor-redact middleware as first app.use — strips vendor field + vendors facet from /api/*
---
 server.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server.js b/server.js
index 94b2f2e..945f29f 100644
--- a/server.js
+++ b/server.js
@@ -52,6 +52,10 @@ let PRODUCTS_NICHE = [];
 
 
 const app = express();
+// Fleet-wide vendor redaction at the API surface — never leak vendor names to
+// customer-facing JSON. MUST be first app.use() so it wraps res.json before any
+// route registers. See _shared/api-vendor-redact.js.
+app.use(require('../_shared/api-vendor-redact'));
 // DW STANDARD: sort by color/style/sku/title for any product-rendering site.
 const COLOR_RANK = {
   black:0,gray:1,grey:1,silver:2,white:3,ivory:4,cream:5,beige:6,brown:7,tan:8,khaki:9,copper:10,

← c45bd1a retag aesthetic from PG: 45 rows updated · back to Madagascarwallpaper · /api/facets now honors q/aesthetic/vendor filters — total re a8b0e7f →