wire api-vendor-redact middleware as first app.use — strips vendor field + vendors facet from /api/* responses

4b059a9bee84129698ac68830b9c9def5b72367d · 2026-05-25 21:18:43 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 4b059a9bee84129698ac68830b9c9def5b72367d
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:18:43 2026 -0700

    wire api-vendor-redact middleware as first app.use — strips vendor field + vendors facet from /api/* responses
---
 server.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/server.js b/server.js
index d778aa6..c3c3e57 100644
--- a/server.js
+++ b/server.js
@@ -53,6 +53,11 @@ let PRODUCTS_NICHE = [];
 
 
 const app = express();
+// VENDOR REDACT — strip `vendor` field + `vendors` facet from /api/* responses
+// (Steve standing rule: DW vendor names NEVER in customer-facing UI). Must be
+// the FIRST app.use(...) so it wraps res.json() before any /api/* handler runs.
+try { app.use(require('../_shared/api-vendor-redact')); }
+catch (e) { console.error(`[${__SITE}] api-vendor-redact unavailable: ${e.message}`); }
 // Security headers via helmet (added 2026-05-04 overnight YOLO loop)
 // DW STANDARD: sort by color/style/sku/title for any product-rendering site.
 const COLOR_RANK = {
@@ -144,6 +149,12 @@ app.use(express.json({ limit: '256kb' }));
 require('./_universal-contact')(app, { siteName: "Metallic Wallpaper", zdColor: "#d4a847", zdPosition: 'right' });
 require('./_universal-auth')(app, { siteName: "metallicwallpaper" });
 
+// Belt-and-suspenders 404-guard — never serve backup/pre-* artifacts even if
+// they accidentally land in public/ at deploy time.
+app.use((req, res, next) => {
+  if (/\.(bak|pre-[^/]+)(\.[^/]+)?$|\.bak\.|\.pre-/i.test(req.path)) return res.status(404).end();
+  next();
+});
 app.use(express.static(path.join(__dirname, 'public'), { extensions: ['html'] }));
 
 app.get('/api/products', (req, res) => {

← 16f9e02 retag aesthetic from PG: 190 rows updated · back to Metallicwallpaper · redact p.vendor on rail-card + noopener noreferrer on target 2a59cae →