wire api-vendor-redact middleware: strip p.vendor + vendors facet from /api/* responses

023a7b670ebb38201484404a8fb4930d2061533a · 2026-05-25 21:19:11 -0700 · steve

Files touched

M server.js

Diff

commit 023a7b670ebb38201484404a8fb4930d2061533a
Author: steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:19:11 2026 -0700

    wire api-vendor-redact middleware: strip p.vendor + vendors facet from /api/* responses
---
 server.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/server.js b/server.js
index a6f0f85..3defcd7 100644
--- a/server.js
+++ b/server.js
@@ -136,6 +136,9 @@ function sortProducts(list, mode) {
 }
 
 
+// Vendor-redact middleware MUST mount first so /api/products + /api/facets
+// never leak vendor names (DW standing rule).
+app.use(require('../_shared/api-vendor-redact'));
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← 6913937 retag aesthetic from PG: 12 rows updated · back to Micawallpaper · remove p.vendor render on Ideas rail card meta (replace with cd37784 →