wire api-vendor-redact middleware (strips vendor/vendors from /api/* + drops ?vendor= query)

3a31d0778864b0ccc50deb495538d1015d87d64c · 2026-05-25 21:20:00 -0700 · Steve

Files touched

M server.js

Diff

commit 3a31d0778864b0ccc50deb495538d1015d87d64c
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:20:00 2026 -0700

    wire api-vendor-redact middleware (strips vendor/vendors from /api/* + drops ?vendor= query)
---
 server.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server.js b/server.js
index 5907ec2..cd8ed90 100644
--- a/server.js
+++ b/server.js
@@ -136,6 +136,10 @@ function sortProducts(list, mode) {
 }
 
 
+// Vendor-redact middleware: strips `vendor`/`vendors` from /api/* responses + drops
+// `?vendor=` query before downstream handlers. Enforces the "DW vendor names NEVER
+// in customer-facing UI" rule at the API surface. Must mount BEFORE route registration.
+app.use(require('../_shared/api-vendor-redact'));
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← 8db4a76 drop p.vendor from rail card meta — render 'Designer Wallcov · back to Museumwallpaper · /api/facets respect q + aesthetic filters so chip counts mat daf22e1 →