wire api-vendor-redact middleware as first app.use()

cee03af55bc7a5503804e7c419e079817a6836ed · 2026-05-25 21:20:48 -0700 · Steve

Mounts ../_shared/api-vendor-redact so /api/facets stops emitting the
vendors{} map and /api/products strips ?vendor= filter. Defense-in-depth
behind the HTML scrub already in place on the customer-facing pages.

Author: steve@designerwallcoverings.com

Files touched

M server.js

Diff

commit cee03af55bc7a5503804e7c419e079817a6836ed
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:20:48 2026 -0700

    wire api-vendor-redact middleware as first app.use()
    
    Mounts ../_shared/api-vendor-redact so /api/facets stops emitting the
    vendors{} map and /api/products strips ?vendor= filter. Defense-in-depth
    behind the HTML scrub already in place on the customer-facing pages.
    
    Author: steve@designerwallcoverings.com
---
 server.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server.js b/server.js
index eeb9f8c..4495047 100644
--- a/server.js
+++ b/server.js
@@ -52,6 +52,10 @@ let PRODUCTS_NICHE = [];
 
 
 const app = express();
+// Fleet-wide vendor redaction at the API surface — never leak vendor names to
+// customer-facing JSON. MUST be first app.use() so it wraps res.json before any
+// route registers. See _shared/api-vendor-redact.js.
+app.use(require('../_shared/api-vendor-redact'));
 // DW STANDARD: sort by color/style/sku/title for any product-rendering site.
 const COLOR_RANK = {
   black:0,gray:1,grey:1,silver:2,white:3,ivory:4,cream:5,beige:6,brown:7,tan:8,khaki:9,copper:10,

← a301390 retag aesthetic from PG: 93 rows updated · back to Mylarwallpaper · /api/facets: total + aesthetics counts now reflect filtered e1f6a3c →