wire api-vendor-redact middleware (above all route registration; strips vendor field + vendors facet + ?vendor= query for /api/* responses)

57702bfc600c5c90610f931f1d7df1503109707e · 2026-05-25 21:24:42 -0700 · Steve

Files touched

M server.js

Diff

commit 57702bfc600c5c90610f931f1d7df1503109707e
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:24:42 2026 -0700

    wire api-vendor-redact middleware (above all route registration; strips vendor field + vendors facet + ?vendor= query for /api/* responses)
---
 server.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server.js b/server.js
index 2e98158..4c892ac 100644
--- a/server.js
+++ b/server.js
@@ -135,6 +135,12 @@ function sortProducts(list, mode) {
 }
 
 
+// Fleet-wide vendor redaction at the API surface. Mount BEFORE any /api/*
+// route registration (incl. _universal-contact/_auth) so it wraps res.json
+// for every JSON response and strips ?vendor= query before downstream
+// handlers see it. Enforces "DW vendor names NEVER in customer-facing UI"
+// at the API edge as well as HTML.
+app.use(require('../_shared/api-vendor-redact'));
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← 6367dcb rail-card meta: render Designer Wallcoverings instead of p.v · back to Naturalwallcoverings · homepage: add retrowalls-canonical rail-sections (id=rails + b87a36d →