wire api-vendor-redact middleware + scrub p.vendor render

1301d4426380e7e36e5dbc91433cb75cba8968b4 · 2026-05-25 21:24:34 -0700 · Steve

Mounts ../_shared/api-vendor-redact as the first app.use, above route
registration, so /api/* responses can never leak vendor fields or the
vendors facet map. Also replaces the inline (p.vendor || '') render in
the Ideas rail card with the canonical 'Designer Wallcoverings' string
so the customer-facing HTML matches the API contract.

Files touched

M public/index.html
M server.js

Diff

commit 1301d4426380e7e36e5dbc91433cb75cba8968b4
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:24:34 2026 -0700

    wire api-vendor-redact middleware + scrub p.vendor render
    
    Mounts ../_shared/api-vendor-redact as the first app.use, above route
    registration, so /api/* responses can never leak vendor fields or the
    vendors facet map. Also replaces the inline (p.vendor || '') render in
    the Ideas rail card with the canonical 'Designer Wallcoverings' string
    so the customer-facing HTML matches the API contract.
---
 public/index.html | 2 +-
 server.js         | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/public/index.html b/public/index.html
index ab3325b..8e54842 100644
--- a/public/index.html
+++ b/public/index.html
@@ -1080,7 +1080,7 @@ loadGridPage();
       return '<a class="rail-card" href="/sample/' + encodeURIComponent(p.handle || p.sku) + '">' +
         '<img src="' + url + '" alt="' + (p.title || '').replace(/"/g, '&quot;') + '" loading="lazy">' +
         '<div class="rc-title">' + ((p.title || '').split('|')[0] || '').trim() + '</div>' +
-        '<div class="rc-meta">' + (p.vendor || '') + '</div>' +
+        '<div class="rc-meta">Designer Wallcoverings</div>' +
       '</a>';
     }
     const r1 = document.getElementById('railNewest');
diff --git a/server.js b/server.js
index 3f208df..76baf0c 100644
--- a/server.js
+++ b/server.js
@@ -136,6 +136,7 @@ function sortProducts(list, mode) {
 }
 
 
+app.use(require('../_shared/api-vendor-redact'));
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← 48c62e2 retag aesthetic from PG: 591 rows updated · back to Pastelwallpaper · /api/facets: total counts the filtered list, not the entire d896cb4 →