wire api-vendor-redact middleware first — strip vendor + vendors + ?vendor= from /api/*

0edb943327f26503e95e5c46a04f992fcc763525 · 2026-05-25 21:26:25 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 0edb943327f26503e95e5c46a04f992fcc763525
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:26:25 2026 -0700

    wire api-vendor-redact middleware first — strip vendor + vendors + ?vendor= from /api/*
---
 server.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server.js b/server.js
index 1a442ae..0bce6f8 100644
--- a/server.js
+++ b/server.js
@@ -137,6 +137,10 @@ function sortProducts(list, mode) {
 }
 
 
+// Strip vendor field + vendors facet + ?vendor= query from /api/* responses
+// (fleet-wide standing rule: DW vendor names NEVER in customer-facing UI).
+// Must be FIRST so it wraps every route's res.json() — including admin-catalog.
+app.use(require('../_shared/api-vendor-redact'));
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js

← 7c5839b drop p.vendor render on Ideas rail-card (replace with 'Desig · back to Raffiawallcoverings · homepage: add retrowalls-canonical rail-sections (id=rails + 036a76d →