wire api-vendor-redact middleware as first app.use — strips vendor field + vendors facet + ?vendor= from /api/* surface

4abb6496815597365e4360ec801f0b5a39e32cba · 2026-05-25 21:27:27 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 4abb6496815597365e4360ec801f0b5a39e32cba
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:27:27 2026 -0700

    wire api-vendor-redact middleware as first app.use — strips vendor field + vendors facet + ?vendor= from /api/* surface
---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index 26cef67..b8398c3 100644
--- a/server.js
+++ b/server.js
@@ -124,6 +124,11 @@ function sortProducts(list, mode) {
 }
 
 
+// Vendor-redact middleware MUST be the first app.use() so it wraps res.json
+// on every /api/* response (strips `vendor` field + `vendors` facet + drops
+// any `?vendor=` query) before any route handler runs.
+try { app.use(require('../_shared/api-vendor-redact')); }
+catch (e) { console.error(`[${__SITE}] api-vendor-redact unavailable (${e.message})`); }
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← 7d76b99 noopener noreferrer on window.open('_blank') sister-site nav · back to Raffiawalls · homepage: add Ideas rails block (New this week + Curated pic 7617c21 →