wire api-vendor-redact middleware

3351662bf2ea18d361e8e75486f5c72ecfed3ab2 · 2026-05-25 21:26:58 -0700 · steve

First app.use(): strips vendor field + vendors facet from /api/* JSON
responses, and drops ?vendor= query param before downstream handlers.

Enforces 'DW vendor names NEVER in customer-facing UI' at the API
surface (HTML already redacted). /api/facets emits vendors object and
/api/products accepts ?vendor=, so both triggers fire here.

Files touched

M server.js

Diff

commit 3351662bf2ea18d361e8e75486f5c72ecfed3ab2
Author: steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:26:58 2026 -0700

    wire api-vendor-redact middleware
    
    First app.use(): strips vendor field + vendors facet from /api/* JSON
    responses, and drops ?vendor= query param before downstream handlers.
    
    Enforces 'DW vendor names NEVER in customer-facing UI' at the API
    surface (HTML already redacted). /api/facets emits vendors object and
    /api/products accepts ?vendor=, so both triggers fire here.
---
 server.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server.js b/server.js
index 6b69130..6a74b51 100644
--- a/server.js
+++ b/server.js
@@ -124,6 +124,7 @@ function sortProducts(list, mode) {
 }
 
 
+app.use(require('../_shared/api-vendor-redact'));
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← 09128aa pull-from-shopify: use shared classifier with rails primary, · back to Recycledwallpaper · pre-hydrate density LS to kill FOUC bedfc1a →