wire api-vendor-redact middleware (strips vendor field + vendors facet + ?vendor= from /api/*)

21bacb85676b1330c7c155aeac950ce968988b78 · 2026-05-25 21:27:42 -0700 · Steve

Files touched

M server.js

Diff

commit 21bacb85676b1330c7c155aeac950ce968988b78
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:27:42 2026 -0700

    wire api-vendor-redact middleware (strips vendor field + vendors facet + ?vendor= from /api/*)
---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index 48bee41..4a09e5f 100644
--- a/server.js
+++ b/server.js
@@ -53,6 +53,11 @@ let PRODUCTS_NICHE = [];
 
 
 const app = express();
+// Vendor-redact middleware — strips `vendor` field + `vendors` facet from /api/*
+// JSON responses and drops `?vendor=` query. MUST mount BEFORE any other route
+// registration (helmet, _universal-contact, /api/* handlers). Standing rule:
+// "DW vendor names NEVER in customer-facing UI" (codified 2026-05-20).
+app.use(require('../_shared/api-vendor-redact'));
 // Security headers via helmet (added 2026-05-04 overnight YOLO loop)
 // DW STANDARD: sort by color/style/sku/title for any product-rendering site.
 const COLOR_RANK = {

← 463e02d retag aesthetic from PG: 600 rows updated · back to Restaurantwallpaper · remove p.vendor render on Ideas rail (replace with 'Designer df39dce →