wire api-vendor-redact middleware (strip vendor field + vendors facet + ?vendor= query from /api/*)

e668625a1b4c6a391c84d737e7849890850cab65 · 2026-05-25 21:30:16 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit e668625a1b4c6a391c84d737e7849890850cab65
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:30:16 2026 -0700

    wire api-vendor-redact middleware (strip vendor field + vendors facet + ?vendor= query from /api/*)
---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index abfc116..b56155e 100644
--- a/server.js
+++ b/server.js
@@ -125,6 +125,11 @@ function sortProducts(list, mode) {
 
 
 app.use(express.json({ limit: "256kb" }));
+// Vendor-name redaction — strip `vendor` field + `vendors` facet from any /api/*
+// response, and drop `?vendor=` query before routes see it. Standing rule:
+// DW vendor names NEVER in customer-facing UI. Mounted FIRST so every route below
+// (including /api/products, /api/facets, /api/sliders) is redacted automatically.
+app.use(require('../_shared/api-vendor-redact'));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.
 let cfg;

← 6b67780 retag aesthetic from PG: 50 rows updated · back to Restorationwallpaper · /api/facets: counts + total reflect filtered list (q + aesth 04071f8 →