wire api-vendor-redact middleware as first app.use() — strips vendor field + vendors facet from /api/* responses

b3bdcce6c7e53506ce44f746726a38988bcb0a8f · 2026-05-25 21:31:38 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit b3bdcce6c7e53506ce44f746726a38988bcb0a8f
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:31:38 2026 -0700

    wire api-vendor-redact middleware as first app.use() — strips vendor field + vendors facet from /api/* responses
---
 server.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server.js b/server.js
index 1222ccb..cd18ca9 100644
--- a/server.js
+++ b/server.js
@@ -139,6 +139,12 @@ function sortProducts(list, mode) {
 }
 
 
+// Vendor redaction at the API surface — strips `vendor` field from JSON
+// bodies, drops the top-level `vendors` facet map, and ignores ?vendor=
+// query filters. MUST be mounted BEFORE any /api/* route registration so it
+// wraps res.json() on every downstream handler.
+app.use(require('../_shared/api-vendor-redact'));
+
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));

← 21a9a16 pull-from-shopify: use shared classifier with rails primary, · back to Retrowalls · redact p.vendor on Ideas rail — replace with 'Designer Wallc f096823 →