wire api-vendor-redact middleware as first app.use — strips vendor names from /api/* responses

2dcc80ce6b5a45be5cd41d1c1642573eee8aa2d6 · 2026-05-25 21:31:27 -0700 · Steve

Files touched

M server.js

Diff

commit 2dcc80ce6b5a45be5cd41d1c1642573eee8aa2d6
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:31:27 2026 -0700

    wire api-vendor-redact middleware as first app.use — strips vendor names from /api/* responses
---
 server.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/server.js b/server.js
index 3976d1f..a06361e 100644
--- a/server.js
+++ b/server.js
@@ -82,6 +82,9 @@ function sortProducts(list, mode) {
 }
 
 const app = express();
+// Strip vendor names from all /api/* JSON responses (standing rule: DW vendor
+// names NEVER in customer-facing UI). Must be mounted BEFORE route handlers.
+app.use(require('../_shared/api-vendor-redact'));
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← db65a0c remove p.vendor render from ideas rail — show 'Designer Wall · back to Selfadhesivewallpaper · rails: wire /api/sliders into horizontal scroll-snap rail se 7a62b2e →