wire api-vendor-redact middleware as first app.use so /api/* responses strip vendor field + vendors facet and drop ?vendor= query

ae0ab5a1fbd3dd60343aca1ea3715854668908bf · 2026-05-25 21:35:10 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit ae0ab5a1fbd3dd60343aca1ea3715854668908bf
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:35:10 2026 -0700

    wire api-vendor-redact middleware as first app.use so /api/* responses strip vendor field + vendors facet and drop ?vendor= query
---
 server.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server.js b/server.js
index a31f686..0ab1746 100644
--- a/server.js
+++ b/server.js
@@ -124,6 +124,13 @@ function sortProducts(list, mode) {
 }
 
 
+// wire api-vendor-redact middleware — strips `vendor` field + `vendors` facet
+// from any /api/* JSON response and drops `?vendor=` query so vendor names
+// can never leak via the API surface (defense-in-depth on top of the HTML
+// already showing "Designer Wallcoverings"). Mounted as the first app.use so
+// it wraps res.json before any route handler can call it.
+try { app.use(require('../_shared/api-vendor-redact')); }
+catch (e) { console.warn(`[${__SITE}] api-vendor-redact unavailable (${e.message}) — relying on HTML-side redaction only`); }
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← a5f0ebe add noopener,noreferrer to window.open(_blank) sister-site l · back to Silkwallcoverings · rails: wire /api/sliders into horizontal scroll-snap rail se 30c767e →