wire api-vendor-redact middleware + 404-guard for .bak/.pre-* files

b9f92f09ccd759056a02a554f1eba2e911270193 · 2026-05-25 21:35:27 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit b9f92f09ccd759056a02a554f1eba2e911270193
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:35:27 2026 -0700

    wire api-vendor-redact middleware + 404-guard for .bak/.pre-* files
---
 server.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.js b/server.js
index 80bbfe2..d89ff4d 100644
--- a/server.js
+++ b/server.js
@@ -138,6 +138,16 @@ function sortProducts(list, mode) {
 }
 
 
+// MUST mount BEFORE any /api/* route registration — strips `vendor` field +
+// `vendors` facet from JSON responses and drops `?vendor=` query, enforcing
+// Steve's standing "no vendor names in customer-facing UI" rule at API surface.
+app.use(require('../_shared/api-vendor-redact'));
+// 404-guard for backup/pre-fix snapshot files — never serve them even if they
+// slip into a deploy dir (defense-in-depth alongside .gitignore + rsync excludes).
+app.use((req, res, next) => {
+  if (/\.(bak|pre-[^/]+)(\.|$)/i.test(req.path)) return res.status(404).send('Not found');
+  next();
+});
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js

← 604360a untrack server.js.pre-sort-skill (covered by .gitignore + 40 · back to Silkwallpaper · add clean-URL routes for history/vocabulary/sourcing/care/tr 3bb8b98 →