wire api-vendor-redact middleware as first app.use (strips vendor fields + ?vendor= from /api/*)

f7e42c79dcd667c8670a9820daaa8f3a644b33fe · 2026-05-25 21:39:48 -0700 · Steve

Files touched

M server.js

Diff

commit f7e42c79dcd667c8670a9820daaa8f3a644b33fe
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:39:48 2026 -0700

    wire api-vendor-redact middleware as first app.use (strips vendor fields + ?vendor= from /api/*)
---
 server.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server.js b/server.js
index ce946f6..ae4a1d4 100644
--- a/server.js
+++ b/server.js
@@ -136,6 +136,12 @@ function sortProducts(list, mode) {
 }
 
 
+// FLEET-WIDE STANDING RULE: strip vendor field + vendors facet from /api/* responses
+// (Steve's "DW vendor names NEVER in customer-facing UI" rule, codified 2026-05-20).
+// MUST be the first app.use(...) so it wraps res.json on every /api/* route.
+// Gracefully no-op if the shared module is missing (Kamatera deploys without _shared).
+try { app.use(require('../_shared/api-vendor-redact')); }
+catch (e) { console.warn(`[${__SITE}] api-vendor-redact middleware unavailable: ${e.message}`); }
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← dc447ca scrub p.vendor from Ideas rail card meta (replace with Desig · back to Textilewallpaper · rails: wire /api/sliders into horizontal scroll-snap rail se 26f0de0 →