wire api-vendor-redact middleware on customer-facing /api/* routes

a872e3914082587cee1d3342cd304b50fd214890 · 2026-05-25 21:39:07 -0700 · Steve

Files touched

M server.js

Diff

commit a872e3914082587cee1d3342cd304b50fd214890
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:39:07 2026 -0700

    wire api-vendor-redact middleware on customer-facing /api/* routes
---
 server.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server.js b/server.js
index 4d07969..b774ab9 100644
--- a/server.js
+++ b/server.js
@@ -136,6 +136,10 @@ function sortProducts(list, mode) {
 }
 
 
+// Fleet-wide vendor redaction at the API surface — strips `vendor` field,
+// drops `vendors` facet, and drops `?vendor=` query param on /api/* routes.
+// Enforces standing rule "DW vendor names NEVER in customer-facing UI".
+app.use(require('../_shared/api-vendor-redact'));
 app.use(express.json({ limit: "256kb" }));
 // Site config — prefer _shared/site-config (canonical) but fall back to an
 // inline minimal loader so this server.js is self-contained on Kamatera.

← a9a5427 remove p.vendor render on customer rail card (Designer Wallc · back to Vinylwallpaper · filter /api/facets counts by q+aesthetic so chip totals matc e51e34e →