wallco: mount _shared/api-vendor-redact -> proxy product image_url to /img/<token> in /api/search + /api/match-photo (kills vendor-name-in-CDN-filename leak)

e7401b711b7b6ac6dd2a5693f5257c63637465cf · 2026-06-03 21:10:33 -0700 · Steve

Files touched

M server.js

Diff

commit e7401b711b7b6ac6dd2a5693f5257c63637465cf
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Jun 3 21:10:33 2026 -0700

    wallco: mount _shared/api-vendor-redact -> proxy product image_url to /img/<token> in /api/search + /api/match-photo (kills vendor-name-in-CDN-filename leak)
---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index 428374f..a803540 100644
--- a/server.js
+++ b/server.js
@@ -49,6 +49,11 @@ const upload = multer({
 
 const app = express();
 
+// Vendor-neutral: scrub vendor names + proxy image_url CDN urls -> /img/<token> in all
+// /api JSON, and serve GET /img/:token. wallco renders product <img> client-side from
+// /api/search + /api/match-photo responses, so this one mount covers its leak surface.
+app.use(require('../_shared/api-vendor-redact'));
+
 app.get(['/favicon.ico','/favicon.svg'], (req, res) => res.sendFile(require('path').join(__dirname, 'public', req.path.slice(1))));
 app.use(express.json({ limit: '2mb' }));
 app.use((_req, res, next) => {

← 652c5c2 Scrub residual vendor names from products.json (title/vendor · back to Wallco · (newest)