wire api-vendor-redact middleware — strips vendor field + vendors facet + ?vendor= from /api/* responses

a31eac9b1aa32dd633295c40e900fa565ac83170 · 2026-05-25 21:39:13 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit a31eac9b1aa32dd633295c40e900fa565ac83170
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:39:13 2026 -0700

    wire api-vendor-redact middleware — strips vendor field + vendors facet + ?vendor= from /api/* responses
---
 server.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/server.js b/server.js
index 74d2e8e..dd438ab 100644
--- a/server.js
+++ b/server.js
@@ -137,6 +137,9 @@ function sortProducts(list, mode) {
 }
 
 
+// Vendor-redact middleware MUST mount before any /api/* route so it can wrap res.json
+// and strip `vendor` / `vendors` from every JSON response (and drop `?vendor=` query).
+app.use(require('../_shared/api-vendor-redact'));
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js

← 95e6d35 redact vendor name on customer cards + rail tiles (show Desi · back to Wallpapercanada · rails: wire /api/sliders into horizontal scroll-snap rail se 6783aaa →