← back to Approvals Viewer

approvals-viewer: re-enable Basic auth + pin default port 9795 (public via CF tunnel)

06062c8e34bb7b078330f1706778e86b2a431df1 · 2026-08-11 12:48:58 -0700 · Steve Abrams

Files touched

• M server.js

Diff

commit 06062c8e34bb7b078330f1706778e86b2a431df1
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Aug 11 12:48:58 2026 -0700

    approvals-viewer: re-enable Basic auth + pin default port 9795 (public via CF tunnel)
---
 server.js | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/server.js b/server.js
index 1c807bb..fa67f7f 100644
--- a/server.js
+++ b/server.js
@@ -21,9 +21,13 @@ function listMemos(){return fs.readdirSync(QUEUE).filter(f=>f.endsWith('.md')&&!
 }).sort((a,b)=>new Date(b.mtime)-new Date(a.mtime));}
 function send(res,c,b,t='application/json'){res.writeHead(c,{'Content-Type':t});res.end(b);}
 http.createServer((req,res)=>{
- // auth disabled: 127.0.0.1-only local tool
- if(req.url==='/'||req.url==='/index.html')return send(res,200,fs.readFileSync(path.join(__dirname,'public/index.html')),'text/html');
+ // /healthz stays open (uptime/keep-alive probes); everything else requires Basic auth.
+ // NOTE: exposed publicly via CF tunnel at approvals.agentabrams.com — auth MUST stay on.
  if(req.url==='/healthz')return send(res,200,'ok','text/plain');
+ const hdr=req.headers.authorization||'';
+ if(!(hdr.startsWith('Basic ')&&Buffer.from(hdr.slice(6),'base64').toString()===USER+':'+PASS)){
+   res.writeHead(401,{'WWW-Authenticate':'Basic realm="Approval Command Center"'});return res.end('auth required');}
+ if(req.url==='/'||req.url==='/index.html')return send(res,200,fs.readFileSync(path.join(__dirname,'public/index.html')),'text/html');
  if(req.url==='/api/memos')return send(res,200,JSON.stringify(listMemos()));
  if(req.url==='/api/decide'&&req.method==='POST'){let d='';req.on('data',c=>d+=c);req.on('end',()=>{try{
    const{file,decision}=JSON.parse(d);if(!/^[\w.\-]+\.md$/.test(file))throw new Error('bad file');
@@ -38,4 +42,4 @@ http.createServer((req,res)=>{
    fs.appendFileSync(LOG,JSON.stringify({ts:new Date().toISOString(),file,decision:'undo:'+decision})+'\n');send(res,200,'{"ok":true}');
  }catch(e){send(res,400,JSON.stringify({error:String(e.message)}));}});return;}
  send(res,404,'nf','text/plain');
-}).listen(process.env.PORT||9788,'127.0.0.1',function(){const port=this.address().port;fs.writeFileSync(path.join(__dirname,'.port'),String(port));console.log('approvals-viewer http://127.0.0.1:'+port+' (admin/DW2024!)');});
+}).listen(process.env.PORT||9795,'127.0.0.1',function(){const port=this.address().port;fs.writeFileSync(path.join(__dirname,'.port'),String(port));console.log('approvals-viewer http://127.0.0.1:'+port+' (admin/DW2024!)');});

← 33ba103 drop basic-auth (localhost-only tool)  ·  back to Approvals Viewer  ·  approvals-viewer UI: always show action buttons + fetch erro f3b563d →