`NEEDS_AUTH.md`

34 lines
# Public POST endpoints lacking auth — worklist
Built 2026-04-30T23:45:20-07:00. Cross-project list of public mutating routes that codex flagged.

## Designer-Wallcoverings
- - `DW-Agents/dw-agents/agent-legal-team/legal-agent.ts:248-284`, `:1894`, `:2151`: auth middleware is not applied, while unauthenticated routes can run Claude analysis and set Shopify products to draft. Add global auth before routes and separately verify Shopify webhook HMAC.
- - `DW-MCP/src/index.js:369-375`: Shopify order webhook reads HMAC but does not verify it. Reject unsigned/invalid webhooks before posting customer/order data to Slack.

## Norma
- - `app/api/pulse/petitions/route.ts:111-182`: unauthenticated public POST creates immediately active petitions with no rate limit, moderation, captcha, or abuse controls. Default to draft/moderation and add IP/user rate limiting.

## professional-directory
- - [agents/api-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/api-agent/server.js:18), [agents/ingest-agent/server.js](/Users/stevestudio2/Projects/professional-directory/agents/ingest-agent/server.js:47): no auth on mutating/control endpoints; localhost CSRF or any proxy exposure can trigger imports, opt-outs, or CRM edits. Add shared auth middleware, Origin checks, and protect all `POST` routes.

## resize-it
- - [server.py:29](/Users/stevestudio2/Projects/resize-it/server.py:29), [server.py:103](/Users/stevestudio2/Projects/resize-it/server.py:103), [server.py:155](/Users/stevestudio2/Projects/resize-it/server.py:155): no auth on endpoints that use stored Spoonflower credentials. Add owner auth/token gate; especially block public `/api/upload-to-spoonflower`.

## site-factory
- - `orchestrator/server.js:15`, `orchestrator/server.js:37`, `orchestrator/server.js:96`, `orchestrator/server.js:130`, `orchestrator/server.js:164`, `orchestrator/server.js:180`: orchestrator has open CORS and no auth on write routes. Add shared bearer auth, restrict CORS, expose only behind admin.
- - `critic/server.js:112-148`, `critic/SELF-CRITIQUE.md:17-22`: `/critique/stub` can post arbitrary findings and has no auth/rate limit. Gate it behind dev-only/shared secret.

## stayclaim
- - `src/app/admin/layout.tsx:45-46`, `src/app/admin/data/page.tsx:167-192`: admin is explicitly unauthenticated and exposes claim/sponsored emails. Put real server-side auth in front of all `/admin/*`, plus nginx deny until ready.

## the-ai-factory
- - `server.js:67`, `server.js:95`, `server.js:31`: no auth plus `Access-Control-Allow-Origin: *`; any webpage Steve visits can POST to localhost and trigger builds/activation. Fix: require `ADMIN_TOKEN` Bearer auth on all mutating routes and restrict CORS to the viewer origin.

## VictoryStays
- - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:81): `GET /api/claim?admin=1` returns every claim, PII, and verification codes with no auth. Fix: require operator auth/session or remove public route.
- - [api-claim.js](/Users/stevestudio2/Projects/VictoryStays/api-claim.js:103): unauthenticated `PATCH /api/claim` can mark any claim verified/rejected; code check is optional. Fix: authenticate operator actions and require code for verification.

## visual-factory
- - `server.js:223`, `server.js:257`, `server.js:279`, `server.js:326`, `server.js:362`: no auth/CSRF on create, retry, delete, activate, IG post. Any local webpage/process reaching `127.0.0.1:9892` can trigger destructive POSTs. Fix with required admin token plus Origin/CSRF checks.