`consensus/Designer-Wallcoverings.md`

57 lines

# Consensus — Designer-Wallcoverings
Generated 2026-04-30T23:48:03-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `DW-Agents/ecosystem.config.js:45`, `:72`, `:92`, `:134`, `:176`, `:494`; `brand-router/server.js:11`; `DW-Websites/shop-by-color/server.js:9`: real-looking Shopify/Slack/Anthropic/Zendesk/Postgres secrets are hardcoded. Rotate every exposed credential, purge from files/history/backups, load only from env/secret store.
- `.env:1`, `shopify/.env:1`, `DW-MCP/.env:1`, `DW-Agents/.env:1`: live secret-bearing env files sit inside the project tree. Confirm whether they are tracked/backed up; rotate and move to an untracked secrets location.
- `DW-Agents/dw-agents/agent-legal-team/legal-agent.ts:248-284`, `:1894`, `:2151`: auth middleware is not applied, while unauthenticated routes can run Claude analysis and set Shopify products to draft. Add global auth before routes and separately verify Shopify webhook HMAC.
- `admin/server.ts:19`, `:30`, `:61`, `:421-424`: admin interface falls back to `admin123`, uses `Math.random()` bearer tokens, allows `Access-Control-Allow-Origin: *`, and prints the admin password. Require `ADMIN_PASSWORD`, use `crypto.randomBytes`, restrict CORS, never log secrets.
- `DW-MCP/src/index.js:300-345`: Shopify OAuth callback has no state validation and logs/displays the new access token. Add OAuth `state` validation, authenticate token-generation flow, and never render/log tokens.
- `DW-Agents/dw-agents/agent-slack/slack-agent.ts:275-280`: Slack events endpoint accepts unsigned JSON; `SLACK_SIGNING_SECRET` is defined but unused. Verify Slack request signatures before calling Claude or posting replies.
- `DW-MCP/src/index.js:369-375`: Shopify order webhook reads HMAC but does not verify it. Reject unsigned/invalid webhooks before posting customer/order data to Slack.

## Round-1 applied
## Applied
- admin/server.ts:19 — replaced `ADMIN_PASSWORD` fallback with required env lookup and fail-fast error — removes hardcoded default admin credential.
- admin/server.ts:427 — stopped printing the configured admin password at startup — prevents runtime secret disclosure in logs.
- brand-router/server.js:11 — replaced hardcoded Shopify token with `BRAND_ROUTER_SHOPIFY_TOKEN` and fail-fast check — removes exposed token from source.
- brand-router/server.js:13 — replaced hardcoded Gemini key with `BRAND_ROUTER_GEMINI_API_KEY` and fail-fast check — removes exposed API key from source.
- brand-router/server.js:14 — replaced hardcoded basic-auth password with `BRAND_ROUTER_PASSWORD` and fail-fast check — removes exposed admin password from source.
- DW-Websites/shop-by-color/server.js:9 — replaced hardcoded Shopify token with `SHOP_BY_COLOR_SHOPIFY_TOKEN` and fail-fast check — removes exposed token from source.
- DW-Agents/dw-agents/in-parallel-agent.ts:611 — moved `message` extraction before use and added a 400 guard for missing/invalid body — prevents a request-body crash.
- .env.example:12 — added placeholder env vars for the updated admin, brand-router, and shop-by-color settings — documents required secrets without storing real values.

## Codex re-review verdict: FIX BEFORE SHIP

## New issues introduced
brand-router/create-vendor-collections.js:479 — `/api/regenerate-html` call still authenticates as `admin:DWSecure2024!`; unless `BRAND_ROUTER_PASSWORD` is set to that exact old password, the workflow now gets 401 and HTML regeneration silently degrades to a warning — severity P1

## Round-2 applied
## Round 2 Applied
- brand-router/create-vendor-collections.js:24 — replaced the remaining hardcoded Shopify token with `BRAND_ROUTER_SHOPIFY_TOKEN` and fail-fast validation — fixes the re-review missed call-site at line 24 and the `brand-router/server.js` token patch marked `concern`.
- brand-router/create-vendor-collections.js:29 — added `BRAND_ROUTER_PASSWORD` lookup with fail-fast validation — supports the same auth env var as `brand-router/server.js`, fixing the re-review `STATUS broken` companion-client password finding.
- brand-router/create-vendor-collections.js:487 — replaced the hardcoded `admin:DWSecure2024!` regenerate auth with `admin:${BRAND_ROUTER_PASSWORD}` — fixes the re-review missed call-site and P1 new issue where `/api/regenerate-html` could return 401 after the server password moved to env.
- brand-router/create-vendor-collections.js:490 — made 401 regeneration responses fatal before the Shopify page push — addresses the re-review recommendation to avoid silently pushing stale HTML when auth fails.

## Still deferred for Steve
- P0 — DW-Agents/ecosystem.config.js:45 — hardcoded production-looking secrets — PM2 ecosystem files are explicitly out of scope; rotate real credentials.
- P0 — .env:1 — live secret-bearing env files in project tree — `.env` files were left untouched; confirm tracking/backups and rotate externally.
- P0 — shopify/.env:1 — live secret-bearing env file — `shopify/` is explicitly out of scope; confirm tracking/backups and rotate externally.
- P0 — DW-MCP/.env:1 — live secret-bearing env file — `.env` files were left untouched; confirm tracking/backups and rotate externally.
- P0 — DW-Agents/.env:1 — live secret-bearing env file — `.env` files were left untouched; confirm tracking/backups and rotate externally.
- P0 — DW-Agents/dw-agents/agent-legal-team/legal-agent.ts:248 — missing auth before destructive/Claude routes — auth design and Shopify HMAC validation are beyond the safe list.
- P0 — admin/server.ts:30 — wildcard CORS and weak token generation remain — not included in the approved safe-fix list.
- P0 — DW-MCP/src/index.js:300 — OAuth callback lacks state validation and exposes generated token — auth flow changes are beyond the safe list.
- P0 — DW-Agents/dw-agents/agent-slack/slack-agent.ts:275 — Slack events are not signature-verified — webhook auth change is beyond the safe list.
- P0 — DW-MCP/src/index.js:369 — Shopify order webhook HMAC is not verified — webhook auth change is beyond the safe list.
- P1 — admin/server.ts:362 — failed-products query ignores `sessionId` — database behavior change was deferred because it is outside the safe list.
- P1 — brand-router/server.js:158 — GraphQL query interpolates user input — not one of the approved safe fixes.
- P1 — DW-MCP/monitor-new-orders.js:14 — polling/state ordering can skip or duplicate notifications — requires behavior redesign, not a surgical safe fix.
- P1 — brand-router/server.js:35 — synchronous brand-data read/write can block or race — datastore/concurrency change was deferred.