`jill-website/claude-review.md`

37 lines

# Claude review of codex patches — jill-website

## Verdict
MIXED — the security patches are directionally correct but the deploy is currently broken and the live site will crash on next restart.

## Where codex got it right
- `src/services/emailService.ts:30,94` — `escapeHtml()` added and applied to all inquiry fields before HTML email interpolation. Clean, correct.
- `src/routes/unsubscribe.ts:3,98` — same `escapeHtml()` pattern; reflected-email XSS closed.
- Body guards on `activities.ts`, `inquiries.ts`, `linkValidation.ts`, `admin.ts` — all return 400 on missing body, no regressions.
- `views/admin.ejs:414,475,497` (round 2) — hardcoded `Authorization: Basic admin:admin123` headers correctly removed; replaced with `credentials: 'same-origin'`. The admin UI will now rely on the session cookie rather than a static credential header.

## Where codex got it wrong or missed (file:line)

**Critical — site will not start:**
- `src/server.ts:62-65` — `requireEnv()` throws at startup if `SITE_USERNAME`, `SITE_PASSWORD`, `SESSION_SECRET`, or `ADMIN_PASSWORD` are absent. The production `.env` (local copy at `/Users/stevestudio2/Projects/jill-website/.env`) contains **none of these four variables**. The PM2 `ecosystem.config.js:11` also does not set them. Any `pm2 restart jill-website` or server reboot will crash the process immediately with an uncaught `Error: Missing required environment variable`. The site is LIVE — this is the highest-priority gap.

**Auth loop introduced:**
- `src/middleware/auth.ts:10` / `views/admin.ejs:414,475,497` — The admin UI now sends `credentials: 'same-origin'`, which passes a session cookie. But `requireAuth` in `auth.ts` checks `req.headers.authorization` (Basic Auth), not the session. There is no session-to-Basic-Auth bridge. Admin CMS calls will all 401/403 until either the auth middleware is updated to read the session or the UI reverts to Basic Auth with the new password.

**Unsubscribe router still not mounted:**
- `src/server.ts` — no `import` or `app.use` for the unsubscribe router anywhere. The fix to `unsubscribe.ts` is correct in isolation, but `/api/unsubscribe` still 404s for every real email link.

**Stale credential hint in UI:**
- `views/admin-login.ejs:179` — still reads `Default credentials: admin / admin123`. Cosmetic but misleading and should be removed.

## Operational concerns codex missed
- The `.env` on Kamatera production almost certainly also lacks the four new required vars. Codex deferred `ecosystem.config.js` as out of scope, but the consequence is **the next PM2 restart kills the live site** without any warning. Steve must add `SITE_USERNAME`, `SITE_PASSWORD`, `SESSION_SECRET`, and `ADMIN_PASSWORD` to the production `.env` (or ecosystem env block) before any restart.
- The Google API keys committed in `.env:31-32` remain live and unrotated — codex flagged this as deferred but these are real keys serving a LIVE site.

## Final action items (priorities)

1. **BEFORE any restart** — add the four required env vars to `/root/Projects/jill-website/.env` on Kamatera (and local `.env`). Values must match whatever the admin UI sends as credentials once session auth is wired.
2. **Fix admin auth loop** — either: (a) update `requireAuth` in `src/middleware/auth.ts` to accept session-authenticated requests, or (b) revert `views/admin.ejs` to send Basic Auth with the new `ADMIN_PASSWORD` env value. Current state leaves the CMS completely non-functional.
3. **Mount unsubscribe router** in `src/server.ts` — one-line fix (`app.use('/api', unsubscribeRouter)`).
4. **Rotate Google API keys** — `AIza_REDACTED_7ETw_was_here` and `${GOOGLE_API_KEY}` are committed in the local `.env` and likely the Kamatera copy. Restrict by referrer/API in Google Cloud Console immediately; rotate if already abused.
5. Remove stale credential hint at `views/admin-login.ejs:179`.