`jill-website/rereview.md`

28 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
src/server.ts:52 — hardcoded fallback secrets — fail-fast env checks added, but deploy env wiring is incomplete — STATUS concern  
src/server.ts:62 — site Basic Auth fallback password — env-only credentials used — STATUS concern  
src/server.ts:69 — hardcoded session secret fallback — env-only session secret used — STATUS concern  
src/middleware/auth.ts:10 — `admin123` fallback — env-only password used, but UI still sends `admin123` — STATUS broken  
.env.example:21 — real/default secrets in example — placeholders added — STATUS good  
src/routes/activities.ts:29 / src/routes/activities.ts:154 — missing body guards — null/missing body now 400 — STATUS good  
src/routes/inquiries.ts:17 — missing body guard — null/missing body now 400 — STATUS good  
src/routes/linkValidation.ts:232 — missing body guard — null/missing body now 400 — STATUS good  
src/routes/admin.ts:110 — missing body guard — null/missing body now 400 — STATUS good  
src/routes/unsubscribe.ts:3 / src/routes/unsubscribe.ts:98 — reflected email HTML injection — query value escaped before render — STATUS good  
src/services/emailService.ts:30 / src/services/emailService.ts:94 — inquiry fields in HTML email — submitted fields escaped before interpolation — STATUS good

## New issues introduced
src/middleware/auth.ts:10 — admin password now comes from `ADMIN_PASSWORD`, but the admin UI still sends `admin:admin123`, so CMS fetch/upload/save calls 403 unless production keeps the old weak password — severity P1  
ecosystem.config.js:11 — PM2 production env only sets `NODE_ENV` and `PORT`; `src/server.ts:62`-`65` now require `SITE_USERNAME`, `SITE_PASSWORD`, `SESSION_SECRET`, and `ADMIN_PASSWORD`, so deploys relying on this config will fail at startup — severity P1

## Missed call-sites (same problem elsewhere)
views/admin.ejs:416 — admin API Basic Auth still hardcodes `admin:admin123`  
views/admin.ejs:480 — upload API Basic Auth still hardcodes `admin:admin123`  
views/admin.ejs:505 — save API Basic Auth still hardcodes `admin:admin123`

## Recommendations
- Update admin UI auth/session flow or remove hardcoded client credentials before shipping the env-only admin password change.
- Add the four required env vars to the deployed process config/secret store. Typecheck could not run here because `tsc` is not installed.