Gate crcp.agentabrams.com behind Basic Auth (admin/DW2024!); open /healthz for smoke test

66769260d5c12fc588c740cad3f05cd2e791e328 · 2026-07-08 06:23:21 -0700 · Steve Abrams

Files touched

M .deploy.conf
M scripts/serve.js

Diff

commit 66769260d5c12fc588c740cad3f05cd2e791e328
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Jul 8 06:23:21 2026 -0700

    Gate crcp.agentabrams.com behind Basic Auth (admin/DW2024!); open /healthz for smoke test
---
 .deploy.conf     |  2 +-
 scripts/serve.js | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/.deploy.conf b/.deploy.conf
index 96712a7..11b99a8 100644
--- a/.deploy.conf
+++ b/.deploy.conf
@@ -1,6 +1,6 @@
 PROJECT_NAME=commercialrealestate
 DEPLOY_PATH=/root/public-projects/commercialrealestate
-HEALTH_URL=http://localhost:9911/
+HEALTH_URL=http://localhost:9911/healthz
 INSTALL_CMD="npm ci --omit=dev"
 BUILD_CMD=""
 REQUIRED_ENVS=""
diff --git a/scripts/serve.js b/scripts/serve.js
index b2b9f61..4c8914e 100644
--- a/scripts/serve.js
+++ b/scripts/serve.js
@@ -32,6 +32,25 @@ const PORT = process.env.PORT || 9911;
 const app = express();
 app.use(express.json({ limit: '256kb' }));
 
+// ── Whole-site Basic Auth gate (Steve 2026-07-08) ───────────────────────────────────
+// crcp.agentabrams.com was fully public; now every page, clean-URL route, /data static dir,
+// and /api endpoint sits behind a username/password because this middleware is mounted BEFORE
+// all routes. Credentials are env-overridable (CRCP_USER/CRCP_PASS); default is the house DW login.
+// /healthz stays OPEN so the deploy smoke-test + uptime canaries get a 200 without credentials.
+const AUTH_USER = process.env.CRCP_USER || 'admin';
+const AUTH_PASS = process.env.CRCP_PASS || 'DW2024!';
+app.get('/healthz', (req, res) => res.type('text').send('ok'));
+app.use((req, res, next) => {
+  const hdr = req.headers.authorization || '';
+  const [scheme, encoded] = hdr.split(' ');
+  if (scheme === 'Basic' && encoded) {
+    const [u, ...rest] = Buffer.from(encoded, 'base64').toString().split(':');
+    if (u === AUTH_USER && rest.join(':') === AUTH_PASS) return next();
+  }
+  res.set('WWW-Authenticate', 'Basic realm="CRCP (crcp.agentabrams.com)", charset="UTF-8"');
+  return res.status(401).send('Authentication required');
+});
+
 // Arcstone-relationship flag (SQL). A broker/agent is flagged if Arcstone has a
 // prior relationship: (1) already pitched/contacted (broker_pitch), (2) co-listed
 // a property with an Arcstone broker (Frank id 5356) via broker_listing, (3) is a

← 08981d0 auto-save: 2026-07-08T06:04:21 (2 files) — data/qwen-cache.j · back to Commercialrealestate · chore: version bump v0.4.1 (session close — auth gate) bea08ab →