app: Basic-auth base64 for George + .env loader (secrets stay in 600 file)

8a2e5c4d9d92db49619b3b763a4664086d4cf6f9 · 2026-08-17 14:12:23 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 8a2e5c4d9d92db49619b3b763a4664086d4cf6f9
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Aug 17 14:12:23 2026 -0700

    app: Basic-auth base64 for George + .env loader (secrets stay in 600 file)
---
 server.js | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 6562943..addf199 100644
--- a/server.js
+++ b/server.js
@@ -6,6 +6,17 @@ const http = require('http');
 const fs = require('fs');
 const path = require('path');
 
+// minimal .env loader (so secrets live in a 600 file, not the process listing)
+try {
+  const envf = path.join(__dirname, '.env');
+  if (fs.existsSync(envf)) {
+    for (const line of fs.readFileSync(envf, 'utf8').split('\n')) {
+      const m = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.*)$/);
+      if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^["']|["']$/g, '');
+    }
+  }
+} catch {}
+
 const PORT = Number(process.env.PORT || readPort() || 9788);
 const OFFER_TO = process.env.OFFER_TO || 'steve@designerwallcoverings.com';
 const GEORGE = process.env.GEORGE_URL || 'http://127.0.0.1:9850/api/send';
@@ -117,7 +128,11 @@ async function forwardGeorge(payload) {
       const u = new URL(GEORGE);
       const headers = { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) };
       if (GEORGE_TOKEN) {
-        headers[GEORGE_AUTH_HEADER] = GEORGE_AUTH_SCHEME === 'raw' ? GEORGE_TOKEN : `${GEORGE_AUTH_SCHEME} ${GEORGE_TOKEN}`;
+        let val;
+        if (GEORGE_AUTH_SCHEME === 'raw') val = GEORGE_TOKEN;
+        else if (GEORGE_AUTH_SCHEME === 'Basic') val = 'Basic ' + (GEORGE_TOKEN.includes(':') ? Buffer.from(GEORGE_TOKEN).toString('base64') : GEORGE_TOKEN);
+        else val = `${GEORGE_AUTH_SCHEME} ${GEORGE_TOKEN}`;
+        headers[GEORGE_AUTH_HEADER] = val;
       }
       const req = http.request({ hostname: u.hostname, port: u.port, path: u.pathname, method: 'POST',
         headers, timeout: 8000 },

← 82ea4eb app: admin inquiries viewer (Basic Auth, created date+time) · back to Domain Landings · app: George payload uses body field (was text) — fixes offer 45f9842 →