[object Object]

← back to Dw Boardroom V2

security: env-ify 4 boardroom files leaking DWSecure2024! plaintext (serve.cjs, api.ts, auth.ts, governanceClient.ts)

7cd839e8e00a5c356565e300b40c393a03ad49d5 · 2026-06-23 17:34:41 -0700 · Steve

Files touched

Diff

commit 7cd839e8e00a5c356565e300b40c393a03ad49d5
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Jun 23 17:34:41 2026 -0700

    security: env-ify 4 boardroom files leaking DWSecure2024! plaintext (serve.cjs, api.ts, auth.ts, governanceClient.ts)
---
 frontend/serve.cjs             | 3 ++-
 frontend/src/api.ts            | 6 +++++-
 src/api/middleware/auth.ts     | 3 ++-
 src/engine/governanceClient.ts | 4 +++-
 4 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/frontend/serve.cjs b/frontend/serve.cjs
index 55e44b1..7c6d3a3 100644
--- a/frontend/serve.cjs
+++ b/frontend/serve.cjs
@@ -5,7 +5,8 @@ const path = require('path');
 
 const PORT = 4050;
 const USER = 'admin';
-const PASS = 'REDACTED_PASSWORD';
+const PASS = process.env.BOARDROOM_AUTH_PASS || process.env.AUTH_PASS;
+if (!PASS) throw new Error('BOARDROOM_AUTH_PASS not set — route via /secrets');
 const DIST = path.join(__dirname, 'dist');
 
 const MIME = {
diff --git a/frontend/src/api.ts b/frontend/src/api.ts
index a528de5..c7f2ec8 100644
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -1,5 +1,9 @@
 const BASE = 'http://45.61.58.125:4040';
-const AUTH = btoa('admin:REDACTED_PASSWORD');
+// NOTE: this Basic-Auth pair ships in the browser bundle; a build-time inject only
+// obscures it, it is not a real secret boundary. Tracked source must not carry the
+// literal — set VITE_BOARDROOM_AUTH_PASS at build time (see /secrets). Steve should
+// move this UI behind a server-side auth proxy rather than client-side Basic Auth.
+const AUTH = btoa(`admin:${import.meta.env.VITE_BOARDROOM_AUTH_PASS ?? ''}`);
 const headers: Record<string, string> = {
   'Content-Type': 'application/json',
   'Authorization': `Basic ${AUTH}`,
diff --git a/src/api/middleware/auth.ts b/src/api/middleware/auth.ts
index c171b72..ae0dc2c 100644
--- a/src/api/middleware/auth.ts
+++ b/src/api/middleware/auth.ts
@@ -5,7 +5,8 @@
 import type { Request, Response, NextFunction } from 'express';
 
 const AUTH_USER = process.env.AUTH_USER || 'admin';
-const AUTH_PASS = process.env.AUTH_PASS || 'REDACTED_PASSWORD';
+const AUTH_PASS = process.env.BOARDROOM_AUTH_PASS || process.env.AUTH_PASS;
+if (!AUTH_PASS) throw new Error('BOARDROOM_AUTH_PASS not set — route via /secrets');
 
 export function basicAuth(req: Request, res: Response, next: NextFunction): void {
   const authHeader = req.headers.authorization;
diff --git a/src/engine/governanceClient.ts b/src/engine/governanceClient.ts
index ef2f8a7..3d7cb0d 100644
--- a/src/engine/governanceClient.ts
+++ b/src/engine/governanceClient.ts
@@ -7,7 +7,9 @@ import fetch from 'node-fetch';
 import type { GovDecision, GovDelegation, GovEscalation, GovStatus, GovDecisionStats, DecisionType } from '../types';
 
 const GOVERNANCE_URL = process.env.GOVERNANCE_URL || 'http://127.0.0.1:4020';
-const AUTH = Buffer.from(`${process.env.AUTH_USER || 'admin'}:${process.env.AUTH_PASS || 'REDACTED_PASSWORD'}`).toString('base64');
+const AUTH_PASS = process.env.BOARDROOM_AUTH_PASS || process.env.AUTH_PASS;
+if (!AUTH_PASS) throw new Error('BOARDROOM_AUTH_PASS not set — route via /secrets');
+const AUTH = Buffer.from(`${process.env.AUTH_USER || 'admin'}:${AUTH_PASS}`).toString('base64');
 
 const headers = {
   'Content-Type': 'application/json',

← 1d42552 security: env-ify boardroom config — remove leaked Gemini ke  ·  back to Dw Boardroom V2  ·  auto-save: 2026-06-23T17:53:42 (1 files) — ecosystem.config. 499a4f0 →