contrarian FIX FIRST #3: rotate public cred off shared DW2024! via app-local .env (envLocal reader)

09bfb8800a26a4f4fb3fbbffbb42381bb6ff3991 · 2026-07-12 11:35:06 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 09bfb8800a26a4f4fb3fbbffbb42381bb6ff3991
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Jul 12 11:35:06 2026 -0700

    contrarian FIX FIRST #3: rotate public cred off shared DW2024! via app-local .env (envLocal reader)
---
 server.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 3637bbc..f3e4d82 100644
--- a/server.js
+++ b/server.js
@@ -59,7 +59,14 @@ app.use(express.json({ limit: '512kb' }));
 // URLs, and inline creds don't propagate to the /api/lists fetch → blank grid).
 // Tunnel/remote requests still require auth: cloudflared stamps proxied requests
 // with cf-connecting-ip / x-forwarded-for, so they don't get the loopback pass.
-const BASIC_AUTH = process.env.BASIC_AUTH || 'admin:DW2024!';
+// Local secrets file for THIS app (pm2/launchd don't load .env into process.env, so read it
+// directly — same pattern as envFromGeorge above). Lets us rotate the public tunnel cred off
+// the shared fleet password (DW2024!) without hardcoding it. .env is gitignored.
+const LOCAL_ENV = path.join(__dirname, '.env');
+function envLocal(key) {
+  try { const m = fs.readFileSync(LOCAL_ENV, 'utf8').match(new RegExp('^' + key + '=(.+)$', 'm')); return m ? m[1].trim().replace(/^["']|["']$/g, '') : ''; } catch { return ''; }
+}
+const BASIC_AUTH = process.env.BASIC_AUTH || envLocal('BASIC_AUTH') || 'admin:DW2024!';
 const AUTH_HEADER = 'Basic ' + Buffer.from(BASIC_AUTH).toString('base64');
 const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);

← 577f14f contrarian FIX FIRST #2: per-IP brute-force lockout on publi · back to Dw Pitch Followup · yolo: baseline security headers (nosniff, frame-DENY, no-ref 211aef3 →