chore: fail-loud guard on empty George Basic-auth, v0.1.3 (session close)

f1cb8a404095f0465c47200a2376dcf6bd56ad29 · 2026-08-14 12:25:19 -0700 · steve

Files touched

M lib/config.js
M package.json

Diff

commit f1cb8a404095f0465c47200a2376dcf6bd56ad29
Author: steve <steve@designerwallcoverings.com>
Date:   Fri Aug 14 12:25:19 2026 -0700

    chore: fail-loud guard on empty George Basic-auth, v0.1.3 (session close)
---
 lib/config.js | 4 ++++
 package.json  | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/config.js b/lib/config.js
index 872e177..e6c4ae5 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -103,6 +103,10 @@ const config = {
     let v = firstEnv('GEORGE_BASIC_AUTH', GEORGE_ENVS) || firstEnv('GEORGE_AUTH', SECRETS_ENVS) || 'admin:';
     if (v.startsWith('Basic ')) { try { v = Buffer.from(v.slice(6), 'base64').toString(); } catch (e) {} }
     if (!v.includes(':')) v = 'admin:' + v;
+    // Fail LOUD if the password resolved empty — this empty-password fallback is exactly
+    // what silently 401'd every George send and hid the DW welcome-email outage. Warn at
+    // load so a misconfig surfaces immediately instead of as mysterious 401s in production.
+    if (!(v.split(':')[1] || '')) console.warn('[config] WARNING: George Basic-auth resolved to an EMPTY password (no GEORGE_BASIC_AUTH / GEORGE_AUTH found) — external sends will 401. Set GEORGE_AUTH in secrets-manager/.env.');
     return v;
   })(),
 
diff --git a/package.json b/package.json
index bc102f2..708417a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dw-signup-fulfillment",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true,
   "description": "DW signup/sample/rep fulfillment: retail gift-code + trade approval + rep round-robin. DRY_RUN by default.",
   "type": "commonjs",

← 28160cb honor-reissue: isolate DRY ledger from live (dry preview no · back to Dw Signup Fulfillment · auto-data-snapshot: 2026-08-14T12:54:45 (1 data files) — pac 7169240 →