auto-save: 2026-06-26T16:04:29 (1 files) — server.js

0ff8bf32958859adf478b4d54547e068118f195b · 2026-06-26 16:04:31 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 0ff8bf32958859adf478b4d54547e068118f195b
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Jun 26 16:04:31 2026 -0700

    auto-save: 2026-06-26T16:04:29 (1 files) — server.js
---
 server.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 1049f84..e63c080 100644
--- a/server.js
+++ b/server.js
@@ -1068,8 +1068,11 @@ const EXT_SEND_TOKEN = (() => {
   if (process.env.GEORGE_EXTERNAL_SEND_TOKEN) return process.env.GEORGE_EXTERNAL_SEND_TOKEN;
   try { const m = require('fs').readFileSync(require('path').join(__dirname, '.env'), 'utf8').match(/^GEORGE_EXTERNAL_SEND_TOKEN=(.+)$/m); return m ? m[1].trim() : ''; } catch (e) { return ''; }
 })();
-const INTERNAL_DOMAINS = (process.env.GEORGE_INTERNAL_DOMAINS || 'designerwallcoverings.com').toLowerCase().split(',').map(s => s.trim()).filter(Boolean);
-const INTERNAL_ADDRS = (process.env.GEORGE_INTERNAL_ADDRS || 'steveabramsdesigns@gmail.com,theagentabrams@gmail.com,wallsandfabrics@gmail.com').toLowerCase().split(',').map(s => s.trim()).filter(Boolean);
+// read a key from .env directly (launchd doesn't load .env into process.env;
+// same fallback the EXT_SEND_TOKEN above uses) so the allowlist is configurable
+function _envFile(key) { try { const m = require('fs').readFileSync(require('path').join(__dirname, '.env'), 'utf8').match(new RegExp('^' + key + '=(.+)$', 'm')); return m ? m[1].trim() : ''; } catch (e) { return ''; } }
+const INTERNAL_DOMAINS = (process.env.GEORGE_INTERNAL_DOMAINS || _envFile('GEORGE_INTERNAL_DOMAINS') || 'designerwallcoverings.com').toLowerCase().split(',').map(s => s.trim()).filter(Boolean);
+const INTERNAL_ADDRS = (process.env.GEORGE_INTERNAL_ADDRS || _envFile('GEORGE_INTERNAL_ADDRS') || 'steveabramsdesigns@gmail.com,theagentabrams@gmail.com,wallsandfabrics@gmail.com').toLowerCase().split(',').map(s => s.trim()).filter(Boolean);
 function _recips(...vals) { const out = []; for (const v of vals) { if (!v) continue; const arr = Array.isArray(v) ? v : String(v).split(','); for (const a of arr) { const m = String(a).match(/[\w.+-]+@[\w.-]+\.\w+/); if (m) out.push(m[0].toLowerCase()); } } return out; }
 function _isInternal(addr) { const dom = (addr.split('@')[1] || ''); return INTERNAL_ADDRS.includes(addr) || INTERNAL_DOMAINS.includes(dom); }
 function externalSendGuard(req) {

← 23d49a6 send-with-attachment: resolve any account (steve-personal/ag · back to George Gmail · Add OAuth durability decision memo — retire the weekly-token 3608276 →