auth: unify both middlewares on resolved GEORGE_BASIC_AUTH cred + fail-closed on empty password (rotation completed 2026-07-13)

a9140cb9c8ec9ecd483f48f94a06dc6997015a49 · 2026-07-13 11:04:03 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit a9140cb9c8ec9ecd483f48f94a06dc6997015a49
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Jul 13 11:04:03 2026 -0700

    auth: unify both middlewares on resolved GEORGE_BASIC_AUTH cred + fail-closed on empty password (rotation completed 2026-07-13)
---
 server.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 4f4b7f9..4b89dc7 100644
--- a/server.js
+++ b/server.js
@@ -316,6 +316,10 @@ app.use((req, res, next) => {
     res.setHeader('WWW-Authenticate', 'Basic realm="George Gmail Agent"');
     return res.status(401).json({ error: 'Authentication required' });
   }
+  // Fail closed: an unset/empty credential must never mean "no auth" — this
+  // server binds all interfaces and fronts live Gmail accounts (2026-07-13,
+  // found running with pass-len=0 after a half-applied rotation).
+  if (!_GEORGE_PASS) return res.status(503).json({ error: 'Auth not configured on server' });
   const decoded = Buffer.from(auth.slice(6), 'base64').toString();
   const [user, pass] = decoded.split(':');
   if (_ctEq(user, _GEORGE_USER) && _ctEq(pass, _GEORGE_PASS)) return next();
@@ -815,7 +819,10 @@ app.use((req, res, next) => {
   const auth = req.headers.authorization;
   if (!auth || !auth.startsWith('Basic ')) return res.status(401).json({ error: 'Auth required' });
   const [user, pass] = Buffer.from(auth.split(' ')[1], 'base64').toString().split(':');
-  if (user !== 'admin' || pass !== (process.env.GEORGE_BASIC_AUTH_PASS || '')) return res.status(401).json({ error: 'Invalid credentials' });
+  // Single source of truth: same resolved credential as the primary middleware
+  // (the old separate GEORGE_BASIC_AUTH_PASS check caused the 2026-07 split-brain
+  // where no credential could pass both stacked middlewares once the vars diverged).
+  if (!_ctEq(user, _GEORGE_USER) || !_ctEq(pass, _GEORGE_PASS)) return res.status(401).json({ error: 'Invalid credentials' });
   next();
 });

← b6e91b3 auto-save: 2026-07-10T11:07:57 (1 files) — server.js · back to George Gmail · chore: version v1.1.1 (session close) 2c2c36d →