TK-11466 FIX 2: decouple ADMIN mint from wall-disabled state (presentedAdminBasicAuth)

0442a975fc42bfca1f1c3e206f6f2ef80998c7bc · 2026-09-11 20:09:19 +0000 · Steve Abrams

Anonymous ADMIN auth-bypass: when BASIC_AUTH="" (wall off) basicAuthOk()
returns true for everyone, so the mint branch handed a real ADMIN ga_session
to any anonymous visitor -> reached /api/credentials + billing. Add
presentedAdminBasicAuth() (false when BASIC_AUTH empty; true only on a real
matching Basic-Auth credential) and use it for the ADMIN mint. Wall-on
behavior unchanged; wall-off no longer mints anonymous ADMIN.

tsc + next build pass. Verified: anon / -> 401, anon /api/credentials -> 401,
authed admin -> /api/credentials 200, anon /api/listings + /pricing -> 200.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019UrUfuy6xZtKf7bmWusKco

Files touched

M src/middleware.ts

Diff

commit 0442a975fc42bfca1f1c3e206f6f2ef80998c7bc
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Sep 11 20:09:19 2026 +0000

    TK-11466 FIX 2: decouple ADMIN mint from wall-disabled state (presentedAdminBasicAuth)
    
    Anonymous ADMIN auth-bypass: when BASIC_AUTH="" (wall off) basicAuthOk()
    returns true for everyone, so the mint branch handed a real ADMIN ga_session
    to any anonymous visitor -> reached /api/credentials + billing. Add
    presentedAdminBasicAuth() (false when BASIC_AUTH empty; true only on a real
    matching Basic-Auth credential) and use it for the ADMIN mint. Wall-on
    behavior unchanged; wall-off no longer mints anonymous ADMIN.
    
    tsc + next build pass. Verified: anon / -> 401, anon /api/credentials -> 401,
    authed admin -> /api/credentials 200, anon /api/listings + /pricing -> 200.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_019UrUfuy6xZtKf7bmWusKco
---
 src/middleware.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/middleware.ts b/src/middleware.ts
index 56f9b22..c4271e0 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -42,6 +42,16 @@ function basicAuthOk(req: NextRequest): boolean {
   try { return atob(m[1]) === BASIC_AUTH; } catch { return false; }
 }
 
+// True ONLY when a real, matching Basic-Auth credential was presented.
+// Unlike basicAuthOk(), this is FALSE when BASIC_AUTH is empty (wall disabled):
+// disabling the shared-password wall must never be treated as "logged in as admin".
+function presentedAdminBasicAuth(req: NextRequest): boolean {
+  if (!BASIC_AUTH) return false;
+  const m = (req.headers.get("authorization") || "").match(/^Basic\s+(.+)$/i);
+  if (!m) return false;
+  try { return atob(m[1]) === BASIC_AUTH; } catch { return false; }
+}
+
 export async function middleware(req: NextRequest) {
   const { pathname } = req.nextUrl;
 
@@ -79,7 +89,7 @@ export async function middleware(req: NextRequest) {
   // email /login form. basicAuthOk is already true for every non-public/non-machine
   // request that reached this line (the wall 401s otherwise); the guard just makes
   // sure a machine-token-only caller doesn't get an admin cookie.
-  if (basicAuthOk(req)) {
+  if (presentedAdminBasicAuth(req)) {
     const ga = await createSession({ sub: "basic-admin", email: "admin@agentabrams.com", role: "ADMIN" });
     const res = NextResponse.next();
     res.cookies.set(SESSION_COOKIE, ga, {

← e3141d0 Deploy approved TK-11249 pricing copy; local source e69a5ea · back to Govarbitrage · TK-11464 test: regression guard for sort orderBy nullability 6531e6f →