auctions/govarbitrage: basic un/pw IS the login — passing the outer wall mints an ADMIN session, no email/login form (Steve)

05f0b6655140bff1120b5182d262c37cc898e301 · 2026-07-27 08:38:25 -0700 · Steve Abrams

Files touched

M src/middleware.ts

Diff

commit 05f0b6655140bff1120b5182d262c37cc898e301
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Jul 27 08:38:25 2026 -0700

    auctions/govarbitrage: basic un/pw IS the login — passing the outer wall mints an ADMIN session, no email/login form (Steve)
---
 src/middleware.ts | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/src/middleware.ts b/src/middleware.ts
index 01fd9f3..a9612d0 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -62,6 +62,25 @@ export async function middleware(req: NextRequest) {
 
   if (session || hasImportToken) return NextResponse.next();
 
+  // Basic-auth IS the login (Steve 2026-07-27: "my basic un and pw, not the email
+  // login"). Any human who cleared the outer un/pw wall (the BASIC_AUTH creds) is
+  // treated as ADMIN — we mint a real ADMIN session here so the app never bounces to the
+  // email /login form. basicAuthOk is already true for every non-public/non-machine
+  // request that reached this line (the wall 401s otherwise); the guard just makes
+  // sure a machine-token-only caller doesn't get an admin cookie.
+  if (basicAuthOk(req)) {
+    const ga = await createSession({ sub: "basic-admin", email: "admin@agentabrams.com", role: "ADMIN" });
+    const res = NextResponse.next();
+    res.cookies.set(SESSION_COOKIE, ga, {
+      httpOnly: true,
+      secure: true,
+      sameSite: "lax",
+      path: "/",
+      maxAge: SESSION_MAX_AGE,
+    });
+    return res;
+  }
+
   // Fleet single-sign-on: a valid shared *.agentabrams.com "aafleet" cookie
   // establishes an ANALYST session here (operational — full data + imports +
   // buyer pages), so one fleet login carries into auctions with no second form.

← 4d4adb4 auto-save: 2026-07-27T07:48:56 (1 files) — tsconfig.tsbuildi · back to Govarbitrage · auto-save: 2026-07-27T08:49:12 (1 files) — tsconfig.tsbuildi 70e7b1e →