Add outer admin/DW2024! basic-auth wall (bypass Stripe webhook + import-token clients)

9b99d81ced14aba88377137a3a33ce7c60fc2980 · 2026-07-13 14:51:43 -0700 · Steve

Files touched

M src/middleware.ts

Diff

commit 9b99d81ced14aba88377137a3a33ce7c60fc2980
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon Jul 13 14:51:43 2026 -0700

    Add outer admin/DW2024! basic-auth wall (bypass Stripe webhook + import-token clients)
---
 src/middleware.ts | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/src/middleware.ts b/src/middleware.ts
index e2bca9a..f13d349 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -23,8 +23,32 @@ function isPublic(pathname: string): boolean {
   return PUBLIC.some((re) => re.test(pathname));
 }
 
+// Outer un/pw wall for the whole site (ideas/fleet-unified admin:DW2024!).
+// Override with BASIC_AUTH="user:pass"; BASIC_AUTH="" disables. Runs in Edge → use atob, not Buffer.
+const BASIC_AUTH = process.env.BASIC_AUTH ?? "admin:DW2024!";
+function basicAuthOk(req: NextRequest): boolean {
+  if (!BASIC_AUTH) return true;
+  const m = (req.headers.get("authorization") || "").match(/^Basic\s+(.+)$/i);
+  if (!m) return false;
+  try { return atob(m[1]) === BASIC_AUTH; } catch { return false; }
+}
+
 export async function middleware(req: NextRequest) {
   const { pathname } = req.nextUrl;
+
+  // Machine callers that cannot present a password bypass the wall:
+  // Stripe's server-to-server webhook and the extension/CSV import-token clients.
+  const importToken0 = process.env.IMPORT_TOKEN;
+  const machineOk =
+    pathname === "/api/billing/webhook" ||
+    (!!importToken0 && req.headers.get("x-import-token") === importToken0);
+  if (!machineOk && !basicAuthOk(req)) {
+    return new NextResponse("auth required", {
+      status: 401,
+      headers: { "WWW-Authenticate": 'Basic realm="GovArbitrage"' },
+    });
+  }
+
   if (isPublic(pathname)) return NextResponse.next();
 
   // Valid session cookie?

← 8e80bc6 chore: lint (Link over bare <a>), refactor (toEdition helper · back to Govarbitrage · chore: v0.2.1 (session close — auth wall) 873b83f →