homesonspec: send scoped Basic auth to usre contractor API (TK-10488)

a2a0172b34133d92a2f4d45307e3ddb10a576663 · 2026-08-12 12:22:26 -0700 · Steve

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M apps/web/src/lib/contractors.ts

Diff

commit a2a0172b34133d92a2f4d45307e3ddb10a576663
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Aug 12 12:22:26 2026 -0700

    homesonspec: send scoped Basic auth to usre contractor API (TK-10488)
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 apps/web/src/lib/contractors.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/apps/web/src/lib/contractors.ts b/apps/web/src/lib/contractors.ts
index 81a33037..07951318 100644
--- a/apps/web/src/lib/contractors.ts
+++ b/apps/web/src/lib/contractors.ts
@@ -23,6 +23,16 @@ import { DEFAULT_TRADES_PARAM } from "./trades";
 export const CONTRACTORS_API_BASE =
   process.env.CONTRACTORS_API_BASE?.replace(/\/+$/, "") || "http://localhost:9913";
 
+// Scoped Basic auth for the usre contractor API (least-privilege contractor-only cred).
+// Set CONTRACTORS_API_USER + CONTRACTORS_API_PASS in .env; unset = no header (local dev).
+export const CONTRACTORS_API_AUTH =
+  process.env.CONTRACTORS_API_USER && process.env.CONTRACTORS_API_PASS
+    ? "Basic " +
+      Buffer.from(
+        `${process.env.CONTRACTORS_API_USER}:${process.env.CONTRACTORS_API_PASS}`,
+      ).toString("base64")
+    : "";
+
 export interface ContractorMatch {
   license_no: string;
   business_name: string;
@@ -99,7 +109,7 @@ export async function matchSubsForHome(args: MatchArgs): Promise<MatchResult> {
   try {
     const res = await fetch(url, {
       signal: controller.signal,
-      headers: { accept: "application/json" },
+      headers: { accept: "application/json", ...(CONTRACTORS_API_AUTH ? { Authorization: CONTRACTORS_API_AUTH } : {}) },
       // Location facts change slowly; cache briefly to avoid hammering the API
       // on every detail-page view.
       next: { revalidate: 900 },

← 552d6aa2 HomesOnSpec: date-stamp nearby-subs — per-row CSLB issue/exp · back to Homesonspec · chore: HomesOnSpec safe full-web deploy runbook (build-gated db6c10ce →