hospitalitydesignreps: remove global Basic Auth gate — make public directory crawlable for AdSense

ee1759bc51c6243aa198a1512c89e97c62e453e2 · 2026-09-10 09:44:31 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit ee1759bc51c6243aa198a1512c89e97c62e453e2
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 10 09:44:31 2026 -0700

    hospitalitydesignreps: remove global Basic Auth gate — make public directory crawlable for AdSense
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 server.js | 21 +++------------------
 1 file changed, 3 insertions(+), 18 deletions(-)

diff --git a/server.js b/server.js
index 2c6c0d4..71f0fd6 100644
--- a/server.js
+++ b/server.js
@@ -21,24 +21,9 @@ app.use(helmet({
 app.use(compression());
 app.use(morgan('tiny'));
 
-// HTTP Basic Auth gate (Steve: admin / DW2024!). Env-overridable. /healthz stays open so the
-// fleet uptime/canary probes still work without credentials.
-const BASIC_USER = process.env.BASIC_AUTH_USER || 'admin';
-const BASIC_PASS = process.env.BASIC_AUTH_PASS || 'DW2024!';
-app.use((req, res, next) => {
-  if (req.path === '/healthz') return next();
-  const hdr = req.headers.authorization || '';
-  const [scheme, b64] = hdr.split(' ');
-  if (scheme === 'Basic' && b64) {
-    const decoded = Buffer.from(b64, 'base64').toString();
-    const idx = decoded.indexOf(':');
-    const u = decoded.slice(0, idx);
-    const p = decoded.slice(idx + 1);   // rejoin rest so a ':' in the password is preserved
-    if (u === BASIC_USER && p === BASIC_PASS) return next();
-  }
-  res.set('WWW-Authenticate', 'Basic realm="Hospitality Design Reps"');
-  return res.status(401).send('Authentication required.');
-});
+// Public directory — the global HTTP Basic Auth gate was removed 2026-09-10 (Steve: "ungate approve go")
+// so Google/AdSense can crawl the site (it is a free public FF&E rep index; no admin/write routes exist).
+// Re-add a gate here if a private surface is ever introduced. /healthz stays open regardless.
 
 app.use((req, res, next) => {
   res.set('Cache-Control', 'no-store, must-revalidate');

← e59363b TK-11341: add AdSense Auto-Ads loader + ads.txt (revert to r · back to Hospitalitydesignreps · auto-data-snapshot: 2026-09-10T10:34:55 (4 data files) — vie 3f71bd2 →