viewer: env-gated admin Basic Auth (REQUIRE_AUTH) for deploy; nginx is the live gate on japan./china.

1826109ba18a4459d96e1f4990d8509a7bf9a969 · 2026-06-30 13:52:29 -0700 · Steve

Files touched

M viewer-local/server.js

Diff

commit 1826109ba18a4459d96e1f4990d8509a7bf9a969
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Jun 30 13:52:29 2026 -0700

    viewer: env-gated admin Basic Auth (REQUIRE_AUTH) for deploy; nginx is the live gate on japan./china.
---
 viewer-local/server.js | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/viewer-local/server.js b/viewer-local/server.js
index 4910fe6..8e8002c 100644
--- a/viewer-local/server.js
+++ b/viewer-local/server.js
@@ -233,7 +233,22 @@ function applyFilters(rows, f, opts = {}) {
   return out;
 }
 
+// Admin Basic Auth — enforced only when REQUIRE_AUTH is set (on Kamatera);
+// local 9931 stays open. Creds default admin/DW2024!, override via BASIC_AUTH="user:pass".
+const REQUIRE_AUTH = !!process.env.REQUIRE_AUTH;
+const [AUTH_USER, AUTH_PASS] = (process.env.BASIC_AUTH || 'admin:DW2024!').split(':');
+function authed(req) {
+  const h = req.headers.authorization || '';
+  if (!h.startsWith('Basic ')) return false;
+  const [u, p] = Buffer.from(h.slice(6), 'base64').toString().split(':');
+  return u === AUTH_USER && p === AUTH_PASS;
+}
+
 const server = http.createServer((req, res) => {
+  if (REQUIRE_AUTH && !authed(req)) {
+    res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="DW Japan/China — admin preview"' });
+    return res.end('Authentication required');
+  }
   const u = new URL(req.url, `http://localhost:${PORT}`);
   if (u.pathname === '/api/skus') {
     const f = parseFilters(u);

← a06707a japan/china viewer: add 6 DW facets (collection, width, fire · back to Japan Enrich · viewer: host-based scoping — china.=Greenland-only (empty st df5e3a0 →