auth: support multiple Basic-Auth users (add Daniel), keep admin + env override

2d8dfbed7c6e591a88b92a581c5c1f217dc16021 · 2026-07-23 14:42:17 -0700 · Steve Abrams

Files touched

M src/server/index.ts

Diff

commit 2d8dfbed7c6e591a88b92a581c5c1f217dc16021
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 23 14:42:17 2026 -0700

    auth: support multiple Basic-Auth users (add Daniel), keep admin + env override
---
 src/server/index.ts | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/server/index.ts b/src/server/index.ts
index a4fbd82..2a2b19b 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -22,15 +22,16 @@ app.use(express.json({ limit: '256kb' }));
 
 app.get('/healthz', (_req, res) => res.type('text').send('ok'));
 
-const AUTH_USER = process.env.USRE_USER || 'admin';
-const AUTH_PASS = process.env.USRE_PASS || 'DW2024!';
+// Whole-site Basic Auth — the default admin login, named stakeholder logins, and any
+// extra comma-separated user:pass pairs via BASIC_AUTH_EXTRA. Accepts a SET of creds
+// (was single-user) so more than one person can be granted access.
+const AUTH_PAIRS = [
+  `${process.env.USRE_USER || 'admin'}:${process.env.USRE_PASS || 'DW2024!'}`,
+  'Daniel:Dandeana1992',
+].concat((process.env.BASIC_AUTH_EXTRA || '').split(',').map((s) => s.trim()).filter(Boolean));
+const ACCEPTED = new Set(AUTH_PAIRS.map((p) => 'Basic ' + Buffer.from(p).toString('base64')));
 app.use((req, res, next) => {
-  const hdr = req.headers.authorization || '';
-  const [scheme, encoded] = hdr.split(' ');
-  if (scheme === 'Basic' && encoded) {
-    const [u, ...rest] = Buffer.from(encoded, 'base64').toString().split(':');
-    if (u === AUTH_USER && rest.join(':') === AUTH_PASS) return next();
-  }
+  if (ACCEPTED.has(req.headers.authorization || '')) return next();
   res.set('WWW-Authenticate', 'Basic realm="USRealEstate", charset="UTF-8"');
   return res.status(401).send('Authentication required');
 });

← dc6baf0 chore: harden sublease.ts (enum allowlists on status/lease_t · back to Nationalrealestate · auth: add Boomer login (rentfree911) 8f27ada →