Add HTTP Basic Auth (admin/admin, env-overridable via BASIC_AUTH); /healthz stays open

ff8a7550fb82da3f3d7506926e9d245c929b88e8 · 2026-07-28 09:46:15 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit ff8a7550fb82da3f3d7506926e9d245c929b88e8
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Jul 28 09:46:15 2026 -0700

    Add HTTP Basic Auth (admin/admin, env-overridable via BASIC_AUTH); /healthz stays open
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 server.js | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/server.js b/server.js
index a44c143..a408f10 100644
--- a/server.js
+++ b/server.js
@@ -46,12 +46,27 @@ function fetchNewest(limit, cb) {
   });
 }
 
+// HTTP Basic Auth gate. Credentials come from BASIC_AUTH ("user:pass"), default admin:admin.
+// /healthz is intentionally left OPEN so the deploy smoke-test + uptime probes work unauthed.
+const [AUTH_USER, AUTH_PASS] = (process.env.BASIC_AUTH || 'admin:admin').split(':');
+function authed(req) {
+  const h = req.headers.authorization || '';
+  if (!h.startsWith('Basic ')) return false;
+  const [u, ...rest] = Buffer.from(h.slice(6), 'base64').toString('utf8').split(':');
+  return u === AUTH_USER && rest.join(':') === AUTH_PASS;
+}
+
 http.createServer((req, res) => {
   const u = new URL(req.url, 'http://x');
   let p = decodeURIComponent(u.pathname);
 
   if (p === '/healthz') { res.writeHead(200); return res.end('ok'); }
 
+  if (!authed(req)) {
+    res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="new-engine"' });
+    return res.end('auth required');
+  }
+
   // Live newest feed. On any DB failure, fall back to the frozen snapshot (wrapped to
   // match the {records,total} contract) so the front end always gets valid data.
   if (p === '/api/new-items') {

← f73dcfd New Arrivals engine for new.engine.designerwallcoverings.com · back to New Engine · auto-save: 2026-07-28T09:59:38 (1 files) — .deploy.conf 09f66bb →