fail-open guardrail: warn at boot when admin auth is unconfigured (TK-10984 opt-A)

f6cdd9bad80cf6663a3555f2738aeaaf2f514b5b · 2026-08-31 00:00:08 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit f6cdd9bad80cf6663a3555f2738aeaaf2f514b5b
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Aug 31 00:00:08 2026 -0700

    fail-open guardrail: warn at boot when admin auth is unconfigured (TK-10984 opt-A)
---
 server.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server.js b/server.js
index 6d5f282..931d0bc 100644
--- a/server.js
+++ b/server.js
@@ -296,6 +296,7 @@ server.listen(PORT, '127.0.0.1', function () {
   const addr = this.address();
   console.log('[permit-radar] http://localhost:' + addr.port);
   console.log('[permit-radar] Admin: BASIC_AUTH=admin:DW2024! PORT=3905 node server.js, then visit /admin');
+  if (!BASIC_AUTH) console.warn('[permit-radar] ⚠️  ADMIN OPEN — BASIC_AUTH unset; /admin is UNGATED (adminAuthed fails OPEN). Set BASIC_AUTH=user:pass BEFORE any public deploy. (TK-10984)');
   console.log('[permit-radar] NOTE: permit data is SAMPLE/REPRESENTATIVE — not real county data.');
   console.log('[permit-radar] Real feed seam: see scripts/ingest-stub.js');
 });

← 04e7eeb add creds-in-URL fetch guard to gated pages (TK-10984) · back to Permit Radar · (newest)