auto-save: 2026-06-26T12:33:24 (1 files) — server.js

c208bf208aae46797b940a1e5dbd7a52ac9194cb · 2026-06-26 12:33:27 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit c208bf208aae46797b940a1e5dbd7a52ac9194cb
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Jun 26 12:33:27 2026 -0700

    auto-save: 2026-06-26T12:33:24 (1 files) — server.js
---
 server.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index b277d8c..e1c20f4 100644
--- a/server.js
+++ b/server.js
@@ -44,8 +44,13 @@ loadProducts();
 app.use(compression());
 app.use(express.json());
 
-// Basic auth (gates everything — standalone, like dw-showroom)
+// Basic auth (gates everything — standalone, like dw-showroom).
+// Localhost is exempt: this is a local-only tool (DTD verdict C), so direct
+// 127.0.0.1 access needs no prompt. NOTE: if ever deployed behind nginx (Option A),
+// re-gate at the proxy — a reverse proxy would arrive as localhost and bypass this.
 app.use((req, res, next) => {
+  const ip = req.ip || (req.socket && req.socket.remoteAddress) || '';
+  if (ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1') return next();
   const auth = req.headers.authorization;
   if (!auth || !auth.startsWith('Basic ')) {
     res.setHeader('WWW-Authenticate', 'Basic realm="Quadrille Showroom"');

← 98df95d Wall-cladding: focused/perused wing renders its pattern onto · back to Quadrille Showroom · Realism pass + proximity book-match wings 8a47897 →