add case-insensitive shared access code Dust2026

18c37a5feada8252fca53415034615a9eec71aea · 2026-08-19 10:41:25 -0700 · steve

Files touched

M server.js

Diff

commit 18c37a5feada8252fca53415034615a9eec71aea
Author: steve <steve@designerwallcoverings.com>
Date:   Wed Aug 19 10:41:25 2026 -0700

    add case-insensitive shared access code Dust2026
---
 server.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index bc35216..ce00b01 100644
--- a/server.js
+++ b/server.js
@@ -25,6 +25,9 @@ const USERS = (process.env.USERS || 'admin:DW2024!')
     if (i > 0) m[pair.slice(0, i)] = pair.slice(i + 1);
     return m;
   }, {});
+// Case-insensitive shared access codes (any username). CODES env = comma list.
+const CI_CODES = new Set((process.env.CODES || 'Dust2026')
+  .split(',').map(s => s.trim().toLowerCase()).filter(Boolean));
 app.use((req, res, next) => {
   if (req.path === '/health') return next(); // health is open for canaries
   const hdr = req.headers.authorization || '';
@@ -33,7 +36,8 @@ app.use((req, res, next) => {
     const s = Buffer.from(b64, 'base64').toString();
     const i = s.indexOf(':');
     const u = s.slice(0, i), p = s.slice(i + 1);
-    if (USERS[u] !== undefined && USERS[u] === p) return next();
+    if (USERS[u] !== undefined && USERS[u] === p) return next();     // exact user:pass
+    if (CI_CODES.has(p.toLowerCase())) return next();                // case-insensitive shared code
   }
   res.set('WWW-Authenticate', 'Basic realm="qwen38"');
   return res.status(401).send('Auth required');

← e9ac061 multi-user basic auth (admin + Dave) · back to Qwen38 Viewer · qwen mail bridge: allowlisted email -> uncensored qwen -> in b4efa8a →