initial scaffold + creds-safe fetch guard (gitify per standing rule)

f19f6ee4c83b69065081e464d8b685630b6ecbfa · 2026-08-25 10:51:22 -0700 · Steve

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

A deploy/rentv-regate.patch
M public/index.html

Diff

commit f19f6ee4c83b69065081e464d8b685630b6ecbfa
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Aug 25 10:51:22 2026 -0700

    initial scaffold + creds-safe fetch guard (gitify per standing rule)
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 deploy/rentv-regate.patch | 49 +++++++++++++++++++++++++++++++++++++++++++++++
 public/index.html         | 24 +++++++++++++++++++++++
 2 files changed, 73 insertions(+)

diff --git a/deploy/rentv-regate.patch b/deploy/rentv-regate.patch
new file mode 100644
index 00000000..0f8528d3
--- /dev/null
+++ b/deploy/rentv-regate.patch
@@ -0,0 +1,49 @@
+commit 23094df1769856d30f8ee106cf9407a0e4608864
+Author: Steve (RENTV 2026) <steve@designerwallcoverings.com>
+Date:   Fri Aug 7 13:24:28 2026 -0700
+
+    rentv: re-gate site behind un/pw (reverse 2026-08-06 public launch)
+    
+    Steve 2026-08-07: rentv.agentabrams.com should not be publicly live; ask for
+    un/pw to enter. Reverses the TK-10284 public tier: anonymous visitors are now
+    challenged at the app layer — browser navigations 302 to /login (login.html),
+    assets/APIs get 401 + WWW-Authenticate (browser un/pw popup). Reuses the existing
+    ROLE_CREDS (admin + user tiers) — no new secrets. PUBLIC=1 env restores open mode
+    without a code edit. Verified locally: anon 302/401, valid creds 200, session +
+    bad-creds paths correct.
+    
+    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
+
+diff --git a/server.js b/server.js
+index 1ea6d22..f6f4bbc 100644
+--- a/server.js
++++ b/server.js
+@@ -132,14 +132,20 @@ app.use((req, res, next) => {
+   if (SERVICE_TOKEN && authz === 'Bearer ' + SERVICE_TOKEN) { req.role = 'admin'; req.authVia = 'service'; return next(); }
+   const role = CRED_ROLE.get(authz);                             // Basic — nginx-forwarded creds + existing callers
+   if (role) { req.role = role; req.authVia = 'basic'; return next(); }
+-  // PUBLIC LAUNCH (TK-10284, Steve 2026-08-06 — "make it public"): unauthenticated visitors
+-  // get the PUBLIC consumer tier (front page, news, map, articles, public APIs). Internal data
+-  // and shells stay protected by adminOnly + the INTERNAL_STATIC guard, which BOTH key off
+-  // role!=='admin' — so a 'public' role is blocked from everything sensitive exactly like the
+-  // 'user' tier. Admin login stays reachable: adminOnly redirects an anonymous browser hit to
+-  // /login. (The edge nginx basic-auth wall is dropped separately so requests reach the app.)
+-  req.role = 'public'; req.authVia = 'anon';
+-  return next();
++  // RE-GATED (Steve 2026-08-07 — "rentv.agentabrams.com should not be live; ask for un and pw
++  // to enter"): the 2026-08-06 public launch (TK-10284) is REVERSED. Unauthenticated visitors
++  // are challenged for a username/password at the app layer (works regardless of the nginx edge
++  // wall) using the SAME ROLE_CREDS as every other login — no new secrets. Set PUBLIC=1 in the
++  // env to restore the open/public consumer tier without a code edit.
++  if (process.env.PUBLIC === '1') { req.role = 'public'; req.authVia = 'anon'; return next(); }
++  // Browser navigations → the branded /login page (login.html, served before this gate).
++  // Everything else (assets/APIs/XHR) → a Basic-Auth challenge so the browser's own un/pw
++  // prompt appears. Either way, no content is served without a valid login.
++  if (req.method === 'GET' && String(req.headers.accept || '').includes('text/html')) {
++    return res.redirect(302, '/login?next=' + encodeURIComponent(req.originalUrl));
++  }
++  res.set('WWW-Authenticate', 'Basic realm="RENTV - sign in to continue"');
++  return res.status(401).send('Authentication required — this site is private. Please sign in.');
+ });
+ // CSRF — enforced ONLY for SESSION-authenticated mutations (Basic/service/open are CSRF-immune;
+ // dormant while the nginx wall keeps everyone on Basic). Double-submit: X-CSRF-Token must equal
diff --git a/public/index.html b/public/index.html
index 9ef4f329..546a2d41 100644
--- a/public/index.html
+++ b/public/index.html
@@ -1,4 +1,28 @@
 <!doctype html><html lang="en"><head>
+<script>
+// Credential-safe fetch guard (fleet drop-in) — if this page is opened with
+// credentials in the URL (a saved bookmark / Chrome-remembered basic-auth:
+// https://user:pass@host/…), the browser poisons document.baseURI, so any
+// relative or root-relative fetch('/api/…') throws "Request cannot be constructed
+// from a URL that includes credentials" and callers silently fall to an empty
+// state. Resolve every non-absolute request URL against the credential-free
+// location instead of baseURI. Placed first so it wraps window.fetch before any
+// app script runs. Ref: creds-in-url-fetch-guard-fleet-pattern.
+(function () {
+  var _fetch = window.fetch.bind(window);
+  var cleanBase = function () { return location.origin + location.pathname; };
+  window.fetch = function (input, init) {
+    try {
+      if (typeof input === 'string' && !/^[a-z]+:\/\//i.test(input) && input.indexOf('//') !== 0) {
+        input = new URL(input, cleanBase()).href;
+      } else if (input instanceof Request && !/^[a-z]+:\/\//i.test(input.url)) {
+        input = new Request(new URL(input.url, cleanBase()).href, input);
+      }
+    } catch (_) { /* fall through to native */ }
+    return _fetch(input, init);
+  };
+})();
+</script>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <title>RENTV.com — Commercial Real Estate News · Western U.S.</title>
 <meta name="description" content="RENTV.com — commercial real estate news, deals, financing, development and conferences across the Western United States since 1998.">

← 437aa93c TK-10569: port /api/advertise + /api/advertise-inquiries fro · back to Rentv 2026 · (newest)