`deploy/rentv-regate.patch`

50 lines
commit 23094df1769856d30f8ee106cf9407a0e4608864
Author: Steve (RENTV 2026) <steve@designerwallcoverings.com>
Date:   Fri Aug 7 13:24:28 2026 -0700

    rentv: re-gate site behind un/pw (reverse 2026-08-06 public launch)
    
    Steve 2026-08-07: rentv.agentabrams.com should not be publicly live; ask for
    un/pw to enter. Reverses the TK-10284 public tier: anonymous visitors are now
    challenged at the app layer — browser navigations 302 to /login (login.html),
    assets/APIs get 401 + WWW-Authenticate (browser un/pw popup). Reuses the existing
    ROLE_CREDS (admin + user tiers) — no new secrets. PUBLIC=1 env restores open mode
    without a code edit. Verified locally: anon 302/401, valid creds 200, session +
    bad-creds paths correct.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

diff --git a/server.js b/server.js
index 1ea6d22..f6f4bbc 100644
--- a/server.js
+++ b/server.js
@@ -132,14 +132,20 @@ app.use((req, res, next) => {
   if (SERVICE_TOKEN && authz === 'Bearer ' + SERVICE_TOKEN) { req.role = 'admin'; req.authVia = 'service'; return next(); }
   const role = CRED_ROLE.get(authz);                             // Basic — nginx-forwarded creds + existing callers
   if (role) { req.role = role; req.authVia = 'basic'; return next(); }
-  // PUBLIC LAUNCH (TK-10284, Steve 2026-08-06 — "make it public"): unauthenticated visitors
-  // get the PUBLIC consumer tier (front page, news, map, articles, public APIs). Internal data
-  // and shells stay protected by adminOnly + the INTERNAL_STATIC guard, which BOTH key off
-  // role!=='admin' — so a 'public' role is blocked from everything sensitive exactly like the
-  // 'user' tier. Admin login stays reachable: adminOnly redirects an anonymous browser hit to
-  // /login. (The edge nginx basic-auth wall is dropped separately so requests reach the app.)
-  req.role = 'public'; req.authVia = 'anon';
-  return next();
+  // RE-GATED (Steve 2026-08-07 — "rentv.agentabrams.com should not be live; ask for un and pw
+  // to enter"): the 2026-08-06 public launch (TK-10284) is REVERSED. Unauthenticated visitors
+  // are challenged for a username/password at the app layer (works regardless of the nginx edge
+  // wall) using the SAME ROLE_CREDS as every other login — no new secrets. Set PUBLIC=1 in the
+  // env to restore the open/public consumer tier without a code edit.
+  if (process.env.PUBLIC === '1') { req.role = 'public'; req.authVia = 'anon'; return next(); }
+  // Browser navigations → the branded /login page (login.html, served before this gate).
+  // Everything else (assets/APIs/XHR) → a Basic-Auth challenge so the browser's own un/pw
+  // prompt appears. Either way, no content is served without a valid login.
+  if (req.method === 'GET' && String(req.headers.accept || '').includes('text/html')) {
+    return res.redirect(302, '/login?next=' + encodeURIComponent(req.originalUrl));
+  }
+  res.set('WWW-Authenticate', 'Basic realm="RENTV - sign in to continue"');
+  return res.status(401).send('Authentication required — this site is private. Please sign in.');
 });
 // CSRF — enforced ONLY for SESSION-authenticated mutations (Basic/service/open are CSRF-immune;
 // dormant while the nginx wall keeps everyone on Basic). Double-submit: X-CSRF-Token must equal