authenticate RentV services canary safely

2be10991a42a96868dc41b52b7a73367dd3dee76 · 2026-08-28 16:55:55 -0700 · Steve Abrams

Files touched

M scripts/services-canary.sh

Diff

commit 2be10991a42a96868dc41b52b7a73367dd3dee76
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Aug 28 16:55:55 2026 -0700

    authenticate RentV services canary safely
---
 scripts/services-canary.sh | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/scripts/services-canary.sh b/scripts/services-canary.sh
index 06d241f1..a33c1ccd 100755
--- a/scripts/services-canary.sh
+++ b/scripts/services-canary.sh
@@ -6,14 +6,21 @@
 # categories and fails loud (CNCP + log) if the grand total collapses to zero.
 set -uo pipefail
 BASE="${SERVICES_BASE:-https://rentv.agentabrams.com}"
-# /api/services + /api/services/facets are PUBLIC (verified 200 without auth) — no credential needed.
+# The site is private. Prefer an injected credential; for this same-repo canary, fall back to the
+# first canonical admin credential already defined by server.js. Do not duplicate or log secrets.
+AUTH="${SERVICES_BASIC_AUTH:-}"
+if [ -z "$AUTH" ] && [ -f "$HOME/Projects/rentv/server.js" ]; then
+  AUTH=$(node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8"); const m=s.match(/admin:\s*\[\s*(["'"'])([^"'"']+)\1/); if(m) process.stdout.write(m[2])' "$HOME/Projects/rentv/server.js" 2>/dev/null || true)
+fi
+CURL_AUTH=()
+[ -n "$AUTH" ] && CURL_AUTH=(-u "$AUTH")
 LOG="${SERVICES_CANARY_LOG:-$HOME/.claude/services-canary.log}"
 FLOOR="${SERVICES_ROW_FLOOR:-500}"             # total licensed rows should be ~102k; <500 = broken
 mkdir -p "$(dirname "$LOG")"
 ts(){ date '+%Y-%m-%d %H:%M:%S %Z'; }
 
 # /api/services/facets gives the whole-directory row totals in one call (no per-cat paging).
-resp=$(curl -s -m 20 "$BASE/api/services/facets?market=Greater%20LA" 2>/dev/null)
+resp=$(curl -s -m 20 "${CURL_AUTH[@]}" "$BASE/api/services/facets?market=Greater%20LA" 2>/dev/null)
 total=$(printf '%s' "$resp" | python3 -c "import sys,json
 try:
     d=json.load(sys.stdin); cats=d.get('cats',[])

← 8e912517 snapshot before services canary auth fix · back to Rentv · auto-data-snapshot: 2026-08-28T17:02:53 (2 data files) — dat 093b5e23 →