crm: harden green-highlight to admin credential only — require genuine admin basic/session/service (honor admin basic-auth even under OPEN=1 dev bypass); unauth + non-admin get zero LinkedIn relationship data

530cac5276e1f2c7a38cadeb3b21a4210ae4ad2d · 2026-08-12 18:39:21 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 530cac5276e1f2c7a38cadeb3b21a4210ae4ad2d
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Aug 12 18:39:21 2026 -0700

    crm: harden green-highlight to admin credential only — require genuine admin basic/session/service (honor admin basic-auth even under OPEN=1 dev bypass); unauth + non-admin get zero LinkedIn relationship data
---
 server.js | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 4087f7ec..d2d3075a 100644
--- a/server.js
+++ b/server.js
@@ -2440,9 +2440,17 @@ app.get('/api/crm', adminOnly, async (req, res) => {
     const owners = crmNormalizeOwners(readJSON('la-commercial.json', { marquee: [] }));
     const commercial = crmNormalizeCommercial(commercialRows);
     const directory = crmLoadImported();      // manually-imported contacts (scanned lists, business cards, etc.)
-    const liGraph = loadLinkedInGraph();
+    // LinkedIn green-highlight is ADMIN-ONLY (it reveals Steve's personal network). Require a
+    // GENUINE admin credential — a real basic/session/service admin, OR (under the OPEN=1 dev
+    // bypass, which clobbers authVia to 'open') a request that still carries admin basic-auth.
+    // A plain unauthenticated hit (even when OPEN=1 makes it role=admin) gets NO relationship data.
+    const isAdmin = req.role === 'admin' && (
+      req.authVia === 'basic' || req.authVia === 'session' || req.authVia === 'service' ||
+      (() => { const az = req.headers.authorization || ''; if (az.startsWith('Basic ')) { try { return Buffer.from(az.slice(6), 'base64').toString().split(':')[0] === 'admin'; } catch { return false; } } return false; })()
+    );
+    const liGraph = isAdmin ? loadLinkedInGraph() : null;
     const all = [...ownedContacts, ...commercial, ...owners, ...directory].map((c) => {
-      const lr = c.name || c.firm ? liGraph.rel(c.name, c.firm) : { any: false, label: null };
+      const lr = (isAdmin && (c.name || c.firm)) ? liGraph.rel(c.name, c.firm) : { any: false, label: null };
       return {
       ...c,
       // LinkedIn relationship (strongest signal drives the green highlight + badge)

← d1e51c25 auto-data-snapshot: 2026-08-12T18:36:17 (8 data files) — dat · back to Rentv · 5x sweep 1: cap CRM render at 400 rows (was rendering all 5, 34e4fb84 →