← back to Rentv
fix(auth): bridge server-admin session into /api/pr so deals.html deal-notes work
71ec8d4971bad1f5b47e12a9ca7fbdf4e23cab92 · 2026-08-06 12:03:47 -0700 · Steve Abrams
deals.html is a server-realm page (session/Basic auth), but /api/pr only resolved
Basic/service creds — a server-session admin got 401 on deal notes (deals.html deal
drawer). Bridge ADMIN server sessions into the PR layer (prAuthCtx then treats them
as tenant-1 admin); gate to role==='admin' so front-page user-tier logins still can't
reach the internal CRM. authVia='session' keeps the CSRF gate active for mutations;
deals.html now loads /csrf.js so its POSTs carry the double-submit token.
Verified: server-admin session GET/POST notes 200 (POST 403 without CSRF); user-tier
session /api/pr 401 (no leak); pr_session workspace unaffected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Files touched
M data/deals-registry.jsonM data/deals.jsonM data/markets.jsonM data/news.jsonM data/ticker.jsonM public/deals.htmlM public/index.htmlM server.js
Diff
commit 71ec8d4971bad1f5b47e12a9ca7fbdf4e23cab92
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Thu Aug 6 12:03:47 2026 -0700
fix(auth): bridge server-admin session into /api/pr so deals.html deal-notes work
deals.html is a server-realm page (session/Basic auth), but /api/pr only resolved
Basic/service creds — a server-session admin got 401 on deal notes (deals.html deal
drawer). Bridge ADMIN server sessions into the PR layer (prAuthCtx then treats them
as tenant-1 admin); gate to role==='admin' so front-page user-tier logins still can't
reach the internal CRM. authVia='session' keeps the CSRF gate active for mutations;
deals.html now loads /csrf.js so its POSTs carry the double-submit token.
Verified: server-admin session GET/POST notes 200 (POST 403 without CSRF); user-tier
session /api/pr 401 (no leak); pr_session workspace unaffected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
data/deals-registry.json | 122 +++++++++++++++++++++++------------------------
data/deals.json | 2 +-
data/markets.json | 14 +++---
data/news.json | 2 +-
data/ticker.json | 8 ++--
public/deals.html | 1 +
public/index.html | 4 +-
server.js | 8 ++++
8 files changed, 85 insertions(+), 76 deletions(-)
diff --git a/data/deals-registry.json b/data/deals-registry.json
index a8352868..62ed8a1f 100644
--- a/data/deals-registry.json
+++ b/data/deals-registry.json
@@ -1,5 +1,5 @@
{
- "updated_at": "2026-08-06T18:37:16.390Z",
+ "updated_at": "2026-08-06T18:57:19.247Z",
"total": 47,
"deals": {
"34086": {
@@ -808,8 +808,8 @@
"summary": "Eagle Partners and The Vistria Group have purchased Crystal View Apartments, a 402-unit apartment mixed-income workforce housing community located in Garden Grove, for $132. 5 mil, or $329."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 1,
"history": [
{
@@ -934,8 +934,8 @@
"summary": "Intercontinental Real Estate Corporation has acquired Lakeland Town Center, a 125. 2k sf grocery-anchored retail center located in the Seattle/Tacoma suburb of Auburn, WA, for $69."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 2,
"history": [
{
@@ -1016,8 +1016,8 @@
"summary": "Meta Housing, with R. D."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 2,
"history": [
{
@@ -1098,8 +1098,8 @@
"summary": "In a major Arizona multifamily trade, Camden Property Trust acquired The Tyler, a 320-unit multifamily community located in the Agritopia master-planned community in Gilbert. The asset was sold by StreetLights Residential in a deal worth $124."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 1,
"history": [
{
@@ -1147,8 +1147,8 @@
"summary": "Shorenstein has closed on a Bay Area office buy, acquiring 550 Allerton, a 76. 6k sf, Class A property in the heart of Downtown Redwood City."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 2,
"history": [
{
@@ -1229,8 +1229,8 @@
"summary": "CentrePoint Properties has purchased a three-property Colorado retail portfolio, including Cottonwood Square in Parker, Bristol Pointe in Aurora and Foothill Green in Littleton. The assets were sold by Western Centers Inc in a $30."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 3,
"history": [
{
@@ -1344,8 +1344,8 @@
"summary": "A 90. 5k sf, industrial distribution facility in the city of Carson traded hands in a $23 mil ($254/sf) transaction."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 2,
"history": [
{
@@ -1426,8 +1426,8 @@
"summary": "MG Properties has acquired Tupelo Alley, a 188-unit mixed use apartment community in Portland, OR. Located at 3850 N."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 1,
"history": [
{
@@ -1475,8 +1475,8 @@
"summary": "Tailwind Investment Group has acquired two multifamily properties totaling 419 units in Sacramento for a combined price of $65 mil. The properties include Bent Tree Apartments (208 units) and California Place Apartments (211 units)."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 1,
"history": [
{
@@ -1524,8 +1524,8 @@
"summary": "Mosaic, a six building, 148. 4k sf retail portfolio spanning multiple city blocks in Downtown Long Beach, traded hands in a recent $30 mil ($202/sf transaction."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 3,
"history": [
{
@@ -1634,8 +1634,8 @@
"summary": "RENTV. com - Commercial real estate news and property information window."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 3,
"history": [
{
@@ -1744,8 +1744,8 @@
"summary": "A joint venture between Phoenix Capital Management and P. B."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 3,
"history": [
{
@@ -1854,8 +1854,8 @@
"summary": "In a Fresno multifamily trade, Maroa Park Apartments, a 248-unit community, was purchased by a private investor for $44 mil ($177. 4k/unit)."
},
"first_seen": "2026-07-23T04:07:13.798Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 70,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 71,
"revisions": 3,
"history": [
{
@@ -1969,8 +1969,8 @@
"summary": "Velo3D has leased a 288. 7k sf facility in Livermore, CA in a $55."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 2,
"history": [
{
@@ -2051,8 +2051,8 @@
"summary": "SFF Realty recently acquired a four-story, 104. 5k sf, Class A office/R&D building in Sunnyvale."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 3,
"history": [
{
@@ -2166,8 +2166,8 @@
"summary": "Granite Towers Equity Group purchased Hathaway at Willow Bend, a 229-unit multifamily community located at 2525 Preston Road in Plano, TX. The property was sold by S2 Capital."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 2,
"history": [
{
@@ -2243,8 +2243,8 @@
"summary": "Building 1 at CapRock Central Point III, a four-building, 2. 7 msf speculative industrial development in Visalia, has been fully leased to an undisclosed global corporate tenant."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 3,
"history": [
{
@@ -2353,8 +2353,8 @@
"summary": "A 782. 8k sf industrial facility in Frederickson, WA traded hands in a recent $174 mil ($222/sf) transaction."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 2,
"history": [
{
@@ -2435,8 +2435,8 @@
"summary": "Clearwater at Riverpark, a 136-unit Class A independent living community in Oxnard, was acquired by an unnamed S&P 500 company focused on senior housing. Built in 2018 within the master-planned Riverpark development, Clearwater at Riverpark is located at 750 Clyde River Place."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 4,
"history": [
{
@@ -2573,8 +2573,8 @@
"summary": "Atlas Peakview, a recently completed 330-unit multifamily community in the Denver suburb of Centennial, has been refinanced with a new $81 mil short-term, first-mortgage loan provided by Mesa West Capital. The property, delivered in 2025, is owned by a joint venture between The Dinerstein Companies and PGIM."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 2,
"history": [
{
@@ -2655,8 +2655,8 @@
"summary": "A 28-unit coastal multifamily investment property located along Santa Monicas Ocean Avenue corridor sold for $23. 46 mil, with the buyer assuming approximately $2."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 3,
"history": [
{
@@ -2770,8 +2770,8 @@
"summary": "Longpoint Partners has purchased Eastpoint I & II, a two-building, 136. 6k sf institutional-quality industrial business park in the highly sought-after Chandler submarket of Phoenix."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 3,
"history": [
{
@@ -2885,8 +2885,8 @@
"summary": "New York-based Sentinel Real Estate has acquired Talavera, a 293-unit apartment community in Folsom, CA. We�re told that Talavera was the first asset to become available in the Folsom submarket in four years."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 1,
"history": [
{
@@ -2934,8 +2934,8 @@
"summary": "A joint venture between PCCP and Stonemont has acquired a 38-asset, 5. 9 msf industrial portfolio diversified across 14 U."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 2,
"history": [
{
@@ -3016,8 +3016,8 @@
"summary": "GO Industrial has broken ground on a 1. 1 msf industrial building in Phoenix."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 3,
"history": [
{
@@ -3126,8 +3126,8 @@
"summary": "Gemdale USA has obtained a $90 mil mezzanine bridge loan for Aperture Del Mar, a newly constructed, 538k sf Class A life science campus in San Diego. The financing, provided by Breakthrough Properties and Tishman Speyer, will be used to refinance an existing loan."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 2,
"history": [
{
@@ -3208,8 +3208,8 @@
"summary": "Step Up Housing recently acquired two California multifamily communities totaling 406 units -- Copper Creek, a 268-unit community in Sacramento, and Terramonte at Foothill, a 138-unit community in Pomona for a combined price of $91. 35 mil."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 2,
"history": [
{
@@ -3290,8 +3290,8 @@
"summary": "San Diego-based ColRich acquired Avia 266, a 267-unit multifamily community in Mesa, AZ, in a $52. 4 mil ($196k/unit) transaction, including the assumption of an existing HUD loan."
},
"first_seen": "2026-08-05T19:53:22.976Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 69,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 70,
"revisions": 1,
"history": [
{
@@ -3339,8 +3339,8 @@
"summary": "In a major institutional multifamily trade, a BlackRock-managed vehicle acquired an 11-property, 3,620-unit residential portfolio in Southern California for $1. 625 bil ($449k/unit)."
},
"first_seen": "2026-08-06T00:14:52.638Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 56,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 57,
"revisions": 3,
"history": [
{
@@ -3454,8 +3454,8 @@
"summary": "OC-based investor EEW Holdings LLC has purchased Bernardo Executive Center, a three-building, 173. 1k sf office property in Rancho Bernardo, for $26."
},
"first_seen": "2026-08-06T00:14:52.638Z",
- "last_seen": "2026-08-06T18:37:16.390Z",
- "seen_count": 56,
+ "last_seen": "2026-08-06T18:57:19.247Z",
+ "seen_count": 57,
"revisions": 3,
"history": [
{
diff --git a/data/deals.json b/data/deals.json
index 9a34ffac..d8876938 100644
--- a/data/deals.json
+++ b/data/deals.json
@@ -1,6 +1,6 @@
{
"source": "rentv.com — live deal listings",
- "fetched_at": "2026-08-06T18:37:16.390Z",
+ "fetched_at": "2026-08-06T18:57:19.247Z",
"count": 30,
"deals": [
{
diff --git a/data/markets.json b/data/markets.json
index 88c35347..9f95f044 100644
--- a/data/markets.json
+++ b/data/markets.json
@@ -1,5 +1,5 @@
{
- "fetched_at": "2026-08-06T18:37:14.628Z",
+ "fetched_at": "2026-08-06T18:57:17.601Z",
"source": "Yahoo Finance — live (CBOE Treasury yields, Dow Jones/MSCI REIT indices)",
"curve": [
{
@@ -17,12 +17,12 @@
{
"label": "10-Year",
"value": "4.67%",
- "change_bps": 5,
+ "change_bps": 6,
"dir": "up"
},
{
"label": "30-Year",
- "value": "5.22%",
+ "value": "5.21%",
"change_bps": 4,
"dir": "up"
}
@@ -42,8 +42,8 @@
"reits": [
{
"label": "DJ U.S. Real Estate",
- "value": "394.25",
- "change_pct": -0.54,
+ "value": "393.94",
+ "change_pct": -0.62,
"dir": "down"
},
{
@@ -54,8 +54,8 @@
},
{
"label": "Vanguard REIT ETF (VNQ)",
- "value": "$98.34",
- "change_pct": -0.59,
+ "value": "$98.27",
+ "change_pct": -0.66,
"dir": "down"
}
],
diff --git a/data/news.json b/data/news.json
index 64b750e4..06f57d72 100644
--- a/data/news.json
+++ b/data/news.json
@@ -1,6 +1,6 @@
{
"source": "rentv.com — live",
- "fetched_at": "2026-08-06T18:37:14.348Z",
+ "fetched_at": "2026-08-06T18:57:17.296Z",
"count": 30,
"items": [
{
diff --git a/data/ticker.json b/data/ticker.json
index e8c00a95..b9abf6cd 100644
--- a/data/ticker.json
+++ b/data/ticker.json
@@ -1,5 +1,5 @@
{
- "fetched_at": "2026-08-06T18:37:14.601Z",
+ "fetched_at": "2026-08-06T18:57:17.551Z",
"la_office_vac": {
"label": "LA OFFICE VAC",
"value": "23.1%",
@@ -14,15 +14,15 @@
},
"cre_index": {
"label": "CRE INDEX",
- "value": "4,144",
- "change_pct": -0.54,
+ "value": "4,140",
+ "change_pct": -0.62,
"dir": "down",
"source": "Dow Jones U.S. Real Estate"
},
"ten_yr": {
"label": "10-YR",
"value": "4.67%",
- "change_bps": 5,
+ "change_bps": 6,
"dir": "up",
"source": "CBOE 10-Yr (^TNX)"
}
diff --git a/public/deals.html b/public/deals.html
index 22783334..cd3a06db 100644
--- a/public/deals.html
+++ b/public/deals.html
@@ -191,6 +191,7 @@
</div>
</div>
+<script src="/csrf.js"></script>
<script src="/admin/pr-intelligence/pr-shared.js"></script>
<script>
const $=s=>document.querySelector(s);
diff --git a/public/index.html b/public/index.html
index 04946cc6..42ed5f2c 100644
--- a/public/index.html
+++ b/public/index.html
@@ -194,8 +194,8 @@
<section class="vhero">
<div class="in">
<div class="eyebrow">▶ RENTV CRE Talk · Featured</div>
- <div class="fr"><iframe src="https://player.vimeo.com/video/1178561985?title=0&byline=0&portrait=0&dnt=1" title="CRE Talk Episode #20 with Colton Sudberry" allow="autoplay; fullscreen; picture-in-picture" allowfullscreen loading="lazy"></iframe></div>
- <div class="cap"><h2>CRE Talk Episode #20 — Colton Sudberry</h2><span>Hosted by Boomer · RENTV.com</span></div>
+ <div class="fr"><iframe id="vhero-frame" src="https://player.vimeo.com/video/1200839794?title=0&byline=0&portrait=0&dnt=1" title="CRE Talk Episode #22 with Bill Shopoff" allow="autoplay; fullscreen; picture-in-picture" allowfullscreen loading="lazy"></iframe></div>
+ <div class="cap"><h2 id="vhero-cap">CRE Talk Episode #22 — Bill Shopoff</h2><span>Hosted by Boomer · RENTV.com</span></div>
</div>
</section>
<main class="wrap"><div class="sechat" id="sechat"></div><section class="hero"><div class="lead" id="lead"></div><div class="aside" id="aside"></div></section></main>
diff --git a/server.js b/server.js
index e83668d1..68e15dc0 100644
--- a/server.js
+++ b/server.js
@@ -113,6 +113,14 @@ app.use((req, res, next) => {
const r = CRED_ROLE.get(az);
if (r) { req.role = r; req.authVia = 'basic'; }
else if (SERVICE_TOKEN && az === 'Bearer ' + SERVICE_TOKEN) { req.role = 'admin'; req.authVia = 'service'; }
+ else {
+ // Bridge a server-session ADMIN into the PR layer so server-realm admin pages (e.g. /deals →
+ // deals.html) can call /api/pr/* (deal notes). Admin-only: front-page 'user'-tier sessions must
+ // NOT reach the internal CRM. authVia='session' → the CSRF gate below applies to mutations
+ // (deals.html loads /csrf.js). pr_session CRM clients are unaffected (prAuthCtx checks them first).
+ const s = sessionOf(req);
+ if (s && s.role === 'admin') { req.role = s.role; req.authVia = 'session'; req.session = s; }
+ }
return next(); // no server creds → the PR layer's own login/session (or its gate's 401) applies
}
const s = sessionOf(req);
← f8daa54d Fix /consulting/slideshow dead 403: INTERNAL_STATIC guard no
·
back to Rentv
·
feat(services): guarantee >=1 vendor per category — curated 8d4a638e →