Fix contact forms: send George X-Send-Approval token when configured (external-send guard)

b6dc7976f1d2c04f36ebc61a261d4b31c51be455 · 2026-07-14 13:06:39 -0700 · Steve

Files touched

M _universal-contact.js

Diff

commit b6dc7976f1d2c04f36ebc61a261d4b31c51be455
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Jul 14 13:06:39 2026 -0700

    Fix contact forms: send George X-Send-Approval token when configured (external-send guard)
---
 _universal-contact.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/_universal-contact.js b/_universal-contact.js
index ad4dc58..d881e2b 100644
--- a/_universal-contact.js
+++ b/_universal-contact.js
@@ -25,6 +25,10 @@ module.exports = function (app, opts) {
   const GEORGE_BASE = process.env.GEORGE_BASE || 'http://localhost:9850';
   // P0 fix: NO fallback creds. If env missing, email path fails closed but lead persistence still works.
   const GEORGE_AUTH = process.env.GEORGE_AUTH || '';
+  // George fail-closes external email (info@<site> is external to George's own
+  // Gmail) and requires the human-approval token via X-Send-Approval, else the
+  // send 502s and every form submission is silently dropped.
+  const GEORGE_APPROVAL = process.env.GEORGE_EXTERNAL_SEND_TOKEN || '';
   const ZD_KEY = process.env.ZD_WIDGET_KEY || '';
   const ZD_COLOR = opts.zdColor || '#C9A14B';
   const ZD_POSITION = opts.zdPosition || 'right';
@@ -102,11 +106,11 @@ module.exports = function (app, opts) {
         port: u.port || (u.protocol === 'https:' ? 443 : 80),
         path: u.pathname + u.search,
         method: 'POST',
-        headers: {
+        headers: Object.assign({
           'Content-Type': 'application/json',
           'Content-Length': Buffer.byteLength(data),
           'Authorization': GEORGE_AUTH
-        },
+        }, GEORGE_APPROVAL ? { 'X-Send-Approval': GEORGE_APPROVAL } : {}),
         timeout: 5000
       }, (res) => {
         let body = '';

← 4d70505 auto-save: 2026-07-14T13:01:14 (1 files) — scripts/rebuild-a · back to Silverleafwallpaper · chore: lint, refactor, v0.2.0 (session close) 867cd17 →