security: gate /api/luxe-curator/regen + /pick behind requireAdmin (Codex audit)

2b40d83ff4eda9addbc2ba00886c5951215d12b8 · 2026-05-31 19:13:53 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 2b40d83ff4eda9addbc2ba00886c5951215d12b8
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun May 31 19:13:53 2026 -0700

    security: gate /api/luxe-curator/regen + /pick behind requireAdmin (Codex audit)
---
 server.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 811afa5..a124a4b 100644
--- a/server.js
+++ b/server.js
@@ -19604,7 +19604,7 @@ app.get('/api/luxe-curator', (req, res) => {
 //
 // Body: { root_id, variant: 'A'|'B'|'C'|'D'|'E' }
 // Returns: { ok, new_id, duration_ms } or { ok: false, error }
-app.post('/api/luxe-curator/regen', express.json({ limit: '4kb' }), async (req, res) => {
+app.post('/api/luxe-curator/regen', requireAdmin, express.json({ limit: '4kb' }), async (req, res) => {
   const rootId = parseInt(req.body?.root_id, 10);
   const variant = String(req.body?.variant || '').toUpperCase();
   if (!Number.isFinite(rootId) || !['A','B','C','D','E'].includes(variant)) {
@@ -19669,7 +19669,7 @@ app.post('/api/luxe-curator/regen', express.json({ limit: '4kb' }), async (req,
 //   - If a variant was picked: publish that luxe + unpublish all non-luxe
 //     descendants of root_id. Other variants stay is_published=FALSE.
 //   - If NONE: leave publish state alone (root stays published).
-app.post('/api/luxe-curator/pick', express.json({ limit: '4kb' }), (req, res) => {
+app.post('/api/luxe-curator/pick', requireAdmin, express.json({ limit: '4kb' }), (req, res) => {
   const rootId = parseInt(req.body?.root_id, 10);
   const picked = String(req.body?.picked_variant || '').toUpperCase();
   const luxeId = parseInt(req.body?.picked_luxe_id, 10);

← 1d5ddf1 deploy.conf: exclude .venv/__pycache__/logs + prod-only scri · back to Wallco Ai · designer-studio compose: bump generator spawn timeout 180s→3 531f5ce →