[object Object]

← back to Wallco Ai

security: remove vestigial admin:DWSecure2024! basic-auth string

63833d5b21869fa843e43642f577434b1e8115ab · 2026-05-29 08:24:45 -0700 · Steve Abrams

The wallco admin gate (src/admin-gate.js) authorizes via localhost / signed
dw_auth JWT (AUTH_DEV_SECRET) / ADMIN_TOKEN — there is NO basic-auth password
check. admin:DWSecure2024! in the reload-designs curl examples + the etsy
mockup-queue script was sent in the -u/auth flag but never validated; those
calls work because they hit 127.0.0.1 (localhost tier). Drop the dead string
so it stops looking like a live credential in tracked files (and in backups).

Files touched

Diff

commit 63833d5b21869fa843e43642f577434b1e8115ab
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri May 29 08:24:45 2026 -0700

    security: remove vestigial admin:DWSecure2024! basic-auth string
    
    The wallco admin gate (src/admin-gate.js) authorizes via localhost / signed
    dw_auth JWT (AUTH_DEV_SECRET) / ADMIN_TOKEN — there is NO basic-auth password
    check. admin:DWSecure2024! in the reload-designs curl examples + the etsy
    mockup-queue script was sent in the -u/auth flag but never validated; those
    calls work because they hit 127.0.0.1 (localhost tier). Drop the dead string
    so it stops looking like a live credential in tracked files (and in backups).
---
 CLAUDE.md                                     | 2 +-
 data/yolo-overnight/baseline-20260525-0201.md | 2 +-
 scripts/queue-room-mockups-for-etsy-bucket.js | 4 +++-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 7faf8b4..ce374c6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -27,7 +27,7 @@ node scripts/triage-ghost-flagged.js   # interactive triage of ghost-flagged row
 
 # Database snapshot ↔ static JSON
 node scripts/sync-designs-json-product-line.js   # PG → data/designs.json (the server reads from this on boot)
-curl -X POST -u admin:DWSecure2024! http://127.0.0.1:9905/admin/reload-designs   # hot-reload data/designs.json without restart
+curl -X POST http://127.0.0.1:9905/admin/reload-designs   # hot-reload data/designs.json (localhost-gated, no auth needed)
 ```
 
 `npm test` is a placeholder (no test suite). Validation happens via the publish-gate stack (settlement + edges + ghost + seamless detectors) before `is_published=true`.
diff --git a/data/yolo-overnight/baseline-20260525-0201.md b/data/yolo-overnight/baseline-20260525-0201.md
index 6f3cc95..80d9f8b 100644
--- a/data/yolo-overnight/baseline-20260525-0201.md
+++ b/data/yolo-overnight/baseline-20260525-0201.md
@@ -27,7 +27,7 @@ tailscaled wildcard-bind conflict). It returns 401 even with admin creds.
 The real wallco-ai port is **9905** (per `pm2 env` and `ss -tlnp`). Hit it with admin auth:
 
 ```
-$ curl -s -u 'admin:DWSecure2024!' 'http://127.0.0.1:9905/api/designs?limit=1'
+$ curl -s 'http://127.0.0.1:9905/api/designs?limit=1'
 ```
 
 ```json
diff --git a/scripts/queue-room-mockups-for-etsy-bucket.js b/scripts/queue-room-mockups-for-etsy-bucket.js
index 4ee5e85..b37e077 100644
--- a/scripts/queue-room-mockups-for-etsy-bucket.js
+++ b/scripts/queue-room-mockups-for-etsy-bucket.js
@@ -118,8 +118,10 @@ async function main() {
       // Hot-reload the in-memory DESIGNS — no pm2 restart needed
       const reload = await new Promise((resolve) => {
         const u = new URL(opt.apiBase + '/admin/reload-designs');
+        // /admin/reload-designs is localhost-gated (src/admin-gate.js isAdmin →
+        // loopback). No basic-auth needed; the request authenticates by origin.
         const req = http.request({ method: 'POST', hostname: u.hostname, port: u.port, path: u.pathname,
-          auth: 'admin:DWSecure2024!', timeout: 15000 }, res => {
+          timeout: 15000 }, res => {
           let data = ''; res.on('data', c => data += c);
           res.on('end', () => resolve({ status: res.statusCode, body: data.slice(0, 200) }));
         });

← 692c3ba Update Claude model IDs to claude-opus-4-8 (Opus 4.8 upgrade  ·  back to Wallco Ai  ·  haiku 4.5 weekend defect-scan test scripts + monday summary 431fbf5 →