From c79c3fa59da42e2afccd2009a5e00ab979f1f9f0 Mon Sep 17 00:00:00 2001
From: Chris Troutner <chris.troutner@gmail.com>
Date: Tue, 25 Nov 2025 08:27:35 -0800
Subject: [PATCH] fix(basic auth): Rejecting API calls that do not include
 basic auth header

---
 .env-local    | 13 +++++++------
 bin/server.js | 31 ++++++++++++++++++++++++++++---
 2 files changed, 35 insertions(+), 9 deletions(-)

diff --git a/.env-local b/.env-local
index ea94e3d..6cdb413 100644
--- a/.env-local
+++ b/.env-local
@@ -6,13 +6,13 @@ RPC_USERNAME=bitcoin
 RPC_PASSWORD=password
 
 # Fulcrum Indexer
-FULCRUM_API=http://192.168.2.127:3001/v1
+FULCRUM_API=http://172.17.0.1:3001/v1
 
 # SLP Indexer
-SLP_INDEXER_API=http://192.168.2.127:5010
+SLP_INDEXER_API=http://localhost:5010
 
 # REST API URL for wallet operations
-LOCAL_RESTURL=http://localhost:5942/v6/
+LOCAL_RESTURL=http://localhost:5942/v6
 
 # END INFRASTRUCTURE SETUP
 
@@ -23,7 +23,8 @@ LOCAL_RESTURL=http://localhost:5942/v6/
 X402_ENABLED=false
 
 # Basic Authentication required to access this API?
-USE_BASIC_AUTH=false
-#BASIC_AUTH_TOKEN=some-random-token
+USE_BASIC_AUTH=true
+BASIC_AUTH_TOKEN=some-random-token
+
+# END ACCESS CONTROL
 
-# END ACCESS CONTROL
\ No newline at end of file
diff --git a/bin/server.js b/bin/server.js
index d9b3900..7b6c7a8 100644
--- a/bin/server.js
+++ b/bin/server.js
@@ -86,7 +86,7 @@ class Server {
       // - If X402_ENABLED=false OR USE_BASIC_AUTH=false: Don't apply x402 (no rate limits)
       // - If X402_ENABLED=true AND USE_BASIC_AUTH=true: Apply x402 conditionally (bypass if basic auth valid)
 
-      // Only apply x402 if both are enabled
+      // Apply access control middleware based on configuration
       if (x402Settings.enabled && basicAuthSettings.enabled) {
         // X402_ENABLED=true AND USE_BASIC_AUTH=true: Apply x402 conditionally
         const routes = buildX402Routes(this.config.apiPrefix)
@@ -112,9 +112,34 @@ class Server {
         }
 
         app.use(conditionalX402Middleware)
+      } else if (basicAuthSettings.enabled && !x402Settings.enabled) {
+        // USE_BASIC_AUTH=true AND X402_ENABLED=false: Require basic auth, reject unauthenticated requests
+        wlogger.info('Basic auth enforcement enabled (x402 disabled)')
+
+        // Middleware that rejects requests without valid basic auth
+        const requireBasicAuthMiddleware = (req, res, next) => {
+          // Skip auth check for health endpoint and root
+          if (req.path === '/health' || req.path === '/') {
+            return next()
+          }
+
+          // If basic auth is valid, allow the request
+          if (req.locals?.basicAuthValid === true) {
+            return next()
+          }
+
+          // Reject unauthenticated requests
+          wlogger.warn(`Unauthenticated request rejected: ${req.method} ${req.path}`)
+          return res.status(401).json({
+            error: 'Unauthorized',
+            message: 'Valid Bearer token required in Authorization header'
+          })
+        }
+
+        app.use(requireBasicAuthMiddleware)
       } else {
-        // X402_ENABLED=false OR USE_BASIC_AUTH=false: No x402 middleware
-        wlogger.info('x402 middleware disabled via configuration')
+        // X402_ENABLED=false AND USE_BASIC_AUTH=false: No access control middleware
+        wlogger.info('No access control middleware enabled')
       }
 
       // Endpoint logging middleware