fix: basic-auth 3 has no default export, use parse()

basic-auth 3.0.0 (pulled in by 856479b) removed the default export in
favour of parse(str). The fleet-server and the webui still called the
default export, so their authentication was broken.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Simon Walz <contact@simonwalz.de>

Author: simonwalz

fleet-server/server.js

@@ -8,7 +8,7 @@ import http from 'http';
 import { WebSocketServer } from 'ws';
 import { fileURLToPath } from 'url';
 import fs from 'fs';
-import auth from 'basic-auth';
+import { parse as parseBasicAuth } from 'basic-auth';
 import Handlebars from 'handlebars';
 
 const locale = process.env.LOCALE || 'de-DE';
@@ -59,7 +59,7 @@ app.set('views', path.join(__dirname, 'views'));
 const ADMIN_USER = process.env.FLEET_ADMIN_USER || 'admin';
 const ADMIN_PASS = process.env.FLEET_ADMIN_PASS || 'admin';
 function requireAuth(req, res, next) {
-  const creds = auth(req);
+  const creds = parseBasicAuth(req.headers.authorization ?? '');
   if (!creds || creds.name !== ADMIN_USER || creds.pass !== ADMIN_PASS) {
     res.set('WWW-Authenticate', 'Basic realm="Fleet"');
     return res.status(401).json({ error: 'unauthorized' });

webui/app.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import express from 'express';
 import { engine } from 'express-handlebars';
-import basicAuth from 'basic-auth';
+import { parse as parseBasicAuth } from 'basic-auth';
 import bodyParser from 'body-parser';
 import net from 'net';
 import path from 'path';
@@ -93,7 +93,7 @@ app.set('view engine', 'handlebars');
 app.set('views', path.join(__dirname, 'views'));
 
 function auth(req, res, next) {
-  const user = basicAuth(req);
+  const user = parseBasicAuth(req.headers.authorization ?? '');
 
   if (!user || user.name !== USER) {
     res.set('WWW-Authenticate', 'Basic realm="cuos"');