feat: add secure auth, admin and postgres persistence

2026-07-29 21:52:22 -04:00
parent 74b4c3a368
commit 432dd2176f
18 changed files with 946 additions and 256 deletions
@@ -0,0 +1 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Roast Planner Admin</title><link rel="stylesheet" href="/app.css"></head><body><main class="auth-page"><section class="panel-card auth-card"><a href="/app">← Plans</a><h1>Administration</h1><label><input id="signup" type="checkbox"> Allow new signups</label><button id="save" class="primary-btn">Save setting</button><h2>Users</h2><ul id="users"></ul><h2>Recent roast plans</h2><ul id="plans"></ul></section></main><script type="module">const csrf=()=>document.cookie.split('; ').find(v=>v.startsWith('rp_csrf='))?.split('=')[1]||'';const users=document.querySelector('#users'),plans=document.querySelector('#plans');async function load(){const b=await(await fetch('/api/admin/users')).json();document.querySelector('#signup').checked=b.signupEnabled;users.replaceChildren(...b.users.map(u=>Object.assign(document.createElement('li'),{textContent:`${u.email} (${u.role}) — ${u.plan_count} plans`})));const p=await(await fetch('/api/admin/plans')).json();plans.replaceChildren(...p.plans.map(x=>Object.assign(document.createElement('li'),{textContent:`${x.email}: ${x.plan?.fields?.['0.1']||'Untitled plan'}`})));}document.querySelector('#save').onclick=async()=>{await fetch('/api/admin/signup-enabled',{method:'PUT',headers:{'content-type':'application/json','x-csrf-token':csrf()},body:JSON.stringify({enabled:document.querySelector('#signup').checked})});await load();};load();</script></body></html>
				`@@ -0,0 +1 @@`
				<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Roast Planner Admin</title><link rel="stylesheet" href="/app.css"></head><body><main class="auth-page"><section class="panel-card auth-card"><a href="/app">← Plans</a><h1>Administration</h1><label><input id="signup" type="checkbox"> Allow new signups</label><button id="save" class="primary-btn">Save setting</button><h2>Users</h2><ul id="users"></ul><h2>Recent roast plans</h2><ul id="plans"></ul></section></main><script type="module">const csrf=()=>document.cookie.split('; ').find(v=>v.startsWith('rp_csrf='))?.split('=')[1]\|\|'';const users=document.querySelector('#users'),plans=document.querySelector('#plans');async function load(){const b=await(await fetch('/api/admin/users')).json();document.querySelector('#signup').checked=b.signupEnabled;users.replaceChildren(...b.users.map(u=>Object.assign(document.createElement('li'),{textContent:`${u.email} (${u.role}) — ${u.plan_count} plans`})));const p=await(await fetch('/api/admin/plans')).json();plans.replaceChildren(...p.plans.map(x=>Object.assign(document.createElement('li'),{textContent:`${x.email}: ${x.plan?.fields?.['0.1']\|\|'Untitled plan'}`})));}document.querySelector('#save').onclick=async()=>{await fetch('/api/admin/signup-enabled',{method:'PUT',headers:{'content-type':'application/json','x-csrf-token':csrf()},body:JSON.stringify({enabled:document.querySelector('#signup').checked})});await load();};load();</script></body></html>