feat: harden authenticated deployment

2026-07-29 22:04:40 -04:00
parent 432dd2176f
commit 892479dceb
20 changed files with 3677 additions and 1298 deletions
@@ -1 +1,24 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Roast Planner Admin</title><link rel="stylesheet" href="/app.css"></head><body><main class="auth-page"><section class="panel-card auth-card"><a href="/app">← Plans</a><h1>Administration</h1><label><input id="signup" type="checkbox"> Allow new signups</label><button id="save" class="primary-btn">Save setting</button><h2>Users</h2><ul id="users"></ul><h2>Recent roast plans</h2><ul id="plans"></ul></section></main><script type="module">const csrf=()=>document.cookie.split('; ').find(v=>v.startsWith('rp_csrf='))?.split('=')[1]||'';const users=document.querySelector('#users'),plans=document.querySelector('#plans');async function load(){const b=await(await fetch('/api/admin/users')).json();document.querySelector('#signup').checked=b.signupEnabled;users.replaceChildren(...b.users.map(u=>Object.assign(document.createElement('li'),{textContent:`${u.email} (${u.role}) — ${u.plan_count} plans`})));const p=await(await fetch('/api/admin/plans')).json();plans.replaceChildren(...p.plans.map(x=>Object.assign(document.createElement('li'),{textContent:`${x.email}: ${x.plan?.fields?.['0.1']||'Untitled plan'}`})));}document.querySelector('#save').onclick=async()=>{await fetch('/api/admin/signup-enabled',{method:'PUT',headers:{'content-type':'application/json','x-csrf-token':csrf()},body:JSON.stringify({enabled:document.querySelector('#signup').checked})});await load();};load();</script></body></html>
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width,initial-scale=1" />
+    <title>Roast Planner Admin</title>
+    <link rel="stylesheet" href="/app.css" />
+  </head>
+  <body>
+    <main class="auth-page">
+      <section class="panel-card auth-card">
+        <a href="/app">← Plans</a>
+        <h1>Administration</h1>
+        <label><input id="signup" type="checkbox" /> Allow new signups</label
+        ><button id="save" class="primary-btn">Save setting</button>
+        <h2>Users</h2>
+        <ul id="users"></ul>
+        <h2>Recent roast plans</h2>
+        <ul id="plans"></ul>
+      </section>
+    </main>
+    <script type="module" src="/js/admin.js"></script>
+  </body>
+</html>