asxpi/asxpio
asxpi/asxpio
1
0
Fork 0
Code Issues Pull requests Packages 1 Activity Actions

admin: user accounts and session login

Browse source 
The admin was one shared HTTP Basic login: no way to give someone
partial access, revoke one person, or tell who changed what. Add a users
table and a session login form. Passwords are scrypt hashes from Ruby's
OpenSSL, so no native gem is needed. Sessions carry a per-user version
that is bumped on password change, which logs that user out everywhere.

ADMIN_USER/ADMIN_PASSWORD now bootstrap the first superuser on an empty
table and afterwards only work while no active superuser exists, as a
recovery path that re-creates one. Until per-area permissions land,
non-superusers only reach the dashboard and their own password page.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-10 08:25:46 +04:00
commit 9bf40690e5
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
13 changed files with 436 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

3
public/style.css
View file

@ -356,6 +356,9 @@ a:hover {
font-size: 0.85rem;
}
.admin-nav a { color: var(--text-dim); text-decoration: none; }
.admin-nav-user { display: flex; gap: 8px; align-items: baseline; margin-left: 16px; padding-left: 16px; border-left: 1px solid var(--border); }
.admin-nav-user form { display: inline; }
.auth-form { max-width: 360px; margin: 0 auto; }
.admin-nav a.active,
.admin-nav a:hover { color: var(--text-bright); }
.dash { display: grid; gap: 24px; }