Sergei Poljanski
9bf40690e5
The admin was one shared HTTP Basic login: no way to give someone partial access, revoke one person, or tell who changed what. Add a users table and a session login form. Passwords are scrypt hashes from Ruby's OpenSSL, so no native gem is needed. Sessions carry a per-user version that is bumped on password change, which logs that user out everywhere. ADMIN_USER/ADMIN_PASSWORD now bootstrap the first superuser on an empty table and afterwards only work while no active superuser exists, as a recovery path that re-creates one. Until per-area permissions land, non-superusers only reach the dashboard and their own password page. Assisted-by: Claude:opus-5
11 lines
707 B
Text
11 lines
707 B
Text
<nav class="admin-nav">
|
|
<% [['/admin', 'dashboard'], ['/admin/invoices', 'invoices'], ['/admin/bingo', 'bingo']].each do |href, label| %>
|
|
<a href="<%= href %>" class="<%= 'active' if href == '/admin' ? request.path == '/admin' : request.path.start_with?(href) %>"><%= label %></a>
|
|
<% end %>
|
|
<% if current_user %>
|
|
<span class="admin-nav-user">
|
|
<a href="/admin/account/password" title="Change password"><%= current_user.username %></a>
|
|
<form method="post" action="/admin/logout"><input type="hidden" name="authenticity_token" value="<%= csrf_token %>" /><button type="submit" class="link-button">log out</button></form>
|
|
</span>
|
|
<% end %>
|
|
</nav>
|