Changeset b919a67 in Klonkt for src/routes/auth.js

Timestamp:

06/19/2026 08:00:37 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

2900f1d

Parents:

70679063

Message:

auth: all Google login errors as clear explanation blocks (codes instead of bare alert)

The Google callback now redirects with ?gerr=<code> (admin/session/email/linked/
unavailable/failed) and auth-login.ejs maps each code to a clear explanation block
with icon + heading + text (admin gets the two login paths as well). Completes the
error indication consistently; free-form ?error= text remains as fallback for the
regular alert.

Co-Authored-By: Claude <noreply@…>

File:

• src/routes/auth.js (modified) (5 diffs)

src/routes/auth.js

@@ -236 +236 @@
 router.get('/google', (req, res) => {
   if (!fanLoginReady()) {
-    return res.redirect('/auth/login?error=' + encodeURIComponent('Inloggen met Google is op deze site niet beschikbaar.'));
+    return res.redirect('/auth/login?gerr=unavailable');
   }
   const state = crypto.randomBytes(16).toString('hex');
@@ -256 +256 @@
 
 router.get('/google/callback', async (req, res) => {
-  const fail = (msg) => res.redirect('/auth/login?error=' + encodeURIComponent(msg));
-  if (!fanLoginReady()) return fail('Inloggen met Google is op deze site niet beschikbaar.');
+  const fail = (code) => res.redirect('/auth/login?gerr=' + code);
+  if (!fanLoginReady()) return fail('unavailable');
   try {
     const { code, state } = req.query;
-    if (!code || !state || state !== req.session.oauthState) return fail('Login afgebroken of ongeldige sessie.');
+    if (!code || !state || state !== req.session.oauthState) return fail('session');
     const next = safeNext(req.session.oauthNext) || '';
     delete req.session.oauthState;
@@ -268 +268 @@
     const info = await fetchUserinfo(tok.access_token);
     const email = (info.email || '').trim().toLowerCase();
-    if (!email || info.email_verified === false) return fail('Geen geverifieerd Google-e-mailadres.');
+    if (!email || info.email_verified === false) return fail('email');
 
     let user = db.prepare('SELECT * FROM users WHERE LOWER(email) = ?').get(email);
@@ -277 +277 @@
       if (user.role === 'god' || user.role === 'admin') {
         // Eigen, duidelijke uitleg-pagina (zie auth-login.ejs) i.p.v. een kale melding.
-        return res.redirect('/auth/login?gerr=admin');
+        return fail('admin');
       }
       // Bestaande luisteraar: koppel google_sub/avatar als die ontbreken; weiger
       // als al aan een ander Google-account gekoppeld.
       if (user.google_sub && info.sub && user.google_sub !== info.sub) {
-        return fail('Dit e-mailadres is al aan een ander Google-account gekoppeld.');
+        return fail('linked');
       }
       db.prepare(`
@@ -307 +307 @@
   } catch (e) {
     console.error('[auth/google/callback]', e.message);
-    fail('Google-login mislukt. Probeer opnieuw.');
+    fail('failed');
   }
 });