Changeset f4b7b6a in Klonkt for src/routes/auth.js

Timestamp:

06/19/2026 09:31:54 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

1e2e9e7

Parents:

1080d14

Message:

feat(auth): public login = Google only; admin login hidden at /auth/admin

• /auth/login shows visitors only "Sign in with Google" (listeners/fans).
• Admin login (username/password) moved to hidden /auth/admin, linked from nowhere. POST errors + password-reset success redirect to /auth/admin.
• gerr=admin notice (Google with admin address) now links to /auth/admin.

Co-Authored-By: Claude <noreply@…>

File:

• src/routes/auth.js (modified) (4 diffs)

src/routes/auth.js

@@ -44 +44 @@
 }
 
-// ==================== LOGIN (beheerder = wachtwoord) ====================
+// ==================== LOGIN ====================
+// Publieke loginpagina: voor BEZOEKERS alleen Google-login (luisteraars/fans).
+// De beheerders-login (wachtwoord) staat hier bewust NIET — die zit verborgen op
+// /auth/admin (zie hieronder), zodat de admin-login niet zichtbaar is op de plek
+// waar bezoekers heen worden gestuurd.
 router.get('/login', (req, res) => {
   const next = safeNext(req.query.next) || '';
@@ -56 +60 @@
     success: req.query.success || null,
     username: '',
+    adminLogin: false,
     googleReady: fanLoginReady(),
+    next,
+  });
+});
+
+// Verborgen beheerders-login (gebruikersnaam + wachtwoord). Nergens in de UI
+// gelinkt — de beheerder navigeert hier rechtstreeks naartoe (/auth/admin).
+router.get('/admin', (req, res) => {
+  const next = safeNext(req.query.next) || '';
+  if (req.session.user) return res.redirect(next || '/');
+  if (isSetupMode()) return res.redirect('/auth/register' + (next ? '?next=' + encodeURIComponent(next) : ''));
+  renderPage(req, res, 'pages/auth-login', {
+    pageTitle: 'Beheerder inloggen',
+    bodyClass: 'on-special on-auth',
+    error: req.query.error || null,
+    gerr: null,
+    success: req.query.success || null,
+    username: '',
+    adminLogin: true,
+    googleReady: false,
     next,
   });
@@ -65 +89 @@
   const next = safeNext(req.body.next) || '';
 
+  // Foutweergave op de (verborgen) beheerders-loginpagina: toon het wachtwoord-
+  // formulier opnieuw (adminLogin:true), niet de Google-only publieke pagina.
   const renderErr = (error, status = 400) => {
     res.status(status);
     return renderPage(req, res, 'pages/auth-login', {
-      pageTitle: 'Inloggen', bodyClass: 'on-special',
-      error, success: null, username: username || '', googleReady: fanLoginReady(), next,
+      pageTitle: 'Beheerder inloggen', bodyClass: 'on-special on-auth',
+      error, gerr: null, success: null, username: username || '',
+      adminLogin: true, googleReady: false, next,
     });
   };
@@ -229 +256 @@
       updated_at = CURRENT_TIMESTAMP WHERE id = ?
   `).run(hash, row.id);
-  res.redirect('/auth/login?success=' + encodeURIComponent('Wachtwoord gereset — log nu in.'));
+  res.redirect('/auth/admin?success=' + encodeURIComponent('Wachtwoord gereset — log nu in.'));
 });