colorlink/afakzaid-rag
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.8.8: fix admin auth — hide main until token verified, block unauthenticated access

Browse Source
This commit is contained in:
colorlink
2026-05-28 20:34:06 +00:00
parent 49b5b195c3
commit 82879656c0
13 changed files with 351 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/admin.html
+10 -3
View File
@@ -388,7 +388,7 @@ a[role=button]:active {
</aside>
<!-- Main -->
<div id="main" class="lg:ml-64 min-h-screen">
<div id="main" class="lg:ml-64 min-h-screen" style="display:none">
<!-- Top bar (mobile) -->
<header class="lg:hidden sticky top-0 z-20 glass border-b border-primary/20 px-4 py-3 flex items-center gap-3">
<button onclick="openSidebar()" class="text-on-surface-variant hover:text-primary">
@@ -1657,17 +1657,24 @@ async function saveClaudeKey() {
// ── Auto-login on page load ───────────────────────────────────────────────────
if (JWT_TOKEN) {
document.getElementById('login').style.display = 'none';
// Verify token before showing admin
fetch('/auth/me', {headers:{'Authorization':'Bearer '+JWT_TOKEN}})
.then(r => r.ok ? r.json() : null)
.then(u => {
if (!u || u.role !== 'admin') {
JWT_TOKEN = ''; localStorage.removeItem('admin_jwt');
document.getElementById('login').style.display = 'flex';
document.getElementById('main').style.display = 'none';
} else {
document.getElementById('login').style.display = 'none';
document.getElementById('main').style.display = '';
loadOverview();
}
}).catch(() => { loadOverview(); }); // network error — stay logged in
}).catch(() => {
// Network error — show login to be safe
document.getElementById('login').style.display = 'flex';
document.getElementById('main').style.display = 'none';
});
}
// ── Nav init ──────────────────────────────────────────────────────────────────