revoked access to website for coaches, added web-specific tokens

2026-05-26 15:49:19 +02:00
parent 7671c9f329
commit 2181d1731e
36 changed files with 129 additions and 41 deletions
--- a/change_password.php
+++ b/change_password.php
@ -65,6 +65,16 @@ try {
        exit;
    }

+    if (($user['role'] ?? '') === 'coach') {
+        qdb_discard($tmpDb, $lockFp);
+        http_response_code(403);
+        echo json_encode([
+            "success" => false,
+            "message" => "Coach accounts can only sign in through the mobile app.",
+        ]);
+        exit;
+    }
+
    if (!password_verify($oldPassword, $user['passwordHash'])) {
        qdb_discard($tmpDb, $lockFp);
        http_response_code(401);