revoked access to website for coaches, added web-specific tokens

website/js/app.js

@@ -19,9 +19,26 @@ export function getRole() {
 export function getUser() {
     return localStorage.getItem('qdb_user') || '';
 }
+const WEBSITE_ROLES = ['admin', 'supervisor'];
+
+export function canAccessWebsite() {
+    return WEBSITE_ROLES.includes(getRole());
+}
+
 export function canEdit() {
-    const r = getRole();
-    return r === 'admin' || r === 'supervisor';
+    return canAccessWebsite();
+}
+
+function clearSession() {
+    localStorage.removeItem('qdb_token');
+    localStorage.removeItem('qdb_user');
+    localStorage.removeItem('qdb_role');
+}
+
+function rejectCoachSession() {
+    clearSession();
+    showToast('Coach accounts must use the mobile app.', 'error');
+    navigate('#/login');
 }
 
 export function showToast(message, type = 'info') {
@@ -40,6 +57,7 @@ export function showToast(message, type = 'info') {
 function authGuard(handler) {
     return (params) => {
         if (!isLoggedIn()) { navigate('#/login'); return; }
+        if (!canAccessWebsite()) { rejectCoachSession(); return; }
         return handler(params);
     };
 }
@@ -95,12 +113,14 @@ addRoute('/translations', roleGuard(['admin', 'supervisor'], translationsPage));
 document.addEventListener('DOMContentLoaded', () => {
     document.getElementById('logoutBtn').addEventListener('click', (e) => {
         e.preventDefault();
-        localStorage.removeItem('qdb_token');
-        localStorage.removeItem('qdb_user');
-        localStorage.removeItem('qdb_role');
+        clearSession();
         navigate('#/login');
     });
 
+    if (isLoggedIn() && !canAccessWebsite()) {
+        clearSession();
+    }
+
     window.addEventListener('hashchange', updateNav);
     updateNav();
     startRouter();