tomh104/nat-as-server
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

revoked access to website for coaches, added web-specific tokens

Browse Source
This commit is contained in:
Tom Hempel
2026-05-26 15:49:19 +02:00
parent 7671c9f329
commit 2181d1731e
36 changed files with 129 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
website/js/pages/login.js
View File

@ -55,7 +55,10 @@ export function loginPage() {
try {
const res = await fetch('../api/auth/login', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
headers: {
'Content-Type': 'application/json',
'X-QDB-Client': 'web',
},
body: JSON.stringify({ username, password }),
});
const json = await res.json();
@ -65,6 +68,11 @@ export function loginPage() {
return;
}
const d = json.data;
if (d.role === 'coach') {
errEl.textContent = 'Coach accounts can only sign in through the mobile app.';
errEl.style.display = '';
return;
}
if (d.mustChangePassword) {
pendingUsername = username;
pendingTempToken = d.token;
@ -95,7 +103,10 @@ export function loginPage() {
}
const oldPw = document.getElementById('password').value;
try {
const headers = { 'Content-Type': 'application/json' };
const headers = {
'Content-Type': 'application/json',
'X-QDB-Client': 'web',
};
if (pendingTempToken) {
headers['Authorization'] = `Bearer ${pendingTempToken}`;
}
@ -111,6 +122,11 @@ export function loginPage() {
return;
}
const d = json.data;
if (d.role === 'coach') {
errEl.textContent = 'Coach accounts can only sign in through the mobile app.';
errEl.style.display = '';
return;
}
localStorage.setItem('qdb_token', d.token);
localStorage.setItem('qdb_user', d.user);
localStorage.setItem('qdb_role', d.role);