admin panel for walk-graph management; /api/import gated behind admin login

1 files changed, 13 insertions, 1 deletions

diff --git a/public/app.js b/public/app.js
index 0959509..311faa9 100644
--- a/public/app.js
+++ b/public/app.js
@@ -14,6 +14,16 @@ const progressText = $("#progress-text")
 const splash = $("#splash")
 const startBtn = $("#start")
 
+function adminToken() {
+  for (const store of [localStorage, sessionStorage]) {
+    try {
+      const raw = store.getItem("pathways_admin")
+      if (raw) { const t = JSON.parse(raw).token; if (t) return t }
+    } catch { /* ignore */ }
+  }
+  return null
+}
+
 addEventListener("error", (e) => {
   toast(`error: ${e.message || "script failed"}`, true)
 })
@@ -306,7 +316,7 @@ function choosePlacement(id, dir) {
   scored.sort((a, b) => a.cost - b.cost)
   const best = scored[0]
   const next = ex.next && !rectOf.has(ex.next.id) ? scored.find((s) => s.id === ex.next.id) : null
-  const chosen = next && next.cost - best.cost <= FIT_TOLERANCE ? next : best
+  const chosen = (ex.forced && next) || (next && next.cost - best.cost <= FIT_TOLERANCE) ? next : best
   const out = { id: chosen.id, info: chosen.info, rect: chosen.rect }
   placementCache.set(key, out)
   return out
@@ -843,6 +853,8 @@ function uploadWithProgress(form, onPct, onUploaded) {
   return new Promise((resolve, reject) => {
     const xhr = new XMLHttpRequest()
     xhr.open("POST", "/api/import")
+    const tok = adminToken()
+    if (tok) xhr.setRequestHeader("Authorization", "Bearer " + tok)
     xhr.upload.addEventListener("progress", (e) => {
       if (e.lengthComputable) onPct(Math.min(100, Math.round((e.loaded / e.total) * 100)))
     })