From d2a8b2abc908311fc249454086d0d0eacfe861e1 Mon Sep 17 00:00:00 2001
From: dax <me@dax.ist>
Date: Wed, 5 Aug 2026 17:52:07 +0100
Subject: admin auth: fixed pathways-admin username shown in setup/login so
 browser saves password; server verifies username

---
 public/admin.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'public/admin.js')

diff --git a/public/admin.js b/public/admin.js
index 0540236..90dd6b0 100644
--- a/public/admin.js
+++ b/public/admin.js
@@ -385,13 +385,14 @@ async function init() {
   $("#setup-form").addEventListener("submit", async (e) => {
     e.preventDefault()
     const err = $("#setup-err")
+    const user = $("#setup-user").value.trim() || "pathways-admin"
     const pw = $("#setup-pw").value
     const pw2 = $("#setup-pw2").value
     err.textContent = ""
     if (pw.length < 8) { err.textContent = "password must be at least 8 characters"; return }
     if (pw !== pw2) { err.textContent = "passwords don't match"; return }
     try {
-      await api("/api/admin/setup", { method: "POST", body: JSON.stringify({ password: pw }), headers: { "Content-Type": "application/json" } })
+      await api("/api/admin/setup", { method: "POST", body: JSON.stringify({ username: user, password: pw }), headers: { "Content-Type": "application/json" } })
       toast("password set — sign in")
       $("#setup-pw").value = ""
       $("#setup-pw2").value = ""
@@ -404,8 +405,10 @@ async function init() {
     const err = $("#login-err")
     err.textContent = ""
     try {
-      const data = await api("/api/admin/login", { method: "POST", body: JSON.stringify({ password: $("#login-pw").value, remember: $("#login-remember").checked }), headers: { "Content-Type": "application/json" } })
+      const user = $("#login-user").value.trim() || "pathways-admin"
+      const data = await api("/api/admin/login", { method: "POST", body: JSON.stringify({ username: user, password: $("#login-pw").value, remember: $("#login-remember").checked }), headers: { "Content-Type": "application/json" } })
       setToken(data.token, !!data.remember)
+      $("#dash-user").textContent = user
       $("#login-pw").value = ""
       await enterDash()
     } catch (err2) { errInto(err, err2) }
-- 
cgit v1.3.1