From d2a8b2abc908311fc249454086d0d0eacfe861e1 Mon Sep 17 00:00:00 2001 From: dax Date: Wed, 5 Aug 2026 17:52:07 +0100 Subject: admin auth: fixed pathways-admin username shown in setup/login so browser saves password; server verifies username --- server.mjs | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'server.mjs') diff --git a/server.mjs b/server.mjs index 9984ecc..cfd963c 100644 --- a/server.mjs +++ b/server.mjs @@ -577,12 +577,14 @@ const server = http.createServer(async (req, res) => { if (req.method !== "POST") return json(res, 405, { error: "method not allowed" }) if (await loadAdmin()) return json(res, 409, { error: "admin already configured" }) const body = await readBody(req, 1024) + const username = String(body?.username || "").trim() || "pathways-admin" const password = String(body?.password || "") + if (username.length < 2 || username.length > 40) return json(res, 400, { error: "username must be 2-40 characters" }) if (password.length < 8) return json(res, 400, { error: "password must be at least 8 characters" }) const salt = randomBytes(16).toString("hex") const hash = await hashPassword(password, salt) - await writeJson(ADMIN_FILE, { salt, hash, createdAt: new Date().toISOString() }) - return json(res, 200, { ok: true }) + await writeJson(ADMIN_FILE, { username, salt, hash, createdAt: new Date().toISOString() }) + return json(res, 200, { ok: true, username }) } if (path === "/api/admin/login") { if (req.method !== "POST") return json(res, 405, { error: "method not allowed" }) @@ -593,11 +595,13 @@ const server = http.createServer(async (req, res) => { const admin = await loadAdmin() if (!admin) return json(res, 400, { error: "no admin password configured yet" }) const body = await readBody(req, 1024) + const username = String(body?.username || "").trim().toLowerCase() || "pathways-admin" const password = String(body?.password || "") - if (!(await verifyPassword(password, admin))) { + const storedUser = String(admin.username || "pathways-admin").trim().toLowerCase() + if (username !== storedUser || !(await verifyPassword(password, admin))) { loginFails++ if (loginFails >= 8) { loginFails = 0; loginLockUntil = Date.now() + 60_000 } - return json(res, 401, { error: "wrong password" }) + return json(res, 401, { error: "wrong username or password" }) } loginFails = 0 const remember = !!body?.remember -- cgit v1.3.1