9294b152b8
Cloudflare Access self-hosted apps require a Cloudflare-managed zone, which workers.dev is not, so the JWT path never worked. Swap in a small login flow that fits the two-person scope: - POST /api/admin/login validates email against ALLOWED_ADMIN_EMAILS and password against ADMIN_PASSWORD (constant-time compare), then issues an HS256-signed JWT in an httpOnly cookie. - POST /api/admin/logout clears the cookie. - requireAdmin verifies the cookie via hono/jwt and exposes the email through context. - New /admin/login page; the dashboard redirects there on 401 and uses /api/admin/logout for the Sair button. Two new env vars are required (set as secrets in the dashboard): ADMIN_PASSWORD and SESSION_SECRET. CF_ACCESS_* are no longer used. https://claude.ai/code/session_01TPBqgcSJMppgrpiq7fLywL |
||
|---|---|---|
| .. | ||
| db | ||
| lib | ||
| routes | ||
| app.ts | ||
| env.ts | ||