Public Access
Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA
This commit is contained in:
+158
-16
@@ -79,20 +79,130 @@ function loginError(message) {
|
||||
el.hidden = !message;
|
||||
}
|
||||
|
||||
function loginStep(id) {
|
||||
$$('.login-step').forEach((s) => {
|
||||
s.hidden = s.id !== id;
|
||||
});
|
||||
loginError('');
|
||||
const input = document.getElementById(id)?.querySelector('input');
|
||||
if (input) input.focus();
|
||||
/* --------------------------------------------------------- auth screens */
|
||||
// The sign in flow is a sequence of small pages rather than one form that grows
|
||||
// as it goes. Each screen carries its own title and instruction, the header shows
|
||||
// where you are in the sequence, and the card animates between the two heights so
|
||||
// a tall screen like the QR code reads as a new page, not a form unfolding.
|
||||
|
||||
const AUTH_SCREENS = {
|
||||
'step-password': {
|
||||
title: 'Sign in',
|
||||
subtitle: 'Use the email address your account was set up with.',
|
||||
focus: '#login-email',
|
||||
},
|
||||
'step-2fa-verify': {
|
||||
screen: 'step-2fa',
|
||||
title: 'Two factor',
|
||||
subtitle: 'Enter the current code from your authenticator app.',
|
||||
focus: '#twofa-code',
|
||||
back: 'restart',
|
||||
},
|
||||
'step-2fa-setup': {
|
||||
screen: 'step-2fa',
|
||||
title: 'Set up two factor',
|
||||
subtitle: 'Scan this with Google Authenticator, Authy, 1Password or similar, then enter the code it shows.',
|
||||
focus: '#twofa-code',
|
||||
back: 'restart',
|
||||
},
|
||||
'step-recovery': {
|
||||
title: 'Recovery codes',
|
||||
subtitle: 'Each of these works once, if you ever lose the phone with your authenticator on it. Save them somewhere safe now — they are not shown again.',
|
||||
},
|
||||
'step-newpassword': {
|
||||
title: 'Choose a password',
|
||||
subtitle: 'Set one only you know before you continue.',
|
||||
focus: '#pw-current',
|
||||
},
|
||||
'step-setup': {
|
||||
title: 'Not set up yet',
|
||||
subtitle: 'No admin account exists on this server.',
|
||||
},
|
||||
};
|
||||
|
||||
// Which screens this particular sign in will pass through, so the header can say
|
||||
// "2 of 3" honestly rather than guessing.
|
||||
let authFlow = ['step-password'];
|
||||
let authCurrent = 'step-password';
|
||||
|
||||
function setAuthFlow(steps) {
|
||||
authFlow = steps;
|
||||
}
|
||||
|
||||
function renderAuthRail(key) {
|
||||
const rail = $('#auth-rail');
|
||||
const index = authFlow.indexOf(key);
|
||||
if (authFlow.length < 2 || index < 0) {
|
||||
rail.hidden = true;
|
||||
return;
|
||||
}
|
||||
rail.hidden = false;
|
||||
rail.innerHTML =
|
||||
authFlow.map((_, i) => `<i class="${i <= index ? 'done' : ''}"></i>`).join('') +
|
||||
`<span>Step ${index + 1} of ${authFlow.length}</span>`;
|
||||
}
|
||||
|
||||
function loginStep(key) {
|
||||
const meta = AUTH_SCREENS[key] || AUTH_SCREENS['step-password'];
|
||||
const targetId = meta.screen || key;
|
||||
const body = $('#auth-body');
|
||||
const previousHeight = body.offsetHeight;
|
||||
|
||||
authCurrent = key;
|
||||
$('#auth-title').textContent = meta.title;
|
||||
$('#auth-subtitle').textContent = meta.subtitle || '';
|
||||
$('#auth-subtitle').hidden = !meta.subtitle;
|
||||
$('#auth-back').hidden = !meta.back;
|
||||
renderAuthRail(key);
|
||||
loginError('');
|
||||
|
||||
$$('.auth-screen').forEach((el) => {
|
||||
el.hidden = el.id !== targetId;
|
||||
el.classList.remove('entering');
|
||||
});
|
||||
|
||||
const entering = document.getElementById(targetId);
|
||||
entering.classList.add('entering');
|
||||
|
||||
// Animate between the old and new heights so the card feels like it is turning
|
||||
// a page instead of jumping.
|
||||
const reduce = window.matchMedia('(prefers-reduced-motion: reduce)').matches;
|
||||
if (!reduce && previousHeight) {
|
||||
const nextHeight = body.scrollHeight;
|
||||
body.style.height = `${previousHeight}px`;
|
||||
requestAnimationFrame(() => {
|
||||
body.style.height = `${nextHeight}px`;
|
||||
});
|
||||
body.addEventListener(
|
||||
'transitionend',
|
||||
() => {
|
||||
body.style.height = '';
|
||||
},
|
||||
{ once: true }
|
||||
);
|
||||
}
|
||||
|
||||
const focusTarget = meta.focus ? $(meta.focus) : entering.querySelector('input');
|
||||
if (focusTarget) setTimeout(() => focusTarget.focus(), 60);
|
||||
}
|
||||
|
||||
$('#auth-back').addEventListener('click', async () => {
|
||||
if ((AUTH_SCREENS[authCurrent] || {}).back === 'restart') {
|
||||
await api('/logout', { method: 'POST' }).catch(() => {});
|
||||
$('#twofa-code').value = '';
|
||||
$('#login-password').value = '';
|
||||
setAuthFlow(['step-password']);
|
||||
loginStep('step-password');
|
||||
}
|
||||
});
|
||||
|
||||
/* ---------------------------------------------------------- login flow */
|
||||
|
||||
$('#step-password').addEventListener('submit', async (event) => {
|
||||
event.preventDefault();
|
||||
loginError('');
|
||||
const button = event.target.querySelector('button[type="submit"]');
|
||||
button.disabled = true;
|
||||
try {
|
||||
const result = await api('/login', {
|
||||
method: 'POST',
|
||||
@@ -101,34 +211,52 @@ $('#step-password').addEventListener('submit', async (event) => {
|
||||
handleLoginResult(result);
|
||||
} catch (err) {
|
||||
loginError(err.message);
|
||||
} finally {
|
||||
button.disabled = false;
|
||||
}
|
||||
});
|
||||
|
||||
function handleLoginResult(result) {
|
||||
if (result.status === 'twoFactorSetup') {
|
||||
$('#twofa-intro').textContent =
|
||||
'Two factor is required here. Scan this with an authenticator app (Google Authenticator, Authy, 1Password), then enter the code it shows.';
|
||||
$('#twofa-setup').hidden = false;
|
||||
$('#twofa-qr').src = result.qr;
|
||||
$('#twofa-secret').textContent = result.secret;
|
||||
$('#twofa-label').textContent = '6 digit code from the app';
|
||||
loginStep('step-2fa');
|
||||
// Enrolling always adds a recovery codes page, and the server tells us whether a
|
||||
// password change follows. Declaring the whole path now means the step counter
|
||||
// never changes its total halfway through.
|
||||
setAuthFlow([
|
||||
'step-password',
|
||||
'step-2fa-setup',
|
||||
'step-recovery',
|
||||
...(result.passwordChangeToFollow ? ['step-newpassword'] : []),
|
||||
]);
|
||||
loginStep('step-2fa-setup');
|
||||
return;
|
||||
}
|
||||
if (result.status === 'twoFactorRequired') {
|
||||
$('#twofa-intro').textContent = 'Enter the code from your authenticator app.';
|
||||
$('#twofa-setup').hidden = true;
|
||||
$('#twofa-label').textContent = '6 digit code, or a recovery code';
|
||||
loginStep('step-2fa');
|
||||
setAuthFlow([
|
||||
'step-password',
|
||||
'step-2fa-verify',
|
||||
...(result.passwordChangeToFollow ? ['step-newpassword'] : []),
|
||||
]);
|
||||
loginStep('step-2fa-verify');
|
||||
return;
|
||||
}
|
||||
if (result.recoveryCodes) {
|
||||
$('#recovery-list').innerHTML = result.recoveryCodes.map((c) => `<li>${esc(c)}</li>`).join('');
|
||||
recoveryCodes = result.recoveryCodes;
|
||||
$('#recovery-list').innerHTML = recoveryCodes.map((c) => `<li>${esc(c)}</li>`).join('');
|
||||
$('#recovery-done').dataset.next = result.status;
|
||||
if (result.status === 'passwordChangeRequired' && !authFlow.includes('step-newpassword')) {
|
||||
setAuthFlow([...authFlow, 'step-newpassword']);
|
||||
}
|
||||
loginStep('step-recovery');
|
||||
return;
|
||||
}
|
||||
if (result.status === 'passwordChangeRequired') {
|
||||
if (!authFlow.includes('step-newpassword')) setAuthFlow([...authFlow, 'step-newpassword']);
|
||||
loginStep('step-newpassword');
|
||||
return;
|
||||
}
|
||||
@@ -141,18 +269,29 @@ function handleLoginResult(result) {
|
||||
$('#step-2fa').addEventListener('submit', async (event) => {
|
||||
event.preventDefault();
|
||||
loginError('');
|
||||
const button = event.target.querySelector('button[type="submit"]');
|
||||
button.disabled = true;
|
||||
try {
|
||||
const result = await api('/login/2fa', { method: 'POST', body: { code: $('#twofa-code').value } });
|
||||
$('#twofa-code').value = '';
|
||||
handleLoginResult(result);
|
||||
} catch (err) {
|
||||
loginError(err.message);
|
||||
$('#twofa-code').select();
|
||||
} finally {
|
||||
button.disabled = false;
|
||||
}
|
||||
});
|
||||
|
||||
$('#twofa-cancel').addEventListener('click', async () => {
|
||||
await api('/logout', { method: 'POST' }).catch(() => {});
|
||||
loginStep('step-password');
|
||||
let recoveryCodes = [];
|
||||
|
||||
$('#recovery-copy').addEventListener('click', async () => {
|
||||
try {
|
||||
await navigator.clipboard.writeText(recoveryCodes.join('\n'));
|
||||
toast('Recovery codes copied.');
|
||||
} catch {
|
||||
toast('Copying was blocked. Write them down instead.', true);
|
||||
}
|
||||
});
|
||||
|
||||
$('#recovery-done').addEventListener('click', () => {
|
||||
@@ -1059,8 +1198,10 @@ async function boot() {
|
||||
if (session.setupNeeded) {
|
||||
$('#setup-message').textContent =
|
||||
'No admin accounts exist yet. Set ADMIN_BOOTSTRAP_EMAIL and ADMIN_BOOTSTRAP_PASSWORD in the .env file and restart the container to create the first one.';
|
||||
setAuthFlow(['step-setup']);
|
||||
loginStep('step-setup');
|
||||
} else {
|
||||
setAuthFlow(['step-password']);
|
||||
loginStep('step-password');
|
||||
}
|
||||
return;
|
||||
@@ -1069,6 +1210,7 @@ async function boot() {
|
||||
if (session.mustChangePassword) {
|
||||
$('#login').hidden = false;
|
||||
$('#console').hidden = true;
|
||||
if (!authFlow.includes('step-newpassword')) setAuthFlow([...authFlow, 'step-newpassword']);
|
||||
loginStep('step-newpassword');
|
||||
return;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user