Carlos Arias
b967419717
- /admin login page (public, noindex): password form + signed-in panel that activates the in-page console. Verified in-browser: login -> panel -> the astroagent handle appears on other pages. - Secret-link login: visit /admin/<token> to sign in without a password. adminauth token() validates a bcrypt-hashed token, sets the session, 302s to /admin. nginx routes the token path to PHP. set-admin-token.php generates it. - Password login kept as a fallback. Verified: token link -> session -> console access; bad token -> /admin?e=1. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DoFYZY9gkGPNDqZ7NuEa9a
8 lines
374 B
SQL
8 lines
374 B
SQL
-- Secret-link login for the admin console.
|
|
--
|
|
-- A hashed token so you can log in by visiting /admin/<token> instead of typing
|
|
-- a password. Stored the same way as the password (bcrypt) — the plaintext
|
|
-- lives only in your bookmark. Password login stays as a fallback.
|
|
|
|
ALTER TABLE `cja_admin`
|
|
ADD COLUMN `token_hash` varchar(255) DEFAULT NULL AFTER `password_hash`;
|