From 064f05536a07d1f5aeb95b2adbab10d08be4dff1 Mon Sep 17 00:00:00 2001
From: poslop <poslop@archfox.org>
Date: Wed, 9 Sep 2026 17:17:00 -0500
Subject: [PATCH] Admin page: validate key before persisting to sessionStorage
 (#99)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Panel was already display:none-gated until auth; tightened so a wrong
submitted key is never stored in sessionStorage — the typed key is
validated via the settings API first, and only persisted on 200.
---
 internal/web/templates/admin.html | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/internal/web/templates/admin.html b/internal/web/templates/admin.html
index d2eb786..86f10ee 100644
--- a/internal/web/templates/admin.html
+++ b/internal/web/templates/admin.html
@@ -44,7 +44,8 @@
 
   function api(path, opts) {
     opts = opts || {};
-    opts.headers = { 'X-Admin-Key': key() };
+    // allow callers to override the key header (e.g. validating a typed key, #99)
+    opts.headers = Object.assign({ 'X-Admin-Key': key() }, opts.headers || {});
     if (opts.body) opts.headers['Content-Type'] = 'application/json';
     return fetch(path, opts);
   }
@@ -72,9 +73,10 @@
 
   document.getElementById('admin-key-form').addEventListener('submit', function (e) {
     e.preventDefault();
-    sessionStorage.setItem(KEY, keyInput.value);
-    api('/admin/api/settings').then(function (r) {
+    // #99: don't persist the key until the server accepts it
+    api('/admin/api/settings', { headers: { 'X-Admin-Key': keyInput.value } }).then(function (r) {
       if (r.status === 200) {
+        sessionStorage.setItem(KEY, keyInput.value);
         status.textContent = '✓';
         keyInput.value = '';
         loadSettings();