2 Commits

Author	SHA1	Message	Date
MechaCat02	a2374f7583	feat: implement host dashboard ... Add Host Dashboard backend endpoints and frontend UI for event and guest management. Backend: - GET /api/v1/host/event — event name, lock/release status - POST /api/v1/host/event/close|open — lock/unlock uploads; SSE broadcast - POST /api/v1/host/gallery/release — set export_released_at, enqueue export jobs - GET /api/v1/host/users — all guests with upload count & bytes - POST /api/v1/host/users/{id}/ban — ban with optional upload hide - POST /api/v1/host/users/{id}/unban — lift ban - PATCH /api/v1/host/users/{id}/role — promote/demote guest ↔ host - DELETE /api/v1/host/upload/{id} — host-level upload delete + SSE - DELETE /api/v1/host/comment/{id} — host-level comment delete Frontend: - /host page: event controls (lock toggle, release gallery button), guest table with ban modal (keep/hide uploads choice), promote/demote - auth.ts: getRole() decodes JWT payload to read role without a round-trip Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-02 20:42:59 +02:00
fabi	8b9d916265	feat: implement authentication flow ... Backend: - AppConfig, AppError, AppState modules for shared infrastructure - JWT creation/verification with HS256 (jsonwebtoken crate) - Session management: SHA-256 token hashing, DB-backed sessions - Auth middleware: AuthUser, RequireHost, RequireAdmin extractors - POST /api/v1/join: name-only registration, 4-digit PIN + bcrypt hash - POST /api/v1/recover: PIN-based recovery with 3-attempt lockout (15 min) - POST /api/v1/admin/login: bcrypt password verification - DELETE /api/v1/session: logout (session invalidation) - Migration 006: user PIN lockout columns (failed_pin_attempts, pin_locked_until) - Models: Event, User (with role enum), Session with all CRUD methods Frontend: - api.ts: typed fetch wrapper with automatic Bearer token injection - auth.ts: JWT/PIN localStorage management with Svelte store - /join: name entry form with PIN display modal and copy button - /recover: name + PIN recovery form with saved PIN pre-fill - /feed: placeholder gallery page with logout - Root layout: auth initialization on mount - Root page: redirect to /join or /feed based on auth state All responses use German language strings as specified. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-31 21:44:03 +02:00