jhodgkin/lisilou-portfolio
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

Simple password-protected admin page for managing bookings #9

New Issue
Closed
opened 2026-07-07 21:39:11 -06:00 by jhodgkin · 1 comment
jhodgkin commented 2026-07-07 21:39:11 -06:00
Owner
Copy Link
Copy Source

Goal

A minimal admin page at /admin where the photographer can see upcoming bookings and confirm Venmo payments.

Authentication

  • Single password stored as ADMIN_PASSWORD_HASH (bcrypt) in api/.env
  • POST /api/admin/login returns a signed JWT (24hr expiry)
  • All /api/admin/* routes require Authorization: Bearer <token>
  • Admin page stores JWT in sessionStorage

Admin page (src/admin.html)

Served by nginx at /admin — separate file from the main portfolio.

Bookings table showing:

  • Client name + email
  • Session date, type, length
  • Location
  • Contract signed (yes/no + download link)
  • Payment status badge (pending / pending_confirmation / confirmed)
  • Actions: "Confirm Payment" button, "Cancel Booking" button

Filters: upcoming only | all | pending payment

API endpoints

  • GET /api/admin/bookings — list all bookings (newest first)
  • PATCH /api/admin/bookings/:id — update status/payment_status
  • GET /api/admin/bookings/:id/contract — download signed PDF

Acceptance

  • Can log in with the configured password
  • Clicking "Confirm Payment" updates the record and triggers the n8n payment-confirmed webhook
  • Signed PDF is downloadable
## Goal A minimal admin page at `/admin` where the photographer can see upcoming bookings and confirm Venmo payments. ## Authentication - Single password stored as `ADMIN_PASSWORD_HASH` (bcrypt) in `api/.env` - `POST /api/admin/login` returns a signed JWT (24hr expiry) - All `/api/admin/*` routes require `Authorization: Bearer <token>` - Admin page stores JWT in sessionStorage ## Admin page (`src/admin.html`) Served by nginx at `/admin` — separate file from the main portfolio. **Bookings table showing:** - Client name + email - Session date, type, length - Location - Contract signed (yes/no + download link) - Payment status badge (pending / pending_confirmation / confirmed) - Actions: "Confirm Payment" button, "Cancel Booking" button **Filters:** upcoming only | all | pending payment ## API endpoints - `GET /api/admin/bookings` — list all bookings (newest first) - `PATCH /api/admin/bookings/:id` — update status/payment_status - `GET /api/admin/bookings/:id/contract` — download signed PDF ## Acceptance - Can log in with the configured password - Clicking "Confirm Payment" updates the record and triggers the n8n payment-confirmed webhook - Signed PDF is downloadable
jhodgkin commented 2026-07-07 21:54:19 -06:00
Author
Owner
Copy Link
Copy Source

Superseded by #10 (Authentik OIDC) and #11 (full management dashboard). Closing.

Superseded by #10 (Authentik OIDC) and #11 (full management dashboard). Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jhodgkin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: jhodgkin/lisilou-portfolio#9
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?