app/static/admin.html

<!doctype html>
<html lang="it">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>PLM Lottery — Admin</title>
<style>
  @import url('https://fonts.googleapis.com/css2?family=Fira+Code:wght@500;600&family=Fira+Sans:wght@400;500;600;700&display=swap');

  :root {
    --color-background: #F8FAFC;
    --color-surface: #FFFFFF;
    --color-foreground: #0F172A;
    --color-muted-foreground: #64748B;
    --color-border: #E2E8F0;
    --color-primary: #F59E0B;
    --color-on-primary: #0F172A;
    --color-destructive: #DC2626;
    --color-destructive-bg: #FEF2F2;
    --color-success: #16A34A;
    --color-success-bg: #F0FDF4;
    --color-ring: #F59E0B;
    --radius: 12px;
  }

  * { box-sizing: border-box; }

  body {
    font-family: 'Fira Sans', system-ui, sans-serif;
    background: var(--color-background);
    color: var(--color-foreground);
    max-width: 480px;
    margin: 0 auto;
    padding: 32px 20px 80px;
    line-height: 1.5;
  }

  .mono { font-family: 'Fira Code', monospace; }

  header { margin-bottom: 24px; }
  header h1 { font-size: 1.375rem; font-weight: 700; margin: 0; letter-spacing: -0.01em; }
  header p { color: var(--color-muted-foreground); font-size: 0.9rem; margin: 4px 0 0; }

  .card {
    background: var(--color-surface);
    border: 1px solid var(--color-border);
    border-radius: var(--radius);
    padding: 20px;
    margin-bottom: 16px;
  }

  .card .hint { color: var(--color-muted-foreground); font-size: 0.85rem; margin: 0 0 14px; }

  label { display: block; font-size: 0.85rem; font-weight: 500; color: var(--color-muted-foreground); margin-top: 12px; margin-bottom: 6px; }
  label:first-child { margin-top: 0; }

  input {
    width: 100%; padding: 10px 12px; font-size: 0.95rem; font-family: inherit;
    border: 1px solid var(--color-border); border-radius: 8px; background: var(--color-surface);
    color: var(--color-foreground); transition: border-color 150ms, box-shadow 150ms;
  }
  input:focus {
    outline: none; border-color: var(--color-ring);
    box-shadow: 0 0 0 3px color-mix(in srgb, var(--color-ring) 25%, transparent);
  }

  button {
    display: inline-flex; align-items: center; justify-content: center; gap: 6px;
    min-height: 44px; padding: 0 18px; margin-top: 16px; width: 100%;
    font-family: inherit; font-size: 0.95rem; font-weight: 600;
    background: var(--color-primary); color: var(--color-on-primary);
    border: none; border-radius: 8px; cursor: pointer;
    transition: filter 150ms, transform 150ms;
  }
  button:hover { filter: brightness(0.94); }
  button:active { transform: scale(0.98); }
  button:disabled { opacity: 0.6; cursor: default; }
  button:focus-visible { outline: 2px solid var(--color-ring); outline-offset: 2px; }

  button.secondary {
    background: var(--color-background); color: var(--color-foreground);
    border: 1px solid var(--color-border);
  }

  .hidden { display: none !important; }

  table { width: 100%; border-collapse: collapse; font-size: 0.85rem; }
  th, td { text-align: left; padding: 8px 6px; border-bottom: 1px solid var(--color-border); vertical-align: top; }
  th { color: var(--color-muted-foreground); font-weight: 500; }
  td.addr { font-family: 'Fira Code', monospace; word-break: break-all; max-width: 160px; }

  button.reveal {
    width: auto; margin-top: 0; padding: 4px 10px; min-height: 30px; font-size: 0.78rem;
    background: var(--color-destructive-bg); color: var(--color-destructive); border: 1px solid var(--color-destructive);
  }

  .privkey-box {
    margin-top: 6px; padding: 8px; border-radius: 6px; font-size: 0.78rem;
    background: var(--color-destructive-bg); border: 1px solid var(--color-destructive);
    word-break: break-all; font-family: 'Fira Code', monospace; color: var(--color-foreground);
  }
  .warning-banner {
    background: var(--color-destructive-bg); border: 1px solid var(--color-destructive); color: var(--color-destructive);
    border-radius: 8px; padding: 10px 12px; font-size: 0.8rem; margin-bottom: 14px; font-weight: 500;
  }

  #toast-container {
    position: fixed; bottom: 20px; left: 50%; transform: translateX(-50%);
    display: flex; flex-direction: column; gap: 8px; z-index: 100; width: calc(100% - 40px); max-width: 440px;
  }
  .toast {
    padding: 12px 14px; border-radius: 8px; font-size: 0.85rem; font-weight: 500;
    box-shadow: 0 4px 12px rgba(15, 23, 42, 0.12);
    animation: toast-in 200ms ease-out;
  }
  .toast.success { background: var(--color-success-bg); color: var(--color-success); }
  .toast.error { background: var(--color-destructive-bg); color: var(--color-destructive); }
  @keyframes toast-in { from { opacity: 0; transform: translateY(8px); } to { opacity: 1; transform: translateY(0); } }

  @media (prefers-reduced-motion: reduce) {
    * { animation: none !important; transition: none !important; }
  }
</style>
</head>
<body>

<section id="login-section">
  <header>
    <h1>PLM Lottery — Admin</h1>
    <p>Accesso riservato</p>
  </header>

  <div class="card">
    <label for="admin-token">Admin token</label>
    <input id="admin-token" type="password" placeholder="valore di ADMIN_TOKEN" autofocus>
    <button onclick="adminLogin()" id="login-btn">Accedi</button>
  </div>
</section>

<section id="dashboard-section" class="hidden">
  <header>
    <div class="row-between" style="display:flex;align-items:center;justify-content:space-between">
      <h1 style="margin:0">PLM Lottery — Admin</h1>
      <button class="secondary" style="width:auto;margin-top:0;min-height:36px" onclick="adminLogout()">Esci</button>
    </div>
    <p>Configurazione operativa del round</p>
  </header>

  <div class="card">
    <h2 style="font-size:1rem;font-weight:600;margin:0 0 4px">Configurazione</h2>
    <p class="hint">
      Salvata nel database, modificabile in qualsiasi momento senza riavviare il server.
    </p>

    <label for="admin-fee-address">Fee address (dove finisce il 30% di ogni round)</label>
    <input id="admin-fee-address" class="mono" placeholder="plm1q...">
    <label for="admin-bet-amount">Bet amount (PLM)</label>
    <input id="admin-bet-amount" inputmode="decimal" placeholder="es. 10">
    <button onclick="adminSave()" id="save-btn">Salva</button>
  </div>

  <div class="card">
    <h2 style="font-size:1rem;font-weight:600;margin:0 0 4px">Utenti</h2>
    <p class="hint">Elenco utenti registrati, con saldo interno e accesso alla chiave privata per interventi manuali (es. restituire fondi bloccati).</p>

    <div class="warning-banner">
      ⚠ La chiave privata dà accesso completo ai fondi dell'utente. Ogni volta che la visualizzi viene registrata nell'audit log del server. Non condividerla, non salvarla altrove.
    </div>

    <div id="users-table-wrap" style="overflow-x:auto">
      <table>
        <thead>
          <tr><th>ID</th><th>Username</th><th>Indirizzo</th><th>Saldo (PLM)</th><th>Chiave</th></tr>
        </thead>
        <tbody id="users-tbody"></tbody>
      </table>
    </div>
  </div>
</section>

<div id="toast-container" aria-live="polite"></div>

<script>
const SATS_PER_PLM = 100000000;
let adminToken = sessionStorage.getItem('plm_admin_token');

function toast(message, type) {
  const container = document.getElementById('toast-container');
  const el = document.createElement('div');
  el.className = 'toast ' + type;
  el.textContent = message;
  container.appendChild(el);
  setTimeout(() => el.remove(), 4000);
}

async function withLoading(button, label, fn) {
  const original = button.textContent;
  button.disabled = true;
  button.textContent = label;
  try {
    await fn();
  } finally {
    button.disabled = false;
    button.textContent = original;
  }
}

async function callAdmin(method, path, body) {
  const headers = { 'Content-Type': 'application/json', 'X-Admin-Token': adminToken };
  const res = await fetch(path, { method, headers, body: body ? JSON.stringify(body) : undefined });
  const data = await res.json().catch(() => ({}));
  if (!res.ok) throw new Error(data.detail || res.statusText);
  return data;
}

function showDashboard() {
  document.getElementById('login-section').classList.add('hidden');
  document.getElementById('dashboard-section').classList.remove('hidden');
}

async function loadDashboard() {
  await Promise.all([adminLoadConfig(), loadUsers()]);
}

async function adminLogin() {
  const btn = document.getElementById('login-btn');
  adminToken = document.getElementById('admin-token').value;
  await withLoading(btn, 'Verifica…', async () => {
    try {
      await callAdmin('GET', '/admin/config');
      sessionStorage.setItem('plm_admin_token', adminToken);
      showDashboard();
      await loadDashboard();
    } catch (e) {
      adminToken = null;
      toast('Token non valido.', 'error');
    }
  });
}

function adminLogout() {
  sessionStorage.removeItem('plm_admin_token');
  adminToken = null;
  document.getElementById('admin-token').value = '';
  document.getElementById('dashboard-section').classList.add('hidden');
  document.getElementById('login-section').classList.remove('hidden');
}

async function adminLoadConfig() {
  try {
    const data = await callAdmin('GET', '/admin/config');
    document.getElementById('admin-fee-address').value = data.fee_address;
    document.getElementById('admin-bet-amount').value = data.bet_amount_sats / SATS_PER_PLM;
  } catch (e) {
    toast('Errore nel caricamento configurazione: ' + e.message, 'error');
  }
}

async function adminSave() {
  const btn = document.getElementById('save-btn');
  const feeAddress = document.getElementById('admin-fee-address').value;
  const betAmountPlm = parseFloat(document.getElementById('admin-bet-amount').value);
  const betAmountSats = Math.round(betAmountPlm * SATS_PER_PLM);
  await withLoading(btn, 'Salvataggio…', async () => {
    try {
      await callAdmin('PUT', '/admin/config', { fee_address: feeAddress, bet_amount_sats: betAmountSats });
      toast('Configurazione salvata.', 'success');
    } catch (e) {
      toast('Errore nel salvataggio: ' + e.message, 'error');
    }
  });
}

function escapeHtml(s) {
  return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
}

async function loadUsers() {
  try {
    const users = await callAdmin('GET', '/admin/users');
    const tbody = document.getElementById('users-tbody');
    tbody.innerHTML = users.map((u) => `
      <tr>
        <td>${u.id}</td>
        <td>${escapeHtml(u.username)}</td>
        <td class="addr">${escapeHtml(u.address)}</td>
        <td>${u.balance_sats / SATS_PER_PLM}</td>
        <td>
          <button class="reveal" onclick="revealPrivkey(${u.id}, this)">Mostra</button>
          <div class="privkey-box hidden" id="privkey-${u.id}"></div>
        </td>
      </tr>
    `).join('');
  } catch (e) {
    toast('Errore nel caricamento utenti: ' + e.message, 'error');
  }
}

async function revealPrivkey(userId, button) {
  const box = document.getElementById('privkey-' + userId);
  if (!box.classList.contains('hidden')) {
    box.classList.add('hidden');
    box.textContent = '';
    button.textContent = 'Mostra';
    return;
  }
  if (!window.confirm('Stai per visualizzare la chiave privata di questo utente. L\'accesso verrà registrato nell\'audit log. Continuare?')) {
    return;
  }
  await withLoading(button, '…', async () => {
    try {
      const data = await callAdmin('GET', '/admin/users/' + userId + '/privkey');
      box.textContent = data.wif;
      box.classList.remove('hidden');
      button.textContent = 'Nascondi';
    } catch (e) {
      toast('Errore: ' + e.message, 'error');
    }
  });
}

document.getElementById('admin-token').addEventListener('keydown', (e) => {
  if (e.key === 'Enter') adminLogin();
});

if (adminToken) {
  callAdmin('GET', '/admin/config')
    .then(() => { showDashboard(); return loadDashboard(); })
    .catch(() => { sessionStorage.removeItem('plm_admin_token'); adminToken = null; });
}
</script>

</body>
</html>
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00			`<!doctype html>`
			`<html lang="it">`
			`<head>`
			`<meta charset="utf-8">`
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`<meta name="viewport" content="width=device-width, initial-scale=1">`
			`<title>PLM Lottery — Admin</title>`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00			`<style>`
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`@import url('https://fonts.googleapis.com/css2?family=Fira+Code:wght@500;600&family=Fira+Sans:wght@400;500;600;700&display=swap');`

			`:root {`
			`--color-background: #F8FAFC;`
			`--color-surface: #FFFFFF;`
			`--color-foreground: #0F172A;`
			`--color-muted-foreground: #64748B;`
			`--color-border: #E2E8F0;`
			`--color-primary: #F59E0B;`
			`--color-on-primary: #0F172A;`
			`--color-destructive: #DC2626;`
			`--color-destructive-bg: #FEF2F2;`
			`--color-success: #16A34A;`
			`--color-success-bg: #F0FDF4;`
			`--color-ring: #F59E0B;`
			`--radius: 12px;`
			`}`

			`* { box-sizing: border-box; }`

			`body {`
			`font-family: 'Fira Sans', system-ui, sans-serif;`
			`background: var(--color-background);`
			`color: var(--color-foreground);`
			`max-width: 480px;`
			`margin: 0 auto;`
			`padding: 32px 20px 80px;`
			`line-height: 1.5;`
			`}`

			`.mono { font-family: 'Fira Code', monospace; }`

			`header { margin-bottom: 24px; }`
			`header h1 { font-size: 1.375rem; font-weight: 700; margin: 0; letter-spacing: -0.01em; }`
			`header p { color: var(--color-muted-foreground); font-size: 0.9rem; margin: 4px 0 0; }`

			`.card {`
			`background: var(--color-surface);`
			`border: 1px solid var(--color-border);`
			`border-radius: var(--radius);`
			`padding: 20px;`
			`margin-bottom: 16px;`
			`}`

			`.card .hint { color: var(--color-muted-foreground); font-size: 0.85rem; margin: 0 0 14px; }`

			`label { display: block; font-size: 0.85rem; font-weight: 500; color: var(--color-muted-foreground); margin-top: 12px; margin-bottom: 6px; }`
			`label:first-child { margin-top: 0; }`

			`input {`
			`width: 100%; padding: 10px 12px; font-size: 0.95rem; font-family: inherit;`
			`border: 1px solid var(--color-border); border-radius: 8px; background: var(--color-surface);`
			`color: var(--color-foreground); transition: border-color 150ms, box-shadow 150ms;`
			`}`
			`input:focus {`
			`outline: none; border-color: var(--color-ring);`
			`box-shadow: 0 0 0 3px color-mix(in srgb, var(--color-ring) 25%, transparent);`
			`}`

			`button {`
			`display: inline-flex; align-items: center; justify-content: center; gap: 6px;`
			`min-height: 44px; padding: 0 18px; margin-top: 16px; width: 100%;`
			`font-family: inherit; font-size: 0.95rem; font-weight: 600;`
			`background: var(--color-primary); color: var(--color-on-primary);`
			`border: none; border-radius: 8px; cursor: pointer;`
			`transition: filter 150ms, transform 150ms;`
			`}`
			`button:hover { filter: brightness(0.94); }`
			`button:active { transform: scale(0.98); }`
			`button:disabled { opacity: 0.6; cursor: default; }`
			`button:focus-visible { outline: 2px solid var(--color-ring); outline-offset: 2px; }`

			`button.secondary {`
			`background: var(--color-background); color: var(--color-foreground);`
			`border: 1px solid var(--color-border);`
			`}`

			`.hidden { display: none !important; }`

Add password confirmation and an admin users/privkey panel 2026-07-21 14:22:03 +02:00			`table { width: 100%; border-collapse: collapse; font-size: 0.85rem; }`
			`th, td { text-align: left; padding: 8px 6px; border-bottom: 1px solid var(--color-border); vertical-align: top; }`
			`th { color: var(--color-muted-foreground); font-weight: 500; }`
			`td.addr { font-family: 'Fira Code', monospace; word-break: break-all; max-width: 160px; }`

			`button.reveal {`
			`width: auto; margin-top: 0; padding: 4px 10px; min-height: 30px; font-size: 0.78rem;`
			`background: var(--color-destructive-bg); color: var(--color-destructive); border: 1px solid var(--color-destructive);`
			`}`

			`.privkey-box {`
			`margin-top: 6px; padding: 8px; border-radius: 6px; font-size: 0.78rem;`
			`background: var(--color-destructive-bg); border: 1px solid var(--color-destructive);`
			`word-break: break-all; font-family: 'Fira Code', monospace; color: var(--color-foreground);`
			`}`
			`.warning-banner {`
			`background: var(--color-destructive-bg); border: 1px solid var(--color-destructive); color: var(--color-destructive);`
			`border-radius: 8px; padding: 10px 12px; font-size: 0.8rem; margin-bottom: 14px; font-weight: 500;`
			`}`

Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`#toast-container {`
			`position: fixed; bottom: 20px; left: 50%; transform: translateX(-50%);`
			`display: flex; flex-direction: column; gap: 8px; z-index: 100; width: calc(100% - 40px); max-width: 440px;`
			`}`
			`.toast {`
			`padding: 12px 14px; border-radius: 8px; font-size: 0.85rem; font-weight: 500;`
			`box-shadow: 0 4px 12px rgba(15, 23, 42, 0.12);`
			`animation: toast-in 200ms ease-out;`
			`}`
			`.toast.success { background: var(--color-success-bg); color: var(--color-success); }`
			`.toast.error { background: var(--color-destructive-bg); color: var(--color-destructive); }`
			`@keyframes toast-in { from { opacity: 0; transform: translateY(8px); } to { opacity: 1; transform: translateY(0); } }`

			`@media (prefers-reduced-motion: reduce) {`
			`* { animation: none !important; transition: none !important; }`
			`}`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00			`</style>`
			`</head>`
			`<body>`

Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`<section id="login-section">`
			`<header>`
			`<h1>PLM Lottery — Admin</h1>`
			`<p>Accesso riservato</p>`
			`</header>`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00
Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`<div class="card">`
			`<label for="admin-token">Admin token</label>`
			`<input id="admin-token" type="password" placeholder="valore di ADMIN_TOKEN" autofocus>`
			`<button onclick="adminLogin()" id="login-btn">Accedi</button>`
			`</div>`
			`</section>`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00
Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`<section id="dashboard-section" class="hidden">`
			`<header>`
			`<div class="row-between" style="display:flex;align-items:center;justify-content:space-between">`
			`<h1 style="margin:0">PLM Lottery — Admin</h1>`
			`<button class="secondary" style="width:auto;margin-top:0;min-height:36px" onclick="adminLogout()">Esci</button>`
			`</div>`
			`<p>Configurazione operativa del round</p>`
			`</header>`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00
Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`<div class="card">`
			`<h2 style="font-size:1rem;font-weight:600;margin:0 0 4px">Configurazione</h2>`
			`<p class="hint">`
			`Salvata nel database, modificabile in qualsiasi momento senza riavviare il server.`
			`</p>`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`<label for="admin-fee-address">Fee address (dove finisce il 30% di ogni round)</label>`
			`<input id="admin-fee-address" class="mono" placeholder="plm1q...">`
			`<label for="admin-bet-amount">Bet amount (PLM)</label>`
			`<input id="admin-bet-amount" inputmode="decimal" placeholder="es. 10">`
			`<button onclick="adminSave()" id="save-btn">Salva</button>`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00			`</div>`

Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`<div class="card">`
			`<h2 style="font-size:1rem;font-weight:600;margin:0 0 4px">Utenti</h2>`
			`<p class="hint">Elenco utenti registrati, con saldo interno e accesso alla chiave privata per interventi manuali (es. restituire fondi bloccati).</p>`
Add password confirmation and an admin users/privkey panel 2026-07-21 14:22:03 +02:00
Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`<div class="warning-banner">`
			`⚠ La chiave privata dà accesso completo ai fondi dell'utente. Ogni volta che la visualizzi viene registrata nell'audit log del server. Non condividerla, non salvarla altrove.`
			`</div>`

			`<div id="users-table-wrap" style="overflow-x:auto">`
			`<table>`
			`<thead>`
			`<tr><th>ID</th><th>Username</th><th>Indirizzo</th><th>Saldo (PLM)</th><th>Chiave</th></tr>`
			`</thead>`
			`<tbody id="users-tbody"></tbody>`
			`</table>`
			`</div>`
Add password confirmation and an admin users/privkey panel 2026-07-21 14:22:03 +02:00			`</div>`
Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`</section>`
Add password confirmation and an admin users/privkey panel 2026-07-21 14:22:03 +02:00
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`<div id="toast-container" aria-live="polite"></div>`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00
			`<script>`
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`const SATS_PER_PLM = 100000000;`
Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`let adminToken = sessionStorage.getItem('plm_admin_token');`
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00
			`function toast(message, type) {`
			`const container = document.getElementById('toast-container');`
			`const el = document.createElement('div');`
			`el.className = 'toast ' + type;`
			`el.textContent = message;`
			`container.appendChild(el);`
			`setTimeout(() => el.remove(), 4000);`
			`}`

			`async function withLoading(button, label, fn) {`
			`const original = button.textContent;`
			`button.disabled = true;`
			`button.textContent = label;`
			`try {`
			`await fn();`
			`} finally {`
			`button.disabled = false;`
			`button.textContent = original;`
			`}`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00			`}`

			`async function callAdmin(method, path, body) {`
			`const headers = { 'Content-Type': 'application/json', 'X-Admin-Token': adminToken };`
			`const res = await fetch(path, { method, headers, body: body ? JSON.stringify(body) : undefined });`
			`const data = await res.json().catch(() => ({}));`
			`if (!res.ok) throw new Error(data.detail \|\| res.statusText);`
			`return data;`
			`}`

Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`function showDashboard() {`
			`document.getElementById('login-section').classList.add('hidden');`
			`document.getElementById('dashboard-section').classList.remove('hidden');`
			`}`

			`async function loadDashboard() {`
			`await Promise.all([adminLoadConfig(), loadUsers()]);`
			`}`

			`async function adminLogin() {`
			`const btn = document.getElementById('login-btn');`
			`adminToken = document.getElementById('admin-token').value;`
			`await withLoading(btn, 'Verifica…', async () => {`
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`try {`
Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`await callAdmin('GET', '/admin/config');`
			`sessionStorage.setItem('plm_admin_token', adminToken);`
			`showDashboard();`
			`await loadDashboard();`
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`} catch (e) {`
Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`adminToken = null;`
			`toast('Token non valido.', 'error');`
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`}`
			`});`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00			`}`

Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`function adminLogout() {`
			`sessionStorage.removeItem('plm_admin_token');`
			`adminToken = null;`
			`document.getElementById('admin-token').value = '';`
			`document.getElementById('dashboard-section').classList.add('hidden');`
			`document.getElementById('login-section').classList.remove('hidden');`
			`}`

			`async function adminLoadConfig() {`
			`try {`
			`const data = await callAdmin('GET', '/admin/config');`
			`document.getElementById('admin-fee-address').value = data.fee_address;`
			`document.getElementById('admin-bet-amount').value = data.bet_amount_sats / SATS_PER_PLM;`
			`} catch (e) {`
			`toast('Errore nel caricamento configurazione: ' + e.message, 'error');`
			`}`
			`}`

Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00			`async function adminSave() {`
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`const btn = document.getElementById('save-btn');`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00			`const feeAddress = document.getElementById('admin-fee-address').value;`
Show and accept amounts in PLM in the test/admin UIs 2026-07-21 10:38:26 +02:00			`const betAmountPlm = parseFloat(document.getElementById('admin-bet-amount').value);`
			`const betAmountSats = Math.round(betAmountPlm * SATS_PER_PLM);`
Redesign the test/admin UIs and drop the on-page log panel 2026-07-21 10:46:55 +02:00			`await withLoading(btn, 'Salvataggio…', async () => {`
			`try {`
			`await callAdmin('PUT', '/admin/config', { fee_address: feeAddress, bet_amount_sats: betAmountSats });`
			`toast('Configurazione salvata.', 'success');`
			`} catch (e) {`
			`toast('Errore nel salvataggio: ' + e.message, 'error');`
			`}`
			`});`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00			`}`
Add password confirmation and an admin users/privkey panel 2026-07-21 14:22:03 +02:00
			`function escapeHtml(s) {`
			`return s.replace(/[&<>"']/g, (c) => ({ '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' }[c]));`
			`}`

			`async function loadUsers() {`
Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00			`try {`
			`const users = await callAdmin('GET', '/admin/users');`
			`const tbody = document.getElementById('users-tbody');`
			tbody.innerHTML = users.map((u) => `
			`<tr>`
			`<td>${u.id}</td>`
			`<td>${escapeHtml(u.username)}</td>`
			`<td class="addr">${escapeHtml(u.address)}</td>`
			`<td>${u.balance_sats / SATS_PER_PLM}</td>`
			`<td>`
			`<button class="reveal" onclick="revealPrivkey(${u.id}, this)">Mostra</button>`
			`<div class="privkey-box hidden" id="privkey-${u.id}"></div>`
			`</td>`
			`</tr>`
			`).join('');
			`} catch (e) {`
			`toast('Errore nel caricamento utenti: ' + e.message, 'error');`
			`}`
Add password confirmation and an admin users/privkey panel 2026-07-21 14:22:03 +02:00			`}`

			`async function revealPrivkey(userId, button) {`
			`const box = document.getElementById('privkey-' + userId);`
			`if (!box.classList.contains('hidden')) {`
			`box.classList.add('hidden');`
			`box.textContent = '';`
			`button.textContent = 'Mostra';`
			`return;`
			`}`
			`if (!window.confirm('Stai per visualizzare la chiave privata di questo utente. L\'accesso verrà registrato nell\'audit log. Continuare?')) {`
			`return;`
			`}`
			`await withLoading(button, '…', async () => {`
			`try {`
			`const data = await callAdmin('GET', '/admin/users/' + userId + '/privkey');`
			`box.textContent = data.wif;`
			`box.classList.remove('hidden');`
			`button.textContent = 'Nascondi';`
			`} catch (e) {`
			`toast('Errore: ' + e.message, 'error');`
			`}`
			`});`
			`}`
Gate the admin panel behind a real login screen 2026-07-21 14:28:29 +02:00
			`document.getElementById('admin-token').addEventListener('keydown', (e) => {`
			`if (e.key === 'Enter') adminLogin();`
			`});`

			`if (adminToken) {`
			`callAdmin('GET', '/admin/config')`
			`.then(() => { showDashboard(); return loadDashboard(); })`
			`.catch(() => { sessionStorage.removeItem('plm_admin_token'); adminToken = null; });`
			`}`
Serve the admin panel at its own unlinked /admin page 2026-07-21 10:36:55 +02:00			`</script>`

			`</body>`
			`</html>`