chore: remove password-lock; switch to ADMIN_TOKEN env; update docs

2026-05-03 16:34:41 -03:00
parent ea0d2c9370
commit ce7731cebb
4 changed files with 31 additions and 74 deletions
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -49,17 +49,28 @@ UI strings are hardcoded in the source. The PT-BR localization lives in:
 - `app/layout.tsx` — `<html lang="pt-BR">` and metadata description
 - `app/[slug]/page.tsx` — `Intl.NumberFormat('pt-BR', ...)` for prices
 - `components/share-button.tsx` — "Compartilhar" label
- `app/lock/page.tsx`, `app/not-found.tsx`, `app/page.tsx` — page copy
+- `app/not-found.tsx`, `app/page.tsx` — page copy

 To switch language, update those files and rebuild the image.

-### Admin credentials
+### Admin token

-Set via environment variables in `docker-compose.yml`:
+The admin authenticates by visiting the site with `?adm=<token>` once. The token is set as an env var:

 ```yaml
- ADMIN_USERNAME=your_username
- ADMIN_PASSWORD=your_password
+- ADMIN_TOKEN=long-random-hex-at-least-16-chars
+```
+
+The token is also accepted from the cookie `adm_token` after first visit.
+
+### Guests
+
+Each guest gets their own URL: `https://chadebebe.omeu.website/<slug>?usr=<token>`. Manage guests at `/admin/guests` or via CLI:
+
+```bash
+npm run guest:create -- --name="Martin"
+npm run guest:list
+npm run guest:delete -- --id=<guest-id>
 ```

 ## Deployment
@@ -80,7 +91,7 @@ cd chadebebe
 docker compose up -d --build
 ```

-The `data/db/wishlist.db` snapshot committed in the repo will be used as the initial database. On first run the app writes `data/secrets.json` (JWT keys) — this file is gitignored and must not be committed.
+The `data/db/wishlist.db` snapshot committed in the repo will be used as the initial database.

 ### Updating the app