From af95cf18023543f6177b7c7b3eed334b302eaa90 Mon Sep 17 00:00:00 2001
From: gator <gatordevin@gmail.com>
Date: Mon, 7 Sep 2026 12:39:57 +0000
Subject: [PATCH] Admin opens on the admin role, with the key only as a
 bootstrap

---
 admin.html | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/admin.html b/admin.html
index 904379d..8b9265a 100644
--- a/admin.html
+++ b/admin.html
@@ -51,15 +51,14 @@
 
 <script src="/assets/app.js"></script>
 <script>
+// Access is the admin ROLE on the signed-in session. The key remains only as
+// a bootstrap for granting the very first admin, and is not needed after that.
 var KEY = null;
 try { KEY = localStorage.getItem("ptl_admin"); } catch (e) {}
+navBar("admin");
 
 function money(v) { return v == null ? "—" : "$" + Number(v).toFixed(2); }
-function when(s) {
-  if (!s) return "";
-  var d = new Date(s);
-  return isNaN(d) ? s : d.toLocaleString();
-}
+// when() comes from app.js and carries the time.
 
 function shotHtml(s) {
   var over = s.words > 18;
@@ -106,7 +105,7 @@ function projHtml(p) {
 
 async function load() {
   hideMsg("msg");
-  var r = await api("admin_overview", { admin_key: KEY });
+  var r = await api("admin_overview", KEY ? { admin_key: KEY } : {});
   if (!r.ok) {
     showMsg("msg", r.error || "Could not load.");
     document.getElementById("gate").style.display = "";
@@ -136,7 +135,8 @@ document.getElementById("go").onclick = function () {
   load();
 };
 
-if (KEY) load();
+// A signed-in admin never sees the key prompt.
+if (Session.token() || KEY) load();
 </script>
 </body>
 </html>