Admin PIN: the fields say enough #7

2026-09-17T13:06:21-04:00

michael commented

2026-09-17 13:06:21 -04:00

The Admin PIN section carried a paragraph under its fields explaining what the PIN covers ("Only this page and the admin API ask for it…") and how to clear it by hand ("Remove adminPin from proddash.json and restart"). It is gone.

Worth noting about the recovery half: it was only ever visible to someone who had already entered the PIN, since the section sits behind the lock. The one person who needed it — locked out — could never see it. The README still documents the file.

Removed with it: the .pin-note styles, and the pin-file element lookup in renderPin() that filled the <code> inside that paragraph. That lookup would have thrown on a null element every time the section repainted, so it had to go with the markup rather than after it.

Kept: the live line under the heading. It is the only thing that says whether admin is locked or open, and the only warning that a PRODDASH_PASSCODE in the server's environment outranks whatever is set on the page. Say the word if you want that gone too.

Verified

On a scratch server with its own data directory:

fresh install, no PIN — section renders as heading, state line, fields; the description is absent and only one paragraph remains;
setting a PIN repaints the section (locked state, Current PIN field, Change PIN / Turn off) with no JavaScript errors — this is the path the removed pin-file lookup would have broken;
reloading and unlocking renders the same, again with no errors.

🤖 Generated with Claude Code

The Admin PIN section carried a paragraph under its fields explaining what the PIN covers ("Only this page and the admin API ask for it…") and how to clear it by hand ("Remove `adminPin` from `proddash.json` and restart"). It is gone. Worth noting about the recovery half: it was only ever visible to someone who had **already** entered the PIN, since the section sits behind the lock. The one person who needed it — locked out — could never see it. The README still documents the file. Removed with it: the `.pin-note` styles, and the `pin-file` element lookup in `renderPin()` that filled the `<code>` inside that paragraph. That lookup would have thrown on a null element every time the section repainted, so it had to go with the markup rather than after it. **Kept:** the live line under the heading. It is the only thing that says whether admin is locked or open, and the only warning that a `PRODDASH_PASSCODE` in the server's environment outranks whatever is set on the page. Say the word if you want that gone too. ### Verified On a scratch server with its own data directory: - fresh install, no PIN — section renders as heading, state line, fields; the description is absent and only one paragraph remains; - setting a PIN repaints the section (locked state, Current PIN field, Change PIN / Turn off) with **no JavaScript errors** — this is the path the removed `pin-file` lookup would have broken; - reloading and unlocking renders the same, again with no errors. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

michael added 1 commit 2026-09-17 13:06:22 -04:00

Admin PIN: the fields say enough ea8be2ac76

The paragraph under the PIN fields explained what the PIN covers and how to
clear it by hand — and only someone already past the PIN could read it, so
the recovery note was never where it was needed. Gone, with the dead style
and the element lookup that hung off it.

The live line under the heading stays: it is the only thing that says
whether admin is locked, and the only warning that a passcode in the
server's environment outranks whatever is set here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

michael merged commit 41f64f3a13 into main

2026-09-17 15:51:37 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: michael/ProdDash#7