From ea8be2ac766afdadc3e9a9c5431d61b5e6faea62 Mon Sep 17 00:00:00 2001
From: Waters Church <info@waterschurch.org>
Date: Thu, 17 Sep 2026 13:05:53 -0400
Subject: [PATCH] Admin PIN: the fields say enough
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The paragraph under the PIN fields explained what the PIN covers and how to
clear it by hand — and only someone already past the PIN could read it, so
the recovery note was never where it was needed. Gone, with the dead style
and the element lookup that hung off it.

The live line under the heading stays: it is the only thing that says
whether admin is locked, and the only warning that a passcode in the
server's environment outranks whatever is set here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 public/admin/admin.css  | 8 --------
 public/admin/admin.js   | 1 -
 public/admin/index.html | 4 ----
 3 files changed, 13 deletions(-)

diff --git a/public/admin/admin.css b/public/admin/admin.css
index 7eec5df..eac4489 100644
--- a/public/admin/admin.css
+++ b/public/admin/admin.css
@@ -550,11 +550,3 @@ a.btn { text-decoration: none; }
   gap: 8px;
   margin-left: auto;
 }
-.pin-note { margin-top: 12px; }
-.pin-note code {
-  font-size: 0.92em;
-  padding: 1px 5px;
-  border-radius: 4px;
-  background: var(--bg);
-  border: 1px solid var(--border);
-}
diff --git a/public/admin/admin.js b/public/admin/admin.js
index a76cbb1..cc10af8 100644
--- a/public/admin/admin.js
+++ b/public/admin/admin.js
@@ -132,7 +132,6 @@ function renderPin(state) {
     : set
       ? 'Admin is locked. This page asks for the PIN, and so does every admin request.'
       : 'Admin is open to anyone on the network. Set a 6-digit PIN to lock it.';
-  if (state.dataDir) document.getElementById('pin-file').textContent = state.dataDir + '/proddash.json';
 }
 
 function pinMessage(text, bad = false) {
diff --git a/public/admin/index.html b/public/admin/index.html
index a327283..8157b88 100644
--- a/public/admin/index.html
+++ b/public/admin/index.html
@@ -92,10 +92,6 @@
             <button class="btn" id="pin-clear" hidden>Turn off</button>
           </div>
         </div>
-        <p class="admin-copy pin-note">Only this page and the admin API ask for it — dashboards stay
-          open, and it is nothing to do with a module's own PIN, such as Slack's send PIN. Forgotten?
-          Remove <code>adminPin</code> from <code id="pin-file">proddash.json</code> in the settings
-          folder and restart.</p>
         <div class="admin-status" id="pin-status"></div>
       </div>
     </section>
-- 
2.54.0