Server Manager (Gyannetra)
0c2a2275ce
Removes the unauthenticated admin API hole verified live in the 2026-09-26 audit: - Add require_admin dependency; apply to ALL 17 /api/admin/* endpoints. 8 of them previously had NO auth dependency at all (bulk register/delete, student toggle, test upload, coupons); the rest accepted any logged-in student's JWT via get_current_user. - Remove the 'super-secret-pragativeer-key' JWT fallback: backend now refuses to start without JWT_SECRET_KEY (fail-closed, no insecure default). - Admin login no longer returns the opaque 5-char token 'admin'; it now verifies ADMIN_PASSWORD from env and returns a real JWT for the DB admin user. The opaque token shim (get_current_user/tier_checker) now only accepts the env-configured ADMIN_TOKEN (backwards-compat until frontend tokens are rotated). - Replace all hardcoded 'Pv9#kL2$mQ8!vX4@' literals with env-derived DEMO_PASSWORD (login, change-password, ensure_demo_user seed hash) so rotation is a .env edit, not a code change. - Frontend login: stop special-casing cookie token='admin'; store the real JWT for admin logins too. - Add backend/.env.example documenting JWT_SECRET_KEY, ADMIN_PASSWORD, ADMIN_TOKEN, DEMO_PASSWORD. Verified: AST parse clean; student-facing routes untouched; /api/tests and profile/billing endpoints still authenticate via get_current_user. Ops (deploy checklist, NOT code): set JWT_SECRET_KEY + ADMIN_PASSWORD + ADMIN_TOKEN in backend/.env before restarting, or the backend will fail closed. Old issued JWTs remain valid until the secret is rotated.
This is a Next.js project bootstrapped with create-next-app.
Getting Started
First, run the development server:
npm run dev
# or
yarn dev
# or
pnpm dev
# or
bun dev
Open http://localhost:3000 with your browser to see the result.
You can start editing the page by modifying app/page.tsx. The page auto-updates as you edit the file.
This project uses next/font to automatically optimize and load Geist, a new font family for Vercel.
Learn More
To learn more about Next.js, take a look at the following resources:
- Next.js Documentation - learn about Next.js features and API.
- Learn Next.js - an interactive Next.js tutorial.
You can check out the Next.js GitHub repository - your feedback and contributions are welcome!
Deploy on Vercel
The easiest way to deploy your Next.js app is to use the Vercel Platform from the creators of Next.js.
Check out our Next.js deployment documentation for more details.