From 0664c018c67d0394f192c06680c91d5f7c0ff9f7 Mon Sep 17 00:00:00 2001
From: treamz <treamz@gmail.com>
Date: Sun, 22 Mar 2026 00:00:13 +0300
Subject: [PATCH] Admin SSO: shared session with main site
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- AdminJS uses main site session (no separate login)
- Login once at /auth/login → /admin accessible if role=admin
- Non-admin users redirected to /auth/login from /admin
- Removed separate AdminJS authentication (cookieName/cookiePassword)
---
 lib/admin.js | 33 ++++++++++++++-------------------
 1 file changed, 14 insertions(+), 19 deletions(-)

diff --git a/lib/admin.js b/lib/admin.js
index 1437ca0..4ec6b3b 100644
--- a/lib/admin.js
+++ b/lib/admin.js
@@ -193,27 +193,22 @@ async function setupAdmin(app) {
     ],
   });
 
-  // Auth: only admin users
-  const bcrypt = require('bcrypt');
-  const db = require('./db');
+  // Auth: use main site session — admin role required
+  const adminRouter = AdminJSExpress.buildRouter(adminJs);
 
-  const adminRouter = AdminJSExpress.buildAuthenticatedRouter(adminJs, {
-    authenticate: async (email, password) => {
-      const user = await db.findUserByEmail(email);
-      if (!user || user.role !== 'admin') return null;
-      const valid = await bcrypt.compare(password, user.password_hash);
-      if (!valid) return null;
-      return { email: user.email, role: user.role, id: user.id };
-    },
-    cookieName: 'adminjs',
-    cookiePassword: process.env.SESSION_SECRET || 'adminjs-secret-change-me',
-  }, null, {
-    resave: false,
-    saveUninitialized: false,
-    secret: process.env.SESSION_SECRET || 'adminjs-secret-change-me',
-  });
+  // Middleware: check main session for admin role before AdminJS
+  app.use(adminJs.options.rootPath, (req, res, next) => {
+    // Allow AdminJS static assets (js, css, etc.)
+    if (req.path.match(/\.(js|css|png|svg|ico|map|woff|woff2|ttf)$/)) return next();
 
-  app.use(adminJs.options.rootPath, adminRouter);
+    if (req.session && req.session.user && req.session.user.role === 'admin') {
+      return next();
+    }
+
+    // Not admin — redirect to login with return URL
+    req.session.returnTo = '/admin';
+    return res.redirect('/auth/login');
+  }, adminRouter);
 
   return adminJs;
 }