SmoelEU App Guide

Overview

• Express + EJS app with simple auth, roles, and JSON persistence.
• Users and messages are stored in data/ with hashed passwords (bcrypt).
• Login is browser‑based via a secure session cookie.

Roles & Permissions

• Superadmin (original admin from ADMIN_USER): full access; cannot be deleted or demoted; only superadmin may delete superadmin’s messages.
• Admin: everything a user can; manage users (add/delete except original superadmin, set role user/admin); delete any message except superadmin’s.
• User: view/post messages; delete own messages; change own password.
• Anonymous: access /, /login only; all /secure/* requires login.

Public Endpoints

• GET / — This guide.
• GET /login — Login form.
• POST /login — Sign in with username/password.
• POST /logout — Sign out.

Secure Endpoints (login required)

Messages

• GET /secure/messages — Form + latest messages.
• POST /secure/messages — Add a message (body: text).
• POST /secure/messages/:id/delete — Delete (author; admin; superadmin — only superadmin can delete superadmin messages).

Account

• GET /secure/account — Change password form.
• POST /secure/account/password — Update password (body: currentPassword, newPassword, confirmPassword).

Users (admin/superadmin)

• GET /secure/users — List users, add user, set roles.
• POST /secure/users — Add user (body: username, password); role defaults to user.
• POST /secure/users/:username/role — Set role to user or admin (cannot change original superadmin).
• POST /secure/users/:username/delete — Delete user (cannot delete original superadmin).

Data & Persistence

• data/users.json — [{ username, passwordHash, role }]
• data/messages.json — [{ id, text, at, user }]

Auth & Environment

• Initial admin (only before users.json exists): ADMIN_USER (default admin), ADMIN_PASS (default admin).
• Set SESSION_SECRET in production (long random string).
• Change admin password immediately at /secure/account to create a hashed record.

Local Setup

• npm install then npm start.
• Open http://127.0.0.1:3000/login → sign in (admin/admin unless overridden).
• Messages: /secure/messages • Account: /secure/account • Users: /secure/users (admin only).

Production Notes

• Data lives on the server at data/ and persists across deploys.
• Deployment is automated via GitHub Actions (push to main).

Permissions Summary

• Messages — create: user/admin/superadmin; delete: owner, admin (not superadmin’s), superadmin (all).
• Users — add/delete/set role: admin/superadmin (cannot delete or edit original superadmin).

API Access (coming soon)

Token-based API usage will be documented here later.