danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 14 Packages Wiki Activity Actions

Hide change-password + 2FA by default, show only when canLocalAuth=true

Browse source 
Sections were briefly visible for SSO-only users before load2FAStatus
resolved and hid them. Flipped the default: both sections now carry
style="display:none" in the HTML and are revealed only when the /me
fetch confirms the user has a real password hash.

SSO-only users never see the sections, even for a flash.
This commit is contained in:
Daniel 2026-04-14 04:38:28 +02:00
parent f9732f25d0
commit b6753d5bc9
2 changed files with 11 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
public/components/settings.html
View file

@ -85,8 +85,8 @@
<p style="font-size:11px;color:var(--g400);margin:8px 0 0;"><i class="fas fa-info-circle"></i> <strong>Trade-off:</strong> Immediate transcription vs. privacy. For maximum privacy, use Browser Whisper (offline batch mode) or Server transcription with HIPAA-eligible provider.</p>
</div>
<!-- Change Password (hidden for SSO-only users) -->
<div class="settings-section card" id="change-password-section">
<!-- Change Password — hidden by default; unhidden only for users with a real password -->
<div class="settings-section card" id="change-password-section" style="display:none;">
<h3><i class="fas fa-key"></i> Change Password</h3>
<div class="form-group" style="max-width:340px;">
<label>Current Password</label>
@ -104,8 +104,8 @@
<span id="pw-change-status" style="font-size:13px;margin-left:8px;"></span>
</div>
<!-- 2FA (hidden for SSO-only users — their IdP handles MFA) -->
<div class="settings-section card" id="2fa-section">
<!-- 2FA — hidden by default; unhidden only for users with a real password (SSO users use their IdP's MFA) -->
<div class="settings-section card" id="2fa-section" style="display:none;">
<h3><i class="fas fa-shield-halved"></i> Two-Factor Authentication</h3>
<p id="2fa-status">Status: Loading...</p>
<button id="btn-setup-2fa" class="btn-sm btn-primary">Enable 2FA</button>

17
public/js/auth.js
View file

@ -733,19 +733,16 @@ document.addEventListener('DOMContentLoaded', function() {
.then(function(r) { return r.json(); })
.then(function(data) {
if (!data || !data.user) return;
// Hide password-change + 2FA sections entirely for SSO-only users.
// Their auth is owned by the IdP — changing a random-blob "password"
// or adding TOTP here has no effect on how they sign in.
// Sections are display:none by default in the HTML. Only reveal them
// if the server confirms this user has a real password hash
// (canLocalAuth === true). SSO-auto-created users never see these UIs.
var pwSection = document.getElementById('change-password-section');
var twofaSection = document.getElementById('2fa-section');
if (data.user.canLocalAuth === false) {
if (pwSection) pwSection.style.display = 'none';
if (twofaSection) twofaSection.style.display = 'none';
return; // Nothing more to load for SSO-only users
} else {
if (pwSection) pwSection.style.display = '';
if (twofaSection) twofaSection.style.display = '';
if (data.user.canLocalAuth !== true) {
return; // Stay hidden — nothing more to load for SSO-only users
}
if (pwSection) pwSection.style.display = '';
if (twofaSection) twofaSection.style.display = '';
var status = document.getElementById('2fa-status');
var setupBtn = document.getElementById('btn-setup-2fa');
var disableBtn = document.getElementById('btn-disable-2fa');