v1.6.1: Sicherheit – Rate Limiting, Default-PW via Env, AUTH_SECRET Pflicht, Bcrypt 12

app/admin/actions.ts

@@ -9,8 +9,8 @@ export interface BeoUser {
   kürzel: string | null;
   name: string;
   vorname: string | null;
-  pw: string | null;
   role: string | null;
+  hasPw: boolean;
 }
 
 export async function listUsers(): Promise<BeoUser[]> {
@@ -18,10 +18,10 @@ export async function listUsers(): Promise<BeoUser[]> {
   if (!session || !session.role?.includes('admin')) redirect('/');
 
   const rows = await query(
-    'SELECT id, `kürzel`, name, vorname, pw, role FROM beos ORDER BY name, vorname',
+    'SELECT id, `kürzel`, name, vorname, role, (pw IS NOT NULL) AS hasPw FROM beos ORDER BY name, vorname',
     []
-  ) as BeoUser[];
-  return rows;
+  ) as (Omit<BeoUser, 'hasPw'> & { hasPw: number })[];
+  return rows.map(r => ({ ...r, hasPw: r.hasPw === 1 }));
 }
 
 export async function resetPassword(

app/admin/page.tsx

@@ -41,10 +41,10 @@ export default async function AdminPage() {
                   <td className="px-4 py-3">{user.vorname ?? '—'}</td>
                   <td className="px-4 py-3">{user.role ?? '—'}</td>
                   <td className="px-4 py-3">
-                    {user.pw == null ? (
-                      <span className="text-amber-600 font-medium">Standard</span>
-                    ) : (
+                    {user.hasPw ? (
                       <span className="text-green-700">gesetzt</span>
+                    ) : (
+                      <span className="text-amber-600 font-medium">Standard</span>
                     )}
                   </td>
                   <td className="px-4 py-3 text-right">