Require admin password for destructive admin actions

2026-02-08 15:05:10 +01:00
parent 96a47020d8
commit e666e7c603
13 changed files with 197 additions and 43 deletions
--- a/SPEC.md
+++ b/SPEC.md
@@ -11,6 +11,7 @@ Help a small Discord group (4–8 players) pick a co-op game via phased flow:
 - Username/password login (cookie auth)
 - Admins flagged via admin key at registration
 - Logout returns to the login form and clears all auth form fields
+- Destructive admin actions (player delete, reset, factory reset) require admin password confirmation
 - Per-user phase tracking; admins can move themselves backward, everyone can move forward (subject to admin “results open” toggle and Suggest→Vote requiring at least one own suggestion)

 ## Suggest Phase