feat: web gui mapping and obj/item/mob placement improvements

1 files changed, 15 insertions, 10 deletions

diff --git a/internal/admin/server.go b/internal/admin/server.go
index 418a693..8facc4a 100644
--- a/internal/admin/server.go
+++ b/internal/admin/server.go
@@ -212,12 +212,11 @@ func (s *AdminServer) checkAuth(r *http.Request) bool {
 }
 
 func (s *AdminServer) isAdminAccount(name string) bool {
-	for _, a := range s.cfg.AdminHTTPS.AdminAccounts {
-		if strings.EqualFold(a, name) {
-			return true
-		}
+	acc, err := s.accountStore.LoadAccount(name)
+	if err != nil {
+		return false
 	}
-	return false
+	return acc.Admin
 }
 
 func (s *AdminServer) setAuthCookie(w http.ResponseWriter, account string) {
@@ -249,17 +248,17 @@ func (s *AdminServer) handleLogin(w http.ResponseWriter, r *http.Request) {
 	account := strings.TrimSpace(r.FormValue("account"))
 	password := r.FormValue("password")
 
-	if !s.isAdminAccount(account) {
-		s.renderPage(w, r, "login.html", map[string]any{"Error": "Account is not authorized as admin."})
-		return
-	}
-
 	acc, err := s.accountStore.LoadAccount(account)
 	if err != nil || !player.CheckPassword(password, acc.PasswordHash) {
 		s.renderPage(w, r, "login.html", map[string]any{"Error": "Invalid account name or password."})
 		return
 	}
 
+	if !acc.Admin {
+		s.renderPage(w, r, "login.html", map[string]any{"Error": "Account is not authorized as admin."})
+		return
+	}
+
 	s.setAuthCookie(w, account)
 	http.Redirect(w, r, "/", http.StatusFound)
 }
@@ -355,6 +354,12 @@ func writeJSON(w http.ResponseWriter, data any) {
 	}
 }
 
+func writeJSONError(w http.ResponseWriter, msg string, code int) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	json.NewEncoder(w).Encode(map[string]any{"error": msg})
+}
+
 func readJSON(r *http.Request, v any) error {
 	body, err := io.ReadAll(r.Body)
 	if err != nil {