diff --git a/board.js b/board.js
index e622124..0f1fa68 100644
--- a/board.js
+++ b/board.js
@@ -24,6 +24,10 @@ function checkPin(uid, pin) {
if (ok) { if (r.fails) { r.fails = 0; savePins(); } return true; }
r.fails = (r.fails || 0) + 1; if (r.fails >= MAX_FAILS) { r.fails = 0; r.until = Date.now() + LOCK_MS; } savePins(); return false;
}
+// how long a family device sits idle before it goes back to the board (minutes; a signed-in session on a family device lasts 30)
+const SET_FILE = () => path.join(process.env.DATA_DIR || path.join(__dirname, 'data'), 'board-settings.json');
+const IDLE_CHOICES = [1, 2, 3, 5, 10, 15, 30];
+const idleMin = () => { try { const n = +JSON.parse(fs.readFileSync(SET_FILE(), 'utf8')).idleMin; return IDLE_CHOICES.includes(n) ? n : 5; } catch { return 5; } };
const ymdOk = s => /^\d{4}-\d{2}-\d{2}$/.test(s || '');
const isKid = u => !!(u.kid && u.kid.on);
const palette = ['#e0742b', '#2f9e6e', '#4f7cff', '#8a5cf0', '#d9453a', '#2aa6a0', '#e5a00d'];
@@ -76,11 +80,15 @@ async function handle(req, res) {
identify(t, b.pin, req);
auth.startSession(req, res, t); audit.log('family device: picked a profile', { who: t.name }, req); return json(res, 200, { ok: true });
}
- if (p === '/api/device' && req.method === 'GET') { if (!me) throw fail(401, 'Not signed in'); return json(res, 200, { device: !!dev, pin: hasPin(me.id), devices: me.role === 'admin' ? devices.load() : undefined }); }
+ if (p === '/api/device' && req.method === 'GET') { if (!me) throw fail(401, 'Not signed in'); return json(res, 200, { device: !!dev, idleMin: idleMin(), idleChoices: IDLE_CHOICES, pin: hasPin(me.id), devices: me.role === 'admin' ? devices.load() : undefined }); }
if (p === '/api/device/pin' && (req.method === 'POST' || req.method === 'DELETE')) {
if (!me) throw fail(401, 'Not signed in'); if (req.method === 'DELETE') { delete db()[me.id]; savePins(); return json(res, 200, { pin: false }); }
const b = JSON.parse(await readBody(req, 5e3) || '{}'); setPin(me.id, b.pin); return json(res, 200, { pin: true });
}
+ if (p === '/api/device/idle' && req.method === 'POST') { // an admin sets how long a family device waits before going back to the board
+ if (!me || me.role !== 'admin') throw fail(403, 'Only an admin can do this'); const b = JSON.parse(await readBody(req, 2e3) || '{}'), n = Math.round(+b.minutes);
+ if (!IDLE_CHOICES.includes(n)) throw fail(400, 'Choose between 1 and 30 minutes'); fs.mkdirSync(path.dirname(SET_FILE()), { recursive: true }); atomicWrite(SET_FILE(), JSON.stringify({ idleMin: n }), { mode: 0o600 }); audit.log('family device idle time set', { who: me.name, detail: n + ' min' }, req); return json(res, 200, { idleMin: n });
+ }
if (p === '/api/device/enable' && req.method === 'POST') { // an admin makes this screen a family device (and it goes back to the board)
if (!me || me.role !== 'admin') throw fail(403, 'Only an admin can do this'); const b = JSON.parse(await readBody(req, 5e3) || '{}'); auth.enrollDevice(req, res, b.name, me.name); audit.log('family device added', { who: me.name, detail: String(b.name || '').slice(0, 40) }, req);
res.setHeader('Set-Cookie', [].concat(res.getHeader('Set-Cookie') || [], 'hub_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0')); return json(res, 200, { ok: true });
diff --git a/public/device-ui.js b/public/device-ui.js
index 5294491..d046b2b 100644
--- a/public/device-ui.js
+++ b/public/device-ui.js
@@ -1,25 +1,26 @@
'use strict';
// ---- Family devices: on a shared screen, a label that says whose account this is, a Switch button, and a return to the family board after a few idle minutes.
// Also the Settings part: your PIN for shared screens, and (admins) making this screen a family device.
-let devOn = false, devIdle = 0;
-const DEV_IDLE_MS = 5 * 60e3;
+let devOn = false, devIdle = 0, devIdleMs = 5 * 60e3;
async function devBack() { try { await fetch('/api/auth/logout', { method: 'POST', body: '{}' }); } catch {} location.replace('/board'); }
async function devStart() {
- try { const r = await jfetch('/api/device'); devOn = !!r.device; } catch { return; }
+ try { const r = await jfetch('/api/device'); devOn = !!r.device; if (r.idleMin) devIdleMs = r.idleMin * 60e3; } catch { return; }
if (!devOn || !ME) return;
const kid = ME.kid && ME.kid.on, chip = document.createElement('div'); chip.id = 'devchip';
chip.innerHTML = `${esc(ME.name)}${kid ? 'KID' : ''}`;
document.body.appendChild(chip); document.body.classList.add('ondevice'); chip.querySelector('#devswitch').onclick = devBack;
const bump = () => { devIdle = Date.now(); }; ['pointerdown', 'keydown', 'scroll', 'touchstart'].forEach(e => addEventListener(e, bump, { passive: true })); bump();
- setInterval(() => { const a = typeof pl !== 'undefined' && pl.a && !pl.a.paused; if (!a && Date.now() - devIdle > DEV_IDLE_MS) devBack(); }, 15000); // (music playing keeps it signed in)
+ setInterval(() => { const a = (typeof pl !== 'undefined' && pl.a && !pl.a.paused) || [...document.querySelectorAll('video, audio')].some(m => !m.paused && !m.ended); /* music, a movie or an episode playing counts as being in use */ if (!a && Date.now() - devIdle > devIdleMs) devBack(); }, 15000); // (music or a video playing keeps it signed in)
}
async function devSettings(box) {
if (!box) return; let r; try { r = await jfetch('/api/device'); } catch { return; }
const admin = ME && ME.role === 'admin', post = (p, b) => jfetch('/api/device/' + p, { method: 'POST', body: JSON.stringify(b || {}) });
box.innerHTML = `
Shared screens
${r.pin ? 'Your PIN is set' : 'Set a PIN'}On a shared family screen, you pick your name and enter this PIN (children can just tap their name). 4 to 8 digits.${r.pin ? '' : ''}
- ${admin ? `
${r.device ? 'This is a family device' : 'Make this a family device'}${r.device ? 'It opens on the family board and signs people out after a few idle minutes.' : 'For a kitchen tablet or the family computer: it opens on the family board, and everyone picks their name to use it. You will be signed out here.'}
` : ''}
`;
+ ${admin ? `
Back to the board afterWhen nobody touches a family device for this long, it signs the person out and shows the family board. Music or a video playing keeps it signed in.
+
${r.device ? 'This is a family device' : 'Make this a family device'}${r.device ? 'It opens on the family board and signs people out after a few idle minutes.' : 'For a kitchen tablet or the family computer: it opens on the family board, and everyone picks their name to use it. You will be signed out here.'}
` : ''}`;
box.querySelector('#devpin').onclick = () => { const el = openSheet('Your PIN', 'Used to pick your name on a shared family screen.', ''); el.querySelector('#pns').onclick = async () => { try { await post('pin', { pin: el.querySelector('#pn').value }); closeSheet(); toast('PIN saved'); devSettings(box); } catch (e) { toast(e.message); } }; };
+ const idle = box.querySelector('#devidle'); if (idle) idle.onchange = async () => { try { await post('idle', { minutes: +idle.value }); toast('Saved'); } catch (e) { toast(e.message); } };
const x = box.querySelector('#devpinx'); if (x) x.onclick = async () => { try { await jfetch('/api/device/pin', { method: 'DELETE' }); devSettings(box); } catch (e) { toast(e.message); } };
const t = box.querySelector('#devtoggle'); if (t) t.onclick = () => r.device ? confirmSheet('Turn off family device?', 'This screen goes back to the normal sign-in.', 'Turn off', async () => { try { await post('remove'); location.replace('/login'); } catch (e) { toast(e.message); } }) : confirmSheet('Make this a family device?', 'You will be signed out, and this screen opens on the family board from now on.', 'Make it', async () => { try { await post('enable', { name: /iPad/.test(navigator.userAgent) ? 'iPad' : 'Family screen' }); location.replace('/board'); } catch (e) { toast(e.message); } });
}
diff --git a/public/store-view.js b/public/store-view.js
index fa480b3..6b8df92 100644
--- a/public/store-view.js
+++ b/public/store-view.js
@@ -15,6 +15,7 @@ const stSections = () => [['books', 'Books', allowed('read')], ['audiobooks', 'A
async function viewStore(args = []) {
const secs = stSections(), want = args[0] === 'ext' || args[0] === 'site' ? 'mine' : args[0], sec = (secs.find(s => s[0] === want) || secs[0])[0];
+ if (!args[0] || (!secs.some(s => s[0] === args[0]) && args[0] !== 'ext' && args[0] !== 'site')) return location.replace('#/store/' + sec); // (a bare #/store opens the first section by its own address, so its page knows it is the one showing)
const v = $('#view');
v.innerHTML = `