From 0edd59be4bbfc62f73b972e4992ec3c31d6baab1 Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Thu, 22 Jan 2026 18:05:17 +0000
Subject: fix admin resets

---
 routes/users.ts | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

(limited to 'routes')

diff --git a/routes/users.ts b/routes/users.ts
index 59aa0778..91928503 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -640,17 +640,14 @@ export default {
       body: { code, username, password },
       user: u,
     } = req;
+    try {
     const admin = u?.admin;
     let id;
     let user;
 
-    if (admin) {
+      if (u.username !== config.admin) fail("disabled");
       id = await g(`user:${username.toLowerCase().replace(/\s/g, "")}`);
       user = await g(`user:${id}`);
-    } else {
-      id = await g(`reset:${code}`);
-      user = await g(`user:${id}`);
-    }
 
     if (!user) fail("user not found");
 
@@ -661,7 +658,6 @@ export default {
       req.headers["cf-connecting-ip"],
     );
 
-    try {
       user.pin = null;
       user.nsec = null;
 
@@ -675,7 +671,7 @@ export default {
 
       res.send(pick(user, whitelist));
     } catch (e) {
-      err("password reset failed", e.message);
+      err("password reset failed", e.message, req.headers["cf-connecting-ip"]);
       bail(res, e.message);
     }
   },
-- 
cgit v1.2.3