fix: resolve dashboard login hidden-state bug and rename auth routes

package.json

@@ -13,14 +13,14 @@
     "openapi.json"
   ],
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "dependencies": {
     "@huggingface/transformers": "^3.8.1",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "bcryptjs": "^2.4.3",
     "better-auth": "^1.5.5",
-    "better-sqlite3": "^11.0.0",
+    "better-sqlite3": "^12.0.0",
     "cors": "^2.8.6",
     "dotenv": "^17.3.1",
     "express": "^4.21.0",

src/public/app.js

@@ -4,7 +4,7 @@ let currentDocId = null;
 
 // Init
 document.addEventListener('DOMContentLoaded', async () => {
-  const res = await fetch('/api/auth/check');
+  const res = await fetch('/api/session/check');
   const data = await res.json();
   if (data.authenticated) {
     showApp();
@@ -29,7 +29,7 @@ function showApp() {
 document.getElementById('login-form').addEventListener('submit', async (e) => {
   e.preventDefault();
   const password = document.getElementById('login-password').value;
-  const res = await fetch('/api/login', {
+  const res = await fetch('/api/session/login', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ password }),
@@ -63,7 +63,7 @@ function showSection(name) {
 
 // Logout
 document.getElementById('logout-btn').addEventListener('click', async () => {
-  await fetch('/api/logout', { method: 'POST' });
+  await fetch('/api/session/logout', { method: 'POST' });
   showLogin();
 });
 
@@ -309,7 +309,7 @@ document.getElementById('password-form').addEventListener('submit', async (e) =>
   e.preventDefault();
   const current = document.getElementById('current-password').value;
   const newPassword = document.getElementById('new-password').value;
-  const res = await fetch('/api/auth/password', {
+  const res = await fetch('/api/session/password', {
     method: 'PUT',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ current: current, newPassword: newPassword }),

src/public/styles.css

@@ -5,6 +5,10 @@
   padding: 0;
 }
 
+[hidden] {
+  display: none !important;
+}
+
 body {
   font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
   background: #0d1117;

src/routes/auth-routes.js → src/routes/session-routes.js

@@ -3,11 +3,11 @@ import { loginHandler, logoutHandler, checkAuthHandler, authMiddleware, checkPas
 
 const router = Router();
 
-router.post('/api/login', loginHandler);
-router.post('/api/logout', logoutHandler);
-router.get('/api/auth/check', checkAuthHandler);
+router.post('/api/session/login', loginHandler);
+router.post('/api/session/logout', logoutHandler);
+router.get('/api/session/check', checkAuthHandler);
 
-router.put('/api/auth/password', authMiddleware, (req, res) => {
+router.put('/api/session/password', authMiddleware, (req, res) => {
   const { current, newPassword } = req.body || {};
   if (!current || !newPassword) {
     return res.status(400).json({ error: 'Both current and newPassword are required' });

src/server.js

@@ -9,7 +9,7 @@ import { hasPassword, setPassword, promptPassword, authMiddleware } from './auth
 import { getDocumentCount } from './db.js';
 import { ingestDirectory } from './ingest.js';
 import cors from 'cors';
-import authRoutes from './routes/auth-routes.js';
+import authRoutes from './routes/session-routes.js';
 import apiRoutes from './routes/api.js';
 import { toNodeHandler } from 'better-auth/node';
 import { auth } from './auth-oauth.js';