${ing.name}${ing.brand ? ' (' + ing.brand + ')' : ''}: ${ing.qty} ✅`;
+ html += ``;
+ html += `${escapeHtml(ing.name)}${ing.brand ? ' (' + escapeHtml(ing.brand) + ')' : ''}: ${escapeHtml(ing.qty)} ✅`;
// Detail line: location + expiry
let details = [];
const ingredientLocLabels = Object.fromEntries(Object.entries(LOCATIONS).map(([k,v]) => [k, `${v.icon} ${v.label}`]));
@@ -14016,7 +14030,7 @@ function renderRecipe(r) {
html += ``;
} else {
const pantryIcon = ing.from_pantry ? ' ✅' : ' 🛒';
- html += `${ing.name}: ${ing.qty}${pantryIcon}`;
+ html += `${escapeHtml(ing.name)}: ${escapeHtml(ing.qty)}${pantryIcon}`;
}
});
html += '';
@@ -14028,13 +14042,60 @@ function renderRecipe(r) {
html += `${t('recipes.steps_title')}
`;
(r.steps || []).forEach(step => {
const appliance = _stepAppliance(step);
- html += `- ${_stepStr(step)}${appliance ? ` ${appliance}` : ''}
`;
+ html += `- ${escapeHtml(_stepStr(step))}${appliance ? ` ${escapeHtml(appliance)}` : ''}
`;
});
html += '
';
- // Nutrition note
+ // Nutritional values grid
+ if (r.nutrition && (r.nutrition.kcal || r.nutrition.protein_g || r.nutrition.carbs_g || r.nutrition.fat_g)) {
+ const n = r.nutrition;
+ html += `
+
📊 ${t('recipes.nutrition_title')}
+
+
+ 🔥
+ ${n.kcal ?? '—'}
+ ${t('recipes.nutrition_kcal')}
+
+
+ 🥩
+ ${n.protein_g ?? '—'} g
+ ${t('recipes.nutrition_protein')}
+
+
+ 🍞
+ ${n.carbs_g ?? '—'} g
+ ${t('recipes.nutrition_carbs')}
+
+
+ 🫒
+ ${n.fat_g ?? '—'} g
+ ${t('recipes.nutrition_fat')}
+
+
+
${t('recipes.nutrition_per_serving')}
+
+
📦 ${t('recipes.storage_title')}
+
+ ${s.where ? `${escapeHtml(s.where)}` : ''}
+ ${s.days > 0 ? `${escapeHtml(daysLabel)}` : `${escapeHtml(daysLabel)}`}
+
+ ${s.tips ? `
${escapeHtml(s.tips)}
` : ''}
+
💡 ${r.nutrition_note}
`;
+ html += ``;
}
document.getElementById('recipe-content').innerHTML = html;
@@ -14453,10 +14514,7 @@ function _buildTtsRequest(text, s) {
function _buildHaTtsRequest(text, s) {
const haUrl = (s.ha_url || '').replace(/\/$/, '');
const url = haUrl + '/api/services/tts/speak';
- const headers = {
- 'Content-Type': 'application/json',
- 'Authorization': 'Bearer ' + (s.ha_token || ''),
- };
+ const headers = { 'Content-Type': 'application/json' };
const body = JSON.stringify({
entity_id: s.ha_tts_entity || '',
message: text,
@@ -14739,8 +14797,9 @@ async function saveHaSettings() {
const statusEl = document.getElementById('ha-save-status');
try {
- const settingsToken = document.getElementById('setting-settings-token')?.value.trim() || '';
- const tokenHeader = settingsToken ? { 'X-Settings-Token': settingsToken } : {};
+ const settingsToken = document.getElementById('setting-settings-token')?.value.trim() || (typeof getApiToken === 'function' ? getApiToken() : '');
+ if (settingsToken && typeof setApiToken === 'function') setApiToken(settingsToken);
+ const tokenHeader = settingsToken ? { 'X-API-Token': settingsToken } : (typeof apiAuthHeaders === 'function' ? apiAuthHeaders() : {});
const result = await api('save_settings', {}, 'POST', {
ha_enabled: haEnabled,
ha_url: haUrl,
@@ -17522,7 +17581,11 @@ async function _runStartupCheck() {
if (!wrapEl) return true; // preloader already removed
- const tl = (key, fallback) => { try { return t('startup.' + key); } catch(e) { return fallback; } };
+ const tl = (key, fallback) => {
+ const full = 'startup.' + key;
+ const v = typeof t === 'function' ? t(full) : full;
+ return (v === full) ? fallback : v;
+ };
// Switch from spinner to progress bar
if (spinnerEl) spinnerEl.style.display = 'none';
@@ -17553,6 +17616,12 @@ async function _runStartupCheck() {
el.textContent = cleanLabel;
};
+ // Auto-provision API token for same-origin browser sessions
+ if (typeof ensureApiToken === 'function') {
+ setProgress(5, tl('token_autoconfig', 'Configurazione accesso...'), 'ok');
+ await ensureApiToken();
+ }
+
// Phase 1: animate 0→15% while fetching (so it never looks stuck)
setProgress(0, tl('connecting', 'Connessione al server...'));
let _fetchDone = false;
@@ -17568,9 +17637,22 @@ async function _runStartupCheck() {
try {
const ctrl = new AbortController();
const tid = setTimeout(() => ctrl.abort(), 12000);
- const resp = await fetch('api/index.php?action=health_check', { signal: ctrl.signal });
+ const resp = await fetch('api/index.php?action=health_check', {
+ signal: ctrl.signal,
+ headers: { ...(typeof apiAuthHeaders === 'function' ? apiAuthHeaders() : {}) },
+ });
clearTimeout(tid);
result = await resp.json();
+ if (result.public && result.api_token_required && typeof getApiToken === 'function' && !getApiToken()) {
+ window._apiTokenRequired = true;
+ if (typeof _promptApiTokenIfNeeded === 'function') _promptApiTokenIfNeeded();
+ setProgress(100, tl('token_required', 'Token API richiesto'), 'warn');
+ return false;
+ }
+ if (result.public && result.api_token_required && typeof getApiToken === 'function' && getApiToken()) {
+ const resp2 = await fetch('api/index.php?action=health_check', { headers: apiAuthHeaders() });
+ result = await resp2.json();
+ }
} catch(e) {
clearInterval(slowAnim);
_showStartupErrorPopup(
@@ -17697,9 +17779,10 @@ async function _runStartupCheck() {
// The bar already shows 100%; we just update the label for a moment.
try {
setProgress(100, tl('syncing_local', 'Sincronizzazione dati locali...'), 'ok');
+ const authH = typeof apiAuthHeaders === 'function' ? apiAuthHeaders() : {};
const [invData, settingsData] = await Promise.all([
- fetch('api/index.php?action=inventory_list').then(r => r.json()).catch(() => null),
- fetch('api/index.php?action=get_settings').then(r => r.json()).catch(() => null),
+ fetch('api/index.php?action=inventory_list', { headers: authH }).then(r => r.json()).catch(() => null),
+ fetch('api/index.php?action=get_settings', { headers: authH }).then(r => r.json()).catch(() => null),
]);
if (invData && Array.isArray(invData.inventory)) _offlineCacheSet(invData.inventory);
if (settingsData && settingsData.success !== false) _offlineCacheSetSettings(settingsData);
diff --git a/assets/js/core/auth.js b/assets/js/core/auth.js
new file mode 100644
index 0000000..cb54b7a
--- /dev/null
+++ b/assets/js/core/auth.js
@@ -0,0 +1,77 @@
+/**
+ * EverShelf core — API token storage and auth headers.
+ */
+const EVERSHELF_TOKEN_KEY = 'evershelf_api_token';
+
+function getApiToken() {
+ return localStorage.getItem(EVERSHELF_TOKEN_KEY) || '';
+}
+
+function setApiToken(token) {
+ const t = (token || '').trim();
+ if (t) {
+ localStorage.setItem(EVERSHELF_TOKEN_KEY, t);
+ } else {
+ localStorage.removeItem(EVERSHELF_TOKEN_KEY);
+ }
+}
+
+function apiAuthHeaders() {
+ const fromStorage = getApiToken();
+ const fromSettingsField = document.getElementById('setting-settings-token')?.value.trim() || '';
+ const token = fromSettingsField || fromStorage;
+ if (!token) return {};
+ return { 'X-API-Token': token };
+}
+
+/** Fetch API token from server when loading the UI from the same origin. */
+async function ensureApiToken() {
+ if (getApiToken()) return true;
+ try {
+ const res = await fetch('api/index.php?action=app_bootstrap', { cache: 'no-store' });
+ if (!res.ok) return false;
+ const data = await res.json();
+ window._apiTokenRequired = !!data.api_token_required;
+ if (data.api_token) {
+ setApiToken(data.api_token);
+ return true;
+ }
+ } catch (_) { /* offline / network */ }
+ return !!getApiToken();
+}
+
+function _promptApiTokenIfNeeded() {
+ if (!window._apiTokenRequired) return;
+ if (getApiToken()) return;
+ const existing = document.getElementById('api-token-overlay');
+ if (existing) return;
+ const title = typeof t === 'function' ? t('startup.token_prompt_title') : '🔒 API Token';
+ const hint = typeof t === 'function' ? t('startup.token_prompt_hint') : 'Enter API_TOKEN from .env';
+ const btn = typeof t === 'function' ? t('startup.token_prompt_btn') : 'Continue';
+ const overlay = document.createElement('div');
+ overlay.id = 'api-token-overlay';
+ overlay.className = 'modal-overlay';
+ overlay.style.display = 'flex';
+ overlay.innerHTML = `
+
+
${title}
+
${hint}
+
+
+