stem-lab-toolkit 1.0.1 → 1.0.3

package/js/admin.js

@@ -1,16 +1,16 @@
-if (!localStorage.getItem('mm_admin_session')) {
-  window.location.replace('./browse.html');
-}
-
 let games = [];
 
-function getAdminPin() {
-  return sessionStorage.getItem('mm_admin_pin') || '1234';
+function getToken() {
+  return sessionStorage.getItem('mm_token') || '';
+}
+
+function authHeaders() {
+  return { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + getToken() };
 }
 
 async function loadGames() {
   try {
-    const res = await fetch('./api/games/all');
+    const res = await fetch('./api/games/all', { headers: authHeaders() });
     if (!res.ok) throw new Error();
     games = await res.json();
   } catch {
@@ -27,8 +27,8 @@ async function saveGames() {
   try {
     const res = await fetch('./api/games', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ adminPin: getAdminPin(), games }),
+      headers: authHeaders(),
+      body: JSON.stringify({ games }),
     });
     if (!res.ok) throw new Error();
     return true;
@@ -135,34 +135,149 @@ document.getElementById('table-body').addEventListener('change', async e => {
   showFeedback('table-feedback', ok ? 'Visibility updated.' : 'Updated locally (API unavailable).', ok ? 'ok' : 'error');
 });
 
-// Change PINs
-document.getElementById('pin-save-btn').addEventListener('click', async () => {
-  const newAdmin = document.getElementById('pin-admin').value.trim();
-  const newUser  = document.getElementById('pin-user').value.trim();
+// ── User Management ───────────────────────────────────────────────────────────
+
+async function loadUsers() {
+  try {
+    const res = await fetch('./api/users', { headers: authHeaders() });
+    if (!res.ok) throw new Error();
+    const users = await res.json();
+    renderUsers(users);
+  } catch {
+    document.getElementById('users-tbody').innerHTML =
+      '<tr><td colspan="3" style="color:var(--muted);text-align:center;padding:24px;">Unable to load users.</td></tr>';
+  }
+}
+
+const RANK_CLASS = { administrator: 'rank-administrator', admin: 'rank-admin', user: 'rank-user' };
+
+function renderUsers(users) {
+  const tbody = document.getElementById('users-tbody');
+  if (!users.length) {
+    tbody.innerHTML = '<tr><td colspan="4" style="text-align:center;padding:24px;color:var(--muted);">No users.</td></tr>';
+    return;
+  }
+  tbody.innerHTML = users.map(u => `
+    <tr>
+      <td style="font-weight:500;">${u.username}</td>
+      <td>
+        <select class="rank-select" data-user="${u.username}" data-orig="${u.rank}">
+          <option value="user" ${u.rank==='user'?'selected':''}>user</option>
+          <option value="admin" ${u.rank==='admin'?'selected':''}>admin</option>
+          <option value="administrator" ${u.rank==='administrator'?'selected':''}>administrator</option>
+        </select>
+      </td>
+      <td style="text-align:center;">
+        <label class="toggle">
+          <input type="checkbox" data-action="force-change" data-user="${u.username}" ${u.forcePasswordChange ? 'checked' : ''}>
+          <span class="toggle-slider"></span>
+        </label>
+      </td>
+      <td style="display:flex;gap:6px;flex-wrap:wrap;padding:6px 8px;">
+        <button class="btn btn-sm btn-primary" data-action="update-rank" data-user="${u.username}">Save Rank</button>
+        <button class="btn btn-sm btn-ghost"   data-action="reset-pass"  data-user="${u.username}">Reset Password</button>
+        <button class="btn btn-sm btn-danger"  data-action="del-user"    data-user="${u.username}">Delete</button>
+      </td>
+    </tr>
+  `).join('');
+}
+
+document.getElementById('users-tbody').addEventListener('click', async e => {
+  const btn = e.target.closest('[data-action]');
+  if (!btn) return;
+  const action = btn.dataset.action;
+  const username = btn.dataset.user;
+
+  if (action === 'update-rank') {
+    const row = btn.closest('tr');
+    const sel = row.querySelector('select.rank-select');
+    const rank = sel.value;
+    try {
+      const res = await fetch('./api/users/update', {
+        method: 'POST', headers: authHeaders(), body: JSON.stringify({ username, rank }),
+      });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data.error);
+      showFeedback('users-feedback', `${username} rank updated to ${rank}.`, 'ok');
+      loadUsers();
+    } catch (err) {
+      showFeedback('users-feedback', err.message || 'Failed.', 'error');
+    }
+  }
+
+  if (action === 'reset-pass') {
+    const newPass = prompt(`New password for "${username}":`);
+    if (!newPass) return;
+    try {
+      const res = await fetch('./api/users/reset-password', {
+        method: 'POST', headers: authHeaders(), body: JSON.stringify({ username, password: newPass }),
+      });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data.error);
+      showFeedback('users-feedback', `Password reset for ${username}.`, 'ok');
+    } catch (err) {
+      showFeedback('users-feedback', err.message || 'Failed.', 'error');
+    }
+  }
+
+  if (action === 'del-user') {
+    if (!confirm(`Delete user "${username}"?`)) return;
+    try {
+      const res = await fetch('./api/users/delete', {
+        method: 'POST', headers: authHeaders(), body: JSON.stringify({ username }),
+      });
+      const data = await res.json();
+      if (!res.ok) throw new Error(data.error);
+      showFeedback('users-feedback', `${username} deleted.`, 'ok');
+      loadUsers();
+    } catch (err) {
+      showFeedback('users-feedback', err.message || 'Failed.', 'error');
+    }
+  }
+});
+
+document.getElementById('add-user-btn').addEventListener('click', async () => {
+  const username = document.getElementById('new-username').value.trim();
+  const password = document.getElementById('new-password').value;
+  const rank     = document.getElementById('new-rank').value;
 
-  if (!newAdmin && !newUser) {
-    showFeedback('pin-feedback', 'Enter at least one new PIN.', 'error');
+  if (!username || !password) {
+    showFeedback('add-user-feedback', 'Username and password are required.', 'error');
     return;
   }
 
   try {
-    const res = await fetch('./api/pins', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ adminPin: getAdminPin(), newAdmin, newUser }),
+    const res = await fetch('./api/users/add', {
+      method: 'POST', headers: authHeaders(), body: JSON.stringify({ username, password, rank }),
     });
     const data = await res.json();
-    if (!res.ok) {
-      showFeedback('pin-feedback', data.error || 'Failed.', 'error');
-      return;
-    }
-    if (newAdmin) sessionStorage.setItem('mm_admin_pin', newAdmin);
-    document.getElementById('pin-admin').value = '';
-    document.getElementById('pin-user').value  = '';
-    showFeedback('pin-feedback', 'PINs updated.', 'ok');
-  } catch {
-    showFeedback('pin-feedback', 'API unavailable.', 'error');
+    if (!res.ok) throw new Error(data.error);
+    document.getElementById('new-username').value = '';
+    document.getElementById('new-password').value = '';
+    showFeedback('add-user-feedback', `User "${username}" added.`, 'ok');
+    loadUsers();
+  } catch (err) {
+    showFeedback('add-user-feedback', err.message || 'Failed.', 'error');
+  }
+});
+
+document.getElementById('users-tbody').addEventListener('change', async e => {
+  const input = e.target.closest('input[data-action="force-change"]');
+  if (!input) return;
+  const username = input.dataset.user;
+  const force = input.checked;
+  try {
+    const res = await fetch('./api/users/set-force-change', {
+      method: 'POST', headers: authHeaders(), body: JSON.stringify({ username, force }),
+    });
+    const data = await res.json();
+    if (!res.ok) throw new Error(data.error);
+    showFeedback('users-feedback', `Force password change ${force ? 'enabled' : 'disabled'} for ${username}.`, 'ok');
+  } catch (err) {
+    input.checked = !force;
+    showFeedback('users-feedback', err.message || 'Failed.', 'error');
   }
 });
 
 loadGames();
+loadUsers();

package/js/games.js

@@ -131,7 +131,7 @@ function renderGotd() {
 
   section.innerHTML = `
     <div class="section-title">Game of the Day</div>
-    <a href="./game.html?slug=${gotd.slug}" class="gotd-card">
+    <a href="./tool.html?slug=${gotd.slug}" class="gotd-card">
       ${thumbHtml}
       <div>
         <div class="gotd-label">⭐ Featured Today</div>
@@ -159,7 +159,7 @@ function renderGrid() {
   }
 
   grid.innerHTML = games.map(g => `
-    <a href="./game.html?slug=${g.slug}" class="game-card">
+    <a href="./tool.html?slug=${g.slug}" class="game-card">
       ${cardThumb(g)}
       <div class="game-card-body">
         <div class="game-card-name">${g.name}</div>

package/js/main.js

@@ -81,7 +81,7 @@ function pressEquals() {
   const entry = currentInput || displayVal;
 
   if (operand === null) {
-    if (entry === '5555') { window.location.href = './browse.html'; return; }
+    if (entry === '8008') { triggerMatrixEgg(); return; }
     justEvaled = true;
     return;
   }
@@ -174,99 +174,18 @@ document.querySelector('.sci-rows').addEventListener('click', e => {
 });
 
 document.addEventListener('keydown', e => {
-  if (pinOverlay.classList.contains('hidden')) {
-    if (e.key >= '0' && e.key <= '9') pressDigit(e.key);
-    else if (e.key === '.')                         pressDot();
-    else if (e.key === '+')                         pressOp('+');
-    else if (e.key === '-')                         pressOp('−');
-    else if (e.key === '*')                         pressOp('×');
-    else if (e.key === '/')  { e.preventDefault();  pressOp('÷'); }
-    else if (e.key === 'Enter' || e.key === '=')    pressEquals();
-    else if (e.key === 'Escape')                    pressClear();
-    else if (e.key === 'Backspace') {
-      if (currentInput.length > 1) { currentInput = currentInput.slice(0, -1); setDisplay(currentInput); }
-      else { currentInput = ''; setDisplay('0'); }
-    }
-  } else {
-    if (e.key >= '0' && e.key <= '9') addPinDigit(e.key);
-    else if (e.key === 'Backspace') delPinDigit();
-    else if (e.key === 'Escape') closePinOverlay();
-  }
-});
-
-// ── PIN overlay ──────────────────────────────────────────────────────────────
-const pinOverlay = document.getElementById('pin-overlay');
-const pinError   = document.getElementById('pin-error');
-let pinEntry     = '';
-
-function openPinOverlay() {
-  pinEntry = '';
-  pinError.textContent = '';
-  updatePinDots();
-  pinOverlay.classList.remove('hidden');
-}
-
-function closePinOverlay() {
-  pinOverlay.classList.add('hidden');
-  pinEntry = '';
-}
-
-function updatePinDots(state) {
-  for (let i = 0; i < 4; i++) {
-    const dot = document.getElementById('d' + i);
-    dot.className = 'pin-dot';
-    if (state === 'error') { dot.classList.add('error'); }
-    else if (i < pinEntry.length) { dot.classList.add('filled'); }
+  const loginOverlay = document.getElementById('login-overlay');
+  if (loginOverlay && !loginOverlay.classList.contains('hidden')) return;
+  if (e.key >= '0' && e.key <= '9') pressDigit(e.key);
+  else if (e.key === '.')                         pressDot();
+  else if (e.key === '+')                         pressOp('+');
+  else if (e.key === '-')                         pressOp('−');
+  else if (e.key === '*')                         pressOp('×');
+  else if (e.key === '/')  { e.preventDefault();  pressOp('÷'); }
+  else if (e.key === 'Enter' || e.key === '=')    pressEquals();
+  else if (e.key === 'Escape')                    pressClear();
+  else if (e.key === 'Backspace') {
+    if (currentInput.length > 1) { currentInput = currentInput.slice(0, -1); setDisplay(currentInput); }
+    else { currentInput = ''; setDisplay('0'); }
   }
-}
-
-function addPinDigit(d) {
-  if (pinEntry.length >= 4) return;
-  pinEntry += d;
-  updatePinDots();
-  if (pinEntry.length === 4) submitPin();
-}
-
-function delPinDigit() {
-  pinEntry = pinEntry.slice(0, -1);
-  updatePinDots();
-  pinError.textContent = '';
-}
-
-async function submitPin() {
-  const pin = pinEntry;
-  let isUser = false;
-  try {
-    const res  = await fetch('./api/pin', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ pin }),
-    });
-    const data = await res.json();
-    isUser = data.role === 'user';
-  } catch {
-    isUser = pin === '5555';
-  }
-  if (isUser) { window.location.href = './browse.html'; }
-  else         { showPinError(); }
-}
-
-function showPinError() {
-  updatePinDots('error');
-  pinError.textContent = 'Incorrect PIN';
-  setTimeout(() => {
-    pinEntry = '';
-    updatePinDots();
-    pinError.textContent = '';
-  }, 1200);
-}
-
-
-document.querySelector('.pin-keypad').addEventListener('click', e => {
-  const btn = e.target.closest('button');
-  if (!btn) return;
-  const k = btn.dataset.k;
-  if (k === 'del')    delPinDigit();
-  else if (k === 'cancel') closePinOverlay();
-  else addPinDigit(k);
 });

package/js/pin-modal.js

@@ -1,98 +1,13 @@
-// Shared PIN modal for light-themed pages (browse, game)
-// Intercepts clicks on any <a href="./admin.html"> and prompts for PIN.
-(() => {
-  const el = document.createElement('div');
-  el.innerHTML = `
-    <div class="pin-overlay hidden" id="pm-overlay">
-      <div class="pin-box">
-        <h2>Admin Access</h2>
-        <p>Enter your PIN to continue</p>
-        <div class="pin-dots">
-          <div class="pin-dot" id="pm-d0"></div>
-          <div class="pin-dot" id="pm-d1"></div>
-          <div class="pin-dot" id="pm-d2"></div>
-          <div class="pin-dot" id="pm-d3"></div>
-        </div>
-        <div class="pin-error" id="pm-error"></div>
-        <div class="pin-keypad" id="pm-keypad">
-          <button class="pin-key" data-k="1">1</button>
-          <button class="pin-key" data-k="2">2</button>
-          <button class="pin-key" data-k="3">3</button>
-          <button class="pin-key" data-k="4">4</button>
-          <button class="pin-key" data-k="5">5</button>
-          <button class="pin-key" data-k="6">6</button>
-          <button class="pin-key" data-k="7">7</button>
-          <button class="pin-key" data-k="8">8</button>
-          <button class="pin-key" data-k="9">9</button>
-          <button class="pin-key delete" data-k="del">⌫</button>
-          <button class="pin-key" data-k="0">0</button>
-          <button class="pin-cancel" data-k="cancel">Cancel</button>
-        </div>
-      </div>
-    </div>`;
-  document.body.appendChild(el.firstElementChild);
-
-  const overlay = document.getElementById('pm-overlay');
-  const errEl   = document.getElementById('pm-error');
-  let entry = '';
-
-  function dots(state) {
-    for (let i = 0; i < 4; i++) {
-      const d = document.getElementById('pm-d' + i);
-      d.className = 'pin-dot' + (state === 'error' ? ' error' : i < entry.length ? ' filled' : '');
-    }
-  }
-
-  function open()  { entry = ''; errEl.textContent = ''; dots(); overlay.classList.remove('hidden'); }
-  function close() { overlay.classList.add('hidden'); entry = ''; }
-
-  function addDigit(d) {
-    if (entry.length >= 4) return;
-    entry += d; dots();
-    if (entry.length === 4) submit();
-  }
-
-  function del() { entry = entry.slice(0, -1); dots(); errEl.textContent = ''; }
-
-  async function submit() {
-    const pin = entry;
-    let ok = false;
-    try {
-      const res  = await fetch('./api/pin', { method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({ pin }) });
-      const data = await res.json();
-      ok = data.role === 'admin';
-    } catch { ok = pin === '1234'; }
-
-    if (ok) {
-      localStorage.setItem('mm_admin_session', '1');
-      sessionStorage.setItem('mm_admin_pin', pin);
-      window.location.href = './admin.html';
-    } else {
-      dots('error');
-      errEl.textContent = 'Incorrect PIN';
-      setTimeout(() => { entry = ''; dots(); errEl.textContent = ''; }, 1200);
-    }
-  }
-
-  document.getElementById('pm-keypad').addEventListener('click', e => {
-    const btn = e.target.closest('[data-k]');
-    if (!btn) return;
-    const k = btn.dataset.k;
-    if (k === 'del') del(); else if (k === 'cancel') close(); else addDigit(k);
-  });
-
-  document.addEventListener('keydown', e => {
-    if (overlay.classList.contains('hidden')) return;
-    if (e.key >= '0' && e.key <= '9') addDigit(e.key);
-    else if (e.key === 'Backspace') del();
-    else if (e.key === 'Escape') close();
-  });
-
-  // Intercept every Admin nav link on this page
-  document.addEventListener('click', e => {
-    const a = e.target.closest('a[href="./admin.html"]');
+// Redirect the Admin nav link based on the authenticated user's rank.
+(function () {
+  document.addEventListener('click', function (e) {
+    var a = e.target.closest('a[href="./admin.html"]');
     if (!a) return;
-    e.preventDefault();
-    open();
+    var rank = sessionStorage.getItem('mm_rank');
+    if (rank === 'admin') {
+      e.preventDefault();
+      window.location.href = './control-panel.html';
+    }
+    // 'administrator' follows the href naturally; 'user' hits admin.html which redirects them
   });
 })();

package/js/theme.js

@@ -0,0 +1,20 @@
+const moonSVG = `<svg width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" viewBox="0 0 24 24"><path d="M21 12.79A9 9 0 1111.21 3 7 7 0 0021 12.79z"/></svg>`;
+const sunSVG  = `<svg width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" viewBox="0 0 24 24"><circle cx="12" cy="12" r="5"/><line x1="12" y1="1" x2="12" y2="3"/><line x1="12" y1="21" x2="12" y2="23"/><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/><line x1="1" y1="12" x2="3" y2="12"/><line x1="21" y1="12" x2="23" y2="12"/><line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/><line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/></svg>`;
+
+function toggleTheme() {
+  const isDark = document.documentElement.getAttribute('data-theme') === 'dark';
+  const next   = isDark ? 'light' : 'dark';
+  document.documentElement.setAttribute('data-theme', next);
+  localStorage.setItem('mm_theme', next);
+  updateIcon();
+}
+
+function updateIcon() {
+  const btn = document.getElementById('theme-toggle');
+  if (!btn) return;
+  const isDark = document.documentElement.getAttribute('data-theme') === 'dark';
+  btn.innerHTML = isDark ? sunSVG : moonSVG;
+  btn.title     = isDark ? 'Light mode' : 'Dark mode';
+}
+
+updateIcon();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stem-lab-toolkit",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "STEM educational toolkit",
   "main": "index.html",
   "scripts": {
@@ -13,5 +13,10 @@
     "math"
   ],
   "license": "MIT",
-  "author": ""
+  "author": "",
+  "dependencies": {
+    "bcrypt": "^6.0.0",
+    "express": "^5.2.1",
+    "express-rate-limit": "^8.5.1"
+  }
 }

package/{game.html → tool.html}

@@ -1,7 +1,9 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
-  <meta charset="UTF-8">
+<meta charset="UTF-8">
+<script>(function(){var n=performance.getEntriesByType('navigation')[0];if(n&&n.type==='reload'){sessionStorage.clear();window.location.replace('./index.html');return;}if(sessionStorage.getItem('mm_auth')!=='true'){window.location.replace('./index.html');return;}if(sessionStorage.getItem('mm_force_change')==='true'){window.location.replace('./change-password.html');return;}var r=sessionStorage.getItem('mm_rank');if(!r){window.location.replace('./index.html');}})();</script>
+  <link rel="icon" type="image/png" href="/assets/favicon.png">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>MM Games</title>
   <link rel="stylesheet" href="./css/style.css">
@@ -115,8 +117,9 @@
 <header class="site-header">
   <div class="header-inner">
     <a href="./browse.html" class="logo-link">
-      <img src="./assets/logo.png" alt="" class="logo-img" onerror="this.style.display='none'">
-      <span>MM Games</span><span style="font-size:0.65rem;color:var(--muted);margin-left:6px;">v1.0.0</span>
+      <img src="./assets/logo.png?v=new" alt="" class="logo-img" onerror="this.style.display='none'">
+      <span>MM Games</span>
+      
     </a>
     <nav class="site-nav">
       <a href="./browse.html">Browse</a>
@@ -162,37 +165,33 @@
   document.title = game.name + ' — MM Games';
 
   const SITE = 'https://calc.moshelab.com';
-  let src;
-  if (game.embedType === 'local') {
-    src = `./local-games/${game.localFile || game.slug + '.html'}`;
-  } else if (game.embedType === 'gamepix') {
-    src = game.embedUrl;
-  } else {
-    src = `https://html5.gamedistribution.com/${game.gameId}/?gd_sdk_referrer_url=${SITE}/games/${game.slug}`;
-  }
+  const isLocal = game.embedType === 'local';
+  const src = isLocal ? '' :
+    game.embedType === 'gamepix' ? game.embedUrl :
+    `https://html5.gamedistribution.com/${game.gameId}/?gd_sdk_referrer_url=${SITE}/games/${game.slug}`;
 
   wrap.innerHTML = `
     <div class="game-title-bar">
       <div class="game-name">${game.name}</div>
       <span class="cat-badge ${game.category}">${game.category}</span>
     </div>
-    <div class="game-frame-wrap" id="frame-wrap" style="${game.embedType === 'local' ? 'height:80vh;' : ''}">
-      <div class="${game.embedType === 'local' ? '' : 'game-frame-ratio'}" style="${game.embedType === 'local' ? 'height:100%;' : ''}">
+    <div class="game-frame-wrap" id="frame-wrap" style="${isLocal ? 'height:80vh;' : ''}">
+      <div class="${isLocal ? '' : 'game-frame-ratio'}" style="${isLocal ? 'height:100%;' : ''}">
         <iframe
           class="game-iframe"
           id="game-iframe"
-          src="${src}"
+          ${src ? `src="${src}"` : ''}
           allowfullscreen
           allow="fullscreen; autoplay; encrypted-media"
-          scrolling="${game.embedType === 'local' ? 'yes' : 'no'}"
-          style="${game.embedType === 'local' ? 'position:static;height:100%;' : ''}"
+          scrolling="${isLocal ? 'yes' : 'no'}"
+          style="${isLocal ? 'position:static;height:100%;' : ''}"
         ></iframe>
       </div>
     </div>
     <div class="game-actions">
       <button class="fullscreen-btn" id="fs-btn">
         <svg width="16" height="16" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
-          <path d="M8 3H5a2 2 0 00-2 2v1.0.0m18 0V5a2 2 0 00-2-2h-3m0 18h3a2 2 0 002-2v-3M3 16v1.0.0a2 2 0 002 2h3"/>
+          <path d="M8 3H5a2 2 0 00-2 2v1.0.3m18 0V5a2 2 0 00-2-2h-3m0 18h3a2 2 0 002-2v-3M3 16v1.0.3a2 2 0 002 2h3"/>
         </svg>
         Fullscreen
       </button>
@@ -202,6 +201,17 @@
     </div>
   `;
 
+  if (isLocal) {
+    try {
+      const localPath = `./local-games/${game.localFile || game.slug + '.html'}`;
+      const res  = await fetch(localPath);
+      const html = await res.text();
+      document.getElementById('game-iframe').srcdoc = html;
+    } catch {
+      error('Could not load game file.');
+    }
+  }
+
   document.getElementById('fs-btn').addEventListener('click', () => {
     const el = document.getElementById('frame-wrap');
     if (el.requestFullscreen)       el.requestFullscreen();
@@ -209,6 +219,9 @@
   });
 })();
 </script>
-<script src="./js/pin-modal.js?v=2"></script>
+<script src="./js/pin-modal.js?v=1.0.3c"></script>
+
+<a href="https://forms.gle/59RMvCkURByui1747" target="_blank" rel="noopener" style="position:fixed;bottom:20px;right:20px;background:rgba(255,255,255,.08);color:rgba(255,255,255,.4);font-size:0.72rem;font-weight:500;padding:6px 14px;border-radius:999px;text-decoration:none;z-index:199;border:1px solid rgba(255,255,255,.1);transition:all .15s;" onmouseover="this.style.background='rgba(255,255,255,.16)';this.style.color='rgba(255,255,255,.8)'" onmouseout="this.style.background='rgba(255,255,255,.08)';this.style.color='rgba(255,255,255,.4)'">Feedback</a>
+
 </body>
 </html>

package/users.json

@@ -0,0 +1,62 @@
+[
+  {
+    "username": "owner",
+    "password": "$2b$12$pv3OKADBaxJdCPEni5KHJexzvuSxQZQU0wdZ03OogqGbg1/UbPjc2",
+    "rank": "administrator",
+    "forcePasswordChange": false
+  },
+  {
+    "username": "Zach",
+    "password": "$2b$12$Mmz/l6N5rbwGOzYVoOMHbeVjQtpn.dSFQxoDhM2EJF9PJXesASxDC",
+    "rank": "admin",
+    "forcePasswordChange": true
+  },
+  {
+    "username": "Anthony",
+    "password": "$2b$12$GOdPip91LXzin0tm405YR.czj4zVDHcKNugvBDASfuyeNs20g0OkS",
+    "rank": "admin",
+    "forcePasswordChange": true
+  },
+  {
+    "username": "Viraj",
+    "password": "$2b$12$Tq60W3D7ti8l3LOApZP1keKy8aulE9zv.es0dbOxyQ61BF/g1iFJO",
+    "rank": "user",
+    "forcePasswordChange": true
+  },
+  {
+    "username": "Blake",
+    "password": "$2b$12$5QX1SvmJVDQuP/Ek3IOmVu85Fh5Gp3rgKNUREZGuONIc5zp7quIb.",
+    "rank": "admin",
+    "forcePasswordChange": true
+  },
+  {
+    "username": "Niko",
+    "password": "$2b$12$orOTbzLeA.Dzw7E.fRuPd.IE52xQahOF1oX57xVlGmUeNSRvB8sLi",
+    "rank": "admin",
+    "forcePasswordChange": true
+  },
+  {
+    "username": "Sebastian",
+    "password": "$2b$12$gA9e471aAPqqtkxMkiUsou2SWwMEPHF1.rYTEqarwvFWPHiavJxfW",
+    "rank": "administrator",
+    "forcePasswordChange": true
+  },
+  {
+    "username": "Logan",
+    "password": "$2b$12$ivEJU6D/nOXXg3WP93TuUusjOJaLFc2uEDvWm9IDRzINMFhoxm5cq",
+    "rank": "user",
+    "forcePasswordChange": true
+  },
+  {
+    "username": "Spencer",
+    "password": "$2b$12$Ru3Vz/.XeOO.xJRD3NW6rOK5LIpXH4nOFGKLf6W36nU5inUM0s27m",
+    "rank": "admin",
+    "forcePasswordChange": true
+  },
+  {
+    "username": "Finn",
+    "password": "$2b$12$UKA3fZnBItyMSME0y9Jmsu0eN4iXZmqUAY0gVPvB0bonBvWtCo3Gy",
+    "rank": "admin",
+    "forcePasswordChange": true
+  }
+]