From b3126013f5df34c02a08a71461c205eb97f7b2d8 Mon Sep 17 00:00:00 2001
From: Hamza-Ayed <hamzaayedflutter@gmail.com>
Date: Fri, 24 Jul 2026 23:31:37 +0300
Subject: [PATCH] Update: 2026-07-24 23:31:37

---
 dashboard/siro-admin/js/app.js | 64 ++++++++++++++++++++--------------
 1 file changed, 37 insertions(+), 27 deletions(-)

diff --git a/dashboard/siro-admin/js/app.js b/dashboard/siro-admin/js/app.js
index 6352a8b4..bb311db1 100644
--- a/dashboard/siro-admin/js/app.js
+++ b/dashboard/siro-admin/js/app.js
@@ -102,49 +102,59 @@ document.addEventListener('DOMContentLoaded', () => {
     const password = document.getElementById('loginPass').value.trim();
 
     if (isLiveMode) {
-      showNotification('Authenticating device with server...', 'info');
+      showNotification('Authenticating credentials with server...', 'info');
       try {
         const formData = new FormData();
         formData.append('phone', phone);
+        formData.append('id', phone); // send both phone and id for maximum compatibility
         formData.append('password', password);
         formData.append('fingerprint', deviceFingerprint);
         formData.append('aud', 'admin');
 
-        const response = await fetch('/backend/Admin/auth/login.php', {
+        // Try Admin auth login endpoint
+        let response = await fetch('/backend/Admin/auth/login.php', {
           method: 'POST',
           body: formData
         });
 
+        // Fallback to loginAdmin.php if 404
+        if (response.status === 404) {
+          response = await fetch('/backend/loginAdmin.php', {
+            method: 'POST',
+            body: formData
+          });
+        }
+
         const res = await response.json();
-        if (response.ok && res.status === 'success') {
-          if (res.jwt) {
-            currentUser = { 
-              name: res.admin?.name || 'Admin', 
-              email: res.admin?.email || phone, 
-              role: res.admin?.role || 'Administrator', 
-              jwt: res.jwt, 
-              isLive: true 
-            };
-            localStorage.setItem('siro_admin_user', JSON.stringify(currentUser));
-            authWrapper.classList.add('hidden');
-            showNotification('Access Granted! Device Fingerprint Verified.', 'success');
-            fetchLiveDashboardData();
-          } else if (res.message && res.message.status === 'otp_required' || res.status === 'otp_required') {
-            pendingOtpPhone = phone;
-            pendingOtpPassword = password;
-            const masked = res.phone || res.message?.phone || phone;
-            document.getElementById('otpPhoneText').textContent = `Verification code sent to WhatsApp (${masked})`;
-            document.getElementById('otpModal').classList.add('active');
-          }
+        
+        if (response.ok && (res.status === 'success' || res.jwt || res.data?.jwt)) {
+          const jwtToken = res.jwt || res.data?.jwt;
+          const adminInfo = res.admin || res.data?.admin || {};
+          currentUser = { 
+            name: adminInfo.name || 'Admin', 
+            email: adminInfo.email || phone, 
+            role: adminInfo.role || 'Administrator', 
+            jwt: jwtToken, 
+            isLive: true 
+          };
+          localStorage.setItem('siro_admin_user', JSON.stringify(currentUser));
+          authWrapper.classList.add('hidden');
+          showNotification('Access Granted! Welcome to Admin Portal.', 'success');
+          fetchLiveDashboardData();
+        } else if (res.status === 'otp_required' || (res.message && (res.message.status === 'otp_required' || res.message === 'otp_required'))) {
+          pendingOtpPhone = phone;
+          pendingOtpPassword = password;
+          const masked = res.phone || (typeof res.message === 'object' ? res.message.phone : null) || phone;
+          document.getElementById('otpPhoneText').textContent = `Verification code sent to WhatsApp (${masked})`;
+          document.getElementById('otpModal').classList.add('active');
         } else {
-          showNotification(res.message || 'Invalid credentials or device not registered.', 'warning');
+          // Show REAL backend API error message and DO NOT redirect to demo mode
+          const errorMsg = res.message || res.error || 'Invalid username or password.';
+          showNotification(`Login Error: ${errorMsg}`, 'danger');
         }
       } catch (err) {
         console.error(err);
-        showNotification('Cannot connect to Live Backend. Entering Demo Mode.', 'info');
-        currentUser = { name: 'Super Admin (Demo)', email: phone, role: 'Administrator', isLive: false };
-        localStorage.setItem('siro_admin_user', JSON.stringify(currentUser));
-        authWrapper.classList.add('hidden');
+        showNotification('Connection Error: Could not reach authentication server.', 'danger');
       }
     } else {
       currentUser = { name: 'Super Admin (Demo)', email: phone, role: 'Administrator', isLive: false };