update promo

functions/login-user.ts

@@ -49,7 +49,7 @@ export default async function (req: Request): Promise<Response> {
 
     const { data: user } = await admin.database
       .from("app_users")
-      .select("username, password_hash, salt")
+      .select("username, password_hash, salt, approved")
       .eq("username", username.trim())
       .maybeSingle();
 
@@ -60,6 +60,13 @@ export default async function (req: Request): Promise<Response> {
       });
     }
 
+    if (!user.approved) {
+      return new Response(
+        JSON.stringify({ error: "Akun Anda belum disetujui oleh admin." }),
+        { status: 403, headers: { ...corsHeaders, "Content-Type": "application/json" } }
+      );
+    }
+
     const pepper = Deno.env.get("AUTH_PEPPER") ?? "";
     const hash = await sha256Hex(`${user.salt}|${password}|${pepper}`);
 
@@ -70,7 +77,11 @@ export default async function (req: Request): Promise<Response> {
       });
     }
 
-    return new Response(JSON.stringify({ ok: true, username: user.username }), {
+    const token = await sha256Hex(`${user.username}|${pepper}`);
+
+    return new Response(
+      JSON.stringify({ ok: true, username: user.username, token }),
+    {
       status: 200,
       headers: { ...corsHeaders, "Content-Type": "application/json" },
     });