From c52f6089744e8275c28b4c66e1360bca311ca96e Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Fri, 22 May 2026 12:35:36 -0400
Subject: [PATCH] Fix admin bypass: defer closed overlay until after Google
 auth
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The closed overlay (z-index 2000) was blocking Google sign-in from
firing, so the admin check never ran. Now the overlay is deferred
when Google auth is configured — checkAdmin() shows or bypasses
it after auth completes.
---
 src/server/generate_form.py | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/src/server/generate_form.py b/src/server/generate_form.py
index fed517f..d11e034 100644
--- a/src/server/generate_form.py
+++ b/src/server/generate_form.py
@@ -136,6 +136,8 @@ function signOut() {
   isAdmin = false;
   var ab = document.getElementById('admin-btn');
   if (ab) ab.style.display = 'none';
+  var banner = document.getElementById('admin-closed-banner');
+  if (banner) banner.remove();
   googleCredential = null;
   googleUser = null;
   google.accounts.id.disableAutoSelect();
@@ -143,6 +145,7 @@ function signOut() {
   document.getElementById('app').style.display = 'none';
   var footer = document.getElementById('sticky-footer');
   if (footer) footer.style.display = 'none';
+  if (formClosed) showClosedOverlay();
 }
 """
     else:
@@ -454,6 +457,7 @@ const BULK_DISCOUNT = {bulk_discount};
 const COMPANY_SUBSIDY = {company_subsidy};
 const quantities = {{}};
 let formClosed = false;
+let formStatusData = null;
 let isAdmin = false;
 let adminWeeks = [];
 {
@@ -622,6 +626,14 @@ function updateTotal() {{
 }
 '''
     }
+function showClosedOverlay() {{
+  document.getElementById('closed-overlay').style.display = 'flex';
+  document.querySelectorAll('.qty-control button').forEach(b => b.disabled = true);
+  var submitBtn = document.getElementById('submit-btn');
+  if (submitBtn) submitBtn.disabled = true;
+  if (formStatusData) startCountdown(formStatusData);
+}}
+
 function adminBypassClosed() {{
   document.getElementById('closed-overlay').style.display = 'none';
   document.querySelectorAll('.qty-control button').forEach(b => b.disabled = false);
@@ -654,9 +666,13 @@ function checkAdmin() {{
         var ab = document.getElementById('admin-btn');
         if (ab) ab.style.display = 'inline-block';
         if (formClosed) adminBypassClosed();
+      }} else if (formClosed) {{
+        showClosedOverlay();
       }}
     }})
-    .catch(() => {{}});
+    .catch(() => {{
+      if (formClosed) showClosedOverlay();
+    }});
 }}
 
 function showAdmin() {{
@@ -862,14 +878,14 @@ async function checkFormStatus() {{
     const data = await res.json();
     if (data.status === 'closed') {{
       formClosed = true;
+      formStatusData = data;
       if (isAdmin) {{
         adminBypassClosed();
+      }} else if (typeof GOOGLE_CLIENT_ID !== 'undefined' && GOOGLE_CLIENT_ID) {{
+        // Defer overlay until after Google auth resolves — checkAdmin() will
+        // show the overlay for non-admins or bypass it for admins.
       }} else {{
-        document.getElementById('closed-overlay').style.display = 'flex';
-        document.querySelectorAll('.qty-control button').forEach(b => b.disabled = true);
-        const submitBtn = document.getElementById('submit-btn');
-        if (submitBtn) submitBtn.disabled = true;
-        startCountdown(data);
+        showClosedOverlay();
       }}
     }}
   }} catch (e) {{}}