fix: auth server-side, sin hash en el HTML

public/nuevo-invitado.html

@@ -44,7 +44,7 @@
 <main class="legal contact">
   <h1>Nuevo <em>enlace</em> de invitado</h1>
 
-  <div id="login-panel">
+  <div id="login-panel" hidden>
     <p class="lead-c">Solo para el equipo del programa.</p>
     <form id="login-form" class="gen-form lock" novalidate>
       <label>Contraseña
@@ -91,37 +91,54 @@
       <button class="copy-btn" id="copy-btn">Copiar enlace</button>
     </div>
   </div>
+
+  <div id="loading" style="color:var(--muted);font-size:.95rem">Cargando…</div>
 </main>
 
 <script>
 (function () {
-  var HASH = '%%PASS_HASH%%';
+  var SESSION_KEY = 'aqnsn-gen-token';
-
-  async function sha256hex(str) {
-    var buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(str));
-    return Array.from(new Uint8Array(buf)).map(function (b) { return b.toString(16).padStart(2, '0'); }).join('');
-  }
-
   var loginPanel = document.getElementById('login-panel');
   var genPanel = document.getElementById('gen-panel');
   var loginForm = document.getElementById('login-form');
   var loginErr = document.getElementById('login-err');
   var pwd = document.getElementById('pwd');
+  var loading = document.getElementById('loading');
 
-  var SESSION_KEY = 'aqnsn-gen-auth';
+  function showLogin() { loading.hidden = true; loginPanel.hidden = false; }
-  try { if (sessionStorage.getItem(SESSION_KEY) === HASH) { loginPanel.hidden = true; genPanel.hidden = false; } } catch (e) {}
+  function showGen() { loading.hidden = true; loginPanel.hidden = true; genPanel.hidden = false; }
+
+  var stored = '';
+  try { stored = sessionStorage.getItem(SESSION_KEY) || ''; } catch (e) {}
+
+  if (stored) {
+    fetch('/api/gen-verify?t=' + encodeURIComponent(stored), { cache: 'no-store' })
+      .then(function (r) { return r.json(); })
+      .then(function (j) { j.ok ? showGen() : showLogin(); })
+      .catch(function () { showLogin(); });
+  } else {
+    showLogin();
+  }
 
   loginForm.addEventListener('submit', function (e) {
     e.preventDefault();
-    sha256hex(pwd.value).then(function (h) {
+    loginErr.textContent = 'Verificando…';
-      if (h === HASH) {
+    fetch('/api/gen-auth', {
-        try { sessionStorage.setItem(SESSION_KEY, h); } catch (e) {}
+      method: 'POST',
-        loginPanel.hidden = true; genPanel.hidden = false; loginErr.textContent = '';
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ pass: pwd.value })
+    })
+      .then(function (r) { return r.json(); })
+      .then(function (j) {
+        if (j.ok) {
+          try { sessionStorage.setItem(SESSION_KEY, j.token); } catch (e) {}
+          showGen();
         } else {
-        loginErr.textContent = 'Contraseña incorrecta.';
+          loginErr.textContent = j.error || 'Contraseña incorrecta.';
           pwd.value = ''; pwd.focus();
         }
-    });
+      })
+      .catch(function () { loginErr.textContent = 'Error de conexión.'; });
   });
 
   // --- Generador ---
@@ -133,18 +150,14 @@
   var resultUrl = document.getElementById('result-url');
   var copyBtn = document.getElementById('copy-btn');
 
-  function addDia(value) {
+  function addDia() {
     var row = document.createElement('div');
     row.className = 'dia-row';
     var inp = document.createElement('input');
     inp.type = 'datetime-local'; inp.className = 'dia-inp';
-    if (value) inp.value = value;
     var del = document.createElement('button');
     del.type = 'button'; del.className = 'del-dia'; del.textContent = '✕';
-    del.addEventListener('click', function () {
+    del.addEventListener('click', function () { row.remove(); actualizarAddBtn(); });
-      row.remove();
-      actualizarAddBtn();
-    });
     row.appendChild(inp); row.appendChild(del);
     diasList.appendChild(row);
     actualizarAddBtn();
@@ -154,7 +167,7 @@
     addDiaBtn.style.display = diasList.children.length >= 5 ? 'none' : '';
   }
 
-  addDia(); // una fila por defecto
+  addDia();
   addDiaBtn.addEventListener('click', function () { addDia(); });
 
   genForm.addEventListener('submit', function (e) {
@@ -170,8 +183,7 @@
       var v = inps[i].value;
       if (!v) continue;
       var ts = Math.round(new Date(v).getTime() / 1000);
-      if (isNaN(ts)) continue;
+      if (!isNaN(ts)) timestamps.push(ts);
-      timestamps.push(ts);
     }
     if (timestamps.length === 0) { genErr.textContent = 'Añade al menos un día.'; genErr.hidden = false; return; }