From bebba79d9f7da1cd9870ce73412967acd270de21 Mon Sep 17 00:00:00 2001
From: Christian Heubaum <christian.heubaum@digiseed.de>
Date: Sun, 19 Apr 2026 11:25:06 +0000
Subject: [PATCH] Fix CORS-Preflight: Token als URL-Parameter

---
 admin.html | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/admin.html b/admin.html
index 249e28a..6c02dd1 100644
--- a/admin.html
+++ b/admin.html
@@ -243,6 +243,7 @@ const GITEA_RAW = 'http://72.60.134.73:3000/api/v1/repos/cheubaum/BNI-Vorstellun
 const GITEA_API = 'http://72.60.134.73:3000/api/v1/repos/cheubaum/BNI-Vorstellungsrunde';
 const CHAPTER_CONFIG_KEY = 'bni-active-chapter';
 function giteaUrl(path) { return `${GITEA_RAW}/${path}?ref=main`; }
+function giteaAuthUrl(path, token) { return `${GITEA_API}/contents/${path}?token=${encodeURIComponent(token)}`; }
 
 // ============================================================
 // CHAPTER CONFIG
@@ -530,11 +531,11 @@ async function uploadSvToGitea() {
     const path = `chapters/${activeChapter.code}/stammvertreter.json`;
     try {
         let sha = null;
-        const shaRes = await fetch(`${GITEA_API}/contents/${path}`, { headers: { Authorization: `token ${token}` } });
+        const shaRes = await fetch(giteaAuthUrl(path, token));
         if (shaRes.ok) sha = (await shaRes.json()).sha;
         const body = { message: 'Stammvertreter aktualisiert', content };
         if (sha) body.sha = sha;
-        const res = await fetch(`${GITEA_API}/contents/${path}`, { method: sha?'PUT':'POST', headers: { Authorization:`token ${token}`, 'Content-Type':'application/json' }, body: JSON.stringify(body) });
+        const res = await fetch(giteaAuthUrl(path, token), { method: sha?'PUT':'POST', headers: { 'Content-Type':'application/json' }, body: JSON.stringify(body) });
         if (res.ok) { statusEl.textContent = `✓ ${list.length} Stammvertreter gesichert`; statusEl.style.color = 'var(--success)'; }
         else { statusEl.textContent = 'Fehler beim Upload.'; statusEl.style.color = '#dc2626'; }
     } catch(e) { statusEl.textContent = 'Verbindungsfehler.'; statusEl.style.color = '#dc2626'; }
@@ -620,11 +621,11 @@ async function uploadMembersAdmin() {
     const path = `chapters/${activeChapter.code}/members.json`;
     try {
         let sha = null;
-        const shaRes = await fetch(`${GITEA_API}/contents/${path}`, { headers: { Authorization:`token ${token}` } });
+        const shaRes = await fetch(giteaAuthUrl(path, token));
         if (shaRes.ok) sha = (await shaRes.json()).sha;
         const body = { message:`Mitglieder aktualisiert ${new Date().toLocaleDateString('de')}`, content };
         if (sha) body.sha = sha;
-        const res = await fetch(`${GITEA_API}/contents/${path}`, { method:sha?'PUT':'POST', headers:{Authorization:`token ${token}`,'Content-Type':'application/json'}, body:JSON.stringify(body) });
+        const res = await fetch(giteaAuthUrl(path, token), { method:sha?'PUT':'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify(body) });
         if (res.ok) { statusEl.textContent = `✓ ${members.length} Mitglieder hochgeladen`; statusEl.style.color = 'var(--success)'; }
         else { statusEl.textContent = 'Fehler beim Upload.'; statusEl.style.color = '#dc2626'; }
     } catch(e) { statusEl.textContent = 'Verbindungsfehler.'; statusEl.style.color = '#dc2626'; }
@@ -684,11 +685,11 @@ async function pushVersionUpdate() {
     const content = btoa(unescape(encodeURIComponent(JSON.stringify({ version, notes }, null, 2))));
     try {
         let sha = null;
-        const shaRes = await fetch(`${GITEA_API}/contents/version.json`, { headers:{Authorization:`token ${token}`} });
+        const shaRes = await fetch(giteaAuthUrl('version.json', token));
         if (shaRes.ok) sha = (await shaRes.json()).sha;
         const body = { message:`Version ${version}`, content };
         if (sha) body.sha = sha;
-        const res = await fetch(`${GITEA_API}/contents/version.json`, { method:sha?'PUT':'POST', headers:{Authorization:`token ${token}`,'Content-Type':'application/json'}, body:JSON.stringify(body) });
+        const res = await fetch(giteaAuthUrl('version.json', token), { method:sha?'PUT':'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify(body) });
         if (res.ok) {
             statusEl.textContent = `✓ Version ${version} gepusht – alle Nutzer sehen das Update-Banner`;
             statusEl.style.color = 'var(--success)';