From b6adb7a3f0549dce83b0ab56936a8a5cc8a98987 Mon Sep 17 00:00:00 2001
From: Myron Blair <myronblair@outlook.com>
Date: Thu, 4 Jun 2026 18:58:12 +0000
Subject: [PATCH] Blur credentials for non-master admins in game management

- Game list cards: login/password fields blurred with user-select/pointer-events
  disabled for non-master admins; URLs and guide remain readable
- View-only edit panel: credential fields blurred, copy button hidden for creds;
  URL fields retain open + copy buttons

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 admin/index.php | 44 +++++++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 21 deletions(-)

diff --git a/admin/index.php b/admin/index.php
index 61b1b91..f79d34a 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -2884,30 +2884,30 @@ async function loadGames() {
           </div>` : ''}
           ${g.agent_login ? `<div class="game-url-row">
             <span class="game-url-label" style="color:var(--purple)">LOGIN</span>
-            <span class="game-url-val">${escHtmlA(g.agent_login)}</span>
+            <span class="game-url-val" style="${IS_MASTER_ADMIN?'':'filter:blur(5px);user-select:none;pointer-events:none'}">${escHtmlA(g.agent_login)}</span>
           </div>` : ''}
           ${g.agent_password ? `<div class="game-url-row">
             <span class="game-url-label" style="color:var(--purple)">PASSWORD</span>
-            <span class="game-url-val">${escHtmlA(g.agent_password)}</span>
+            <span class="game-url-val" style="${IS_MASTER_ADMIN?'':'filter:blur(5px);user-select:none;pointer-events:none'}">${escHtmlA(g.agent_password)}</span>
           </div>` : ''}
           ${g.agent_guide ? `<div style="margin-top:6px;padding:8px 10px;background:rgba(155,93,229,0.07);border-radius:6px;font-size:12px;color:var(--text2);white-space:pre-wrap;max-height:80px;overflow:auto"><span style="color:var(--purple);font-weight:700;font-size:11px;letter-spacing:1px">AGENT GUIDE </span>${escHtmlA(g.agent_guide)}</div>` : ''}
           ${(g.sub_agent_login||g.sub_agent_password) ? `<div style="margin-top:4px;font-size:11px;font-weight:700;color:var(--purple);letter-spacing:1px;text-transform:uppercase;margin-bottom:2px">SUB-ACCOUNT</div>` : ''}
           ${g.sub_agent_login ? `<div class="game-url-row">
             <span class="game-url-label" style="color:var(--purple)">LOGIN</span>
-            <span class="game-url-val">${escHtmlA(g.sub_agent_login)}</span>
+            <span class="game-url-val" style="${IS_MASTER_ADMIN?'':'filter:blur(5px);user-select:none;pointer-events:none'}">${escHtmlA(g.sub_agent_login)}</span>
           </div>` : ''}
           ${g.sub_agent_password ? `<div class="game-url-row">
             <span class="game-url-label" style="color:var(--purple)">PASSWORD</span>
-            <span class="game-url-val">${escHtmlA(g.sub_agent_password)}</span>
+            <span class="game-url-val" style="${IS_MASTER_ADMIN?'':'filter:blur(5px);user-select:none;pointer-events:none'}">${escHtmlA(g.sub_agent_password)}</span>
           </div>` : ''}
           ${(g.cashier_login||g.cashier_password) ? `<div style="margin-top:4px;font-size:11px;font-weight:700;color:var(--cyan);letter-spacing:1px;text-transform:uppercase;margin-bottom:2px">CASHIER</div>` : ''}
           ${g.cashier_login ? `<div class="game-url-row">
             <span class="game-url-label" style="color:var(--cyan)">LOGIN</span>
-            <span class="game-url-val">${escHtmlA(g.cashier_login)}</span>
+            <span class="game-url-val" style="${IS_MASTER_ADMIN?'':'filter:blur(5px);user-select:none;pointer-events:none'}">${escHtmlA(g.cashier_login)}</span>
           </div>` : ''}
           ${g.cashier_password ? `<div class="game-url-row">
             <span class="game-url-label" style="color:var(--cyan)">PASSWORD</span>
-            <span class="game-url-val">${escHtmlA(g.cashier_password)}</span>
+            <span class="game-url-val" style="${IS_MASTER_ADMIN?'':'filter:blur(5px);user-select:none;pointer-events:none'}">${escHtmlA(g.cashier_password)}</span>
           </div>` : ''}
         </div>
       </div>
@@ -2970,15 +2970,15 @@ function editGame(id) {
     document.getElementById('gf-credit-btn').disabled = true;
 
     const agentFields = [
-      {label:'Agent Login',               key:'agent_login',          isUrl:false},
-      {label:'Agent Password',            key:'agent_password',       isUrl:false},
-      {label:'Agent Link',                key:'agent_link',           isUrl:true},
-      {label:'Games Link',                key:'games_link',           isUrl:true},
-      {label:'Agent Guide',               key:'agent_guide',          isUrl:false},
-      {label:'Sub-Account Agent Login',   key:'sub_agent_login',      isUrl:false},
-      {label:'Sub-Account Agent Password',key:'sub_agent_password',   isUrl:false},
-      {label:'Cashier Login',             key:'cashier_login',        isUrl:false},
-      {label:'Cashier Password',          key:'cashier_password',     isUrl:false},
+      {label:'Agent Login',               key:'agent_login',           isUrl:false, isCred:true},
+      {label:'Agent Password',            key:'agent_password',        isUrl:false, isCred:true},
+      {label:'Agent Link',                key:'agent_link',            isUrl:true,  isCred:false},
+      {label:'Games Link',                key:'games_link',            isUrl:true,  isCred:false},
+      {label:'Agent Guide',               key:'agent_guide',           isUrl:false, isCred:false},
+      {label:'Sub-Account Agent Login',   key:'sub_agent_login',       isUrl:false, isCred:true},
+      {label:'Sub-Account Agent Password',key:'sub_agent_password',    isUrl:false, isCred:true},
+      {label:'Cashier Login',             key:'cashier_login',         isUrl:false, isCred:true},
+      {label:'Cashier Password',          key:'cashier_password',      isUrl:false, isCred:true},
     ];
     const content = document.getElementById('gf-agent-view-content');
     content.innerHTML = agentFields.map(f => {
@@ -2988,14 +2988,16 @@ function editGame(id) {
           style="background:rgba(0,229,255,0.1);border:1px solid rgba(0,229,255,0.25);color:var(--cyan);border-radius:5px;padding:3px 9px;font-size:12px;font-weight:700;cursor:pointer;flex-shrink:0;text-decoration:none">
           ↗ Open
         </a>` : '';
-      return `<div style="display:flex;align-items:center;gap:8px;padding:7px 10px;background:rgba(155,93,229,0.05);border-radius:6px">
-        <span style="font-size:12px;font-weight:700;color:var(--purple);min-width:160px;flex-shrink:0">${escHtmlA(f.label)}</span>
-        <span style="flex:1;color:var(--text);font-size:14px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="${escHtmlA(val)}">${escHtmlA(val)}</span>
-        ${openBtn}
-        <button onclick="copyToClipboard(${JSON.stringify(val)},this)"
+      const valStyle = f.isCred ? 'filter:blur(5px);user-select:none;pointer-events:none' : '';
+      const copyBtn = f.isCred ? '' : `<button onclick="copyToClipboard(${JSON.stringify(val)},this)"
           style="background:rgba(155,93,229,0.15);border:1px solid rgba(155,93,229,0.3);color:var(--purple);border-radius:5px;padding:3px 10px;font-size:12px;font-weight:700;cursor:pointer;flex-shrink:0">
           📋 Copy
-        </button>
+        </button>`;
+      return `<div style="display:flex;align-items:center;gap:8px;padding:7px 10px;background:rgba(155,93,229,0.05);border-radius:6px">
+        <span style="font-size:12px;font-weight:700;color:var(--purple);min-width:160px;flex-shrink:0">${escHtmlA(f.label)}</span>
+        <span style="flex:1;color:var(--text);font-size:14px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;${valStyle}">${escHtmlA(val)}</span>
+        ${openBtn}
+        ${copyBtn}
       </div>`;
     }).join('');
     if (!content.innerHTML.trim()) {