adding user confirmation for external domains

app-code/account/index.php

@@ -75,6 +75,9 @@ if (!isset($_SESSION["logged_in"]) || $_SESSION["logged_in"] !== true) {
               <li class="nav-item" role="presentation">
                 <a class="nav-link" id="message-tab" data-bs-toggle="tab" href="#message" role="tab" aria-controls="message" aria-selected="false"><span class="material-icons">message</span></a>
               </li>
+              <li class="nav-item" role="presentation">
+                <a class="nav-link" id="domains-tab" data-bs-toggle="tab" href="#domains" role="tab" aria-controls="domains" aria-selected="false"><span class="material-icons">language</span></a>
+              </li>
               <?php
               	if($_SESSION["permissions"][0]==="1"){
               		echo('<li class="nav-item" role="presentation">
@@ -173,6 +176,11 @@ if (!isset($_SESSION["logged_in"]) || $_SESSION["logged_in"] !== true) {
 		  <label class="form-check-label" for="message-switch">Enable login messages</label>
 		</div>
               </div>
+              <div class="tab-pane fade" id="domains" role="tabpanel" aria-labelledby="domains-tab">
+                <p>These external domains have been approved to receive your login data. You can revoke access at any time.</p>
+		<div id="confirmedDomainsList" class="list-group"></div>
+		<p id="noDomainsMessage" class="text-muted mt-3" style="display:none;">No external domains approved yet.</p>
+              </div>
             </div>
           </div>
         </div>
@@ -734,6 +742,53 @@ function generate2FAQRCode(issuer, accountName, secret) {
 			}
 		});
 	}
+
+	function loadConfirmedDomains() {
+		fetch('/api/account/manage_domains.php')
+			.then(r => r.json())
+			.then(data => {
+				const list = document.getElementById('confirmedDomainsList');
+				const noMsg = document.getElementById('noDomainsMessage');
+				list.innerHTML = '';
+				if (!data.domains || data.domains.length === 0) {
+					noMsg.style.display = 'block';
+					return;
+				}
+				noMsg.style.display = 'none';
+				data.domains.forEach(d => {
+					const item = document.createElement('div');
+					item.className = 'list-group-item d-flex justify-content-between align-items-center';
+					item.innerHTML = '<span><strong>' + d.domain + '</strong><br><small class="text-muted">Approved: ' + d.confirmed_at + '</small></span>' +
+						'<button class="btn btn-sm btn-outline-danger" onclick="removeDomain(' + d.id + ')">Revoke</button>';
+					list.appendChild(item);
+				});
+			});
+	}
+
+	function removeDomain(id) {
+		fetch('/api/account/manage_domains.php', {
+			method: 'POST',
+			headers: {
+				'Content-Type': 'application/json',
+				'X-CSRF-Token': window.csrfToken
+			},
+			body: JSON.stringify({ id: id })
+		}).then(r => r.json()).then(data => {
+			if (data.success) {
+				loadConfirmedDomains();
+				showSuccessModal('Domain access revoked.');
+			} else {
+				showErrorModal(data.message || 'Failed to revoke domain.');
+			}
+		});
+	}
+
+	document.addEventListener('DOMContentLoaded', function() {
+		const domainsTab = document.getElementById('domains-tab');
+		if (domainsTab) {
+			domainsTab.addEventListener('shown.bs.tab', loadConfirmedDomains);
+		}
+	});
   </script>
 
 </body>