From 93ee721442e033d2b9f52057406f7a7c7e2bfdee Mon Sep 17 00:00:00 2001
From: Akshu121796 <akshata.zerosix@gmail.com>
Date: Tue, 28 Jul 2026 09:50:23 +0530
Subject: [PATCH] fix(security): remove plaintext password storage from login
 flow

---
 .../src/login.html                            | 24 +++++++++-----
 .../src/register.html                         |  2 +-
 .../Version_1_Frontend/src/login.html         | 33 +++----------------
 .../Version_1_Frontend/src/register.html      |  2 +-
 4 files changed, 23 insertions(+), 38 deletions(-)

diff --git a/Desktop/organchain-main/organchain-main/TransplantChain-Organ_Donation_Application-main/src/login.html b/Desktop/organchain-main/organchain-main/TransplantChain-Organ_Donation_Application-main/src/login.html
index 63a48da..e113f6b 100644
--- a/Desktop/organchain-main/organchain-main/TransplantChain-Organ_Donation_Application-main/src/login.html
+++ b/Desktop/organchain-main/organchain-main/TransplantChain-Organ_Donation_Application-main/src/login.html
@@ -241,14 +241,22 @@ <h3 class="text-lg font-extrabold text-slate-900 mb-1">Phase 2 Authentication</h
                     return;
                 }
                 
-                const registeredEmail = localStorage.getItem('registeredEmail');
-                const registeredPassword = localStorage.getItem('registeredPassword');
-                
-                if (registeredEmail && registeredPassword) {
-                    if (identifier !== registeredEmail || password !== registeredPassword) {
-                        showToast('Invalid Credentials. Please try again.', 'error');
-                        return;
-                    }
+                const response = await fetch('/api/auth/login', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json'
+                    },
+                    body: JSON.stringify({
+                        email: identifier,
+                        password
+                    })
+                });
+                const data = await response.json();
+
+
+                if (!response.ok) {
+                    showToast('Invalid credentials', 'error');
+                    return;
                 }
 
                 const btn = form.querySelector('button[type="submit"]');
diff --git a/Desktop/organchain-main/organchain-main/TransplantChain-Organ_Donation_Application-main/src/register.html b/Desktop/organchain-main/organchain-main/TransplantChain-Organ_Donation_Application-main/src/register.html
index 575541b..5544a41 100644
--- a/Desktop/organchain-main/organchain-main/TransplantChain-Organ_Donation_Application-main/src/register.html
+++ b/Desktop/organchain-main/organchain-main/TransplantChain-Organ_Donation_Application-main/src/register.html
@@ -349,7 +349,7 @@ <h4 class="text-sm font-extrabold text-slate-900 tracking-tight mb-1">Pledge Org
                 if (fname) localStorage.setItem('patientName', fname);
                 if (abha) localStorage.setItem('patientABHA', abha);
                 if (email) localStorage.setItem('registeredEmail', email);
-                if (pwd) localStorage.setItem('registeredPassword', pwd);
+                
 
                 // Show green toast success event
                 showToast('Account Created!', 'Redirecting to Login...', true);
diff --git a/Desktop/organchain-main/organchain-main/Version_1_Frontend/src/login.html b/Desktop/organchain-main/organchain-main/Version_1_Frontend/src/login.html
index e75c293..ad0de57 100644
--- a/Desktop/organchain-main/organchain-main/Version_1_Frontend/src/login.html
+++ b/Desktop/organchain-main/organchain-main/Version_1_Frontend/src/login.html
@@ -239,37 +239,14 @@ <h3 class="text-lg font-extrabold text-slate-900 mb-1">Phase 2 Authentication</h
                 }
                 
                 // Hackathon Link intercept
-                const registeredEmail = localStorage.getItem('registeredEmail');
-                const registeredPassword = localStorage.getItem('registeredPassword');
-                
-                // If the user registered recently via the UI demo, strictly check against those credentials
-                if (registeredEmail && registeredPassword) {
-                    if (identifier !== registeredEmail || password !== registeredPassword) {
+                if (activeRole === 'patient') {
+                    identifier = document.getElementById('patientIdentifier').value.trim();
+                    password = document.getElementById('patientPassword').value.trim();
+
+                    if (!identifier || !password) {
                         showToast('Invalid Credentials. Please try again.', 'error');
                         return;
                     }
-                    
-                    // Match found! Fast track to dashboard
-                    sessionStorage.setItem('userRole', 'patient');
-                    sessionStorage.setItem('abhaId', localStorage.getItem('patientABHA') || identifier);
-                    sessionStorage.setItem('userName', localStorage.getItem('patientName') || identifier);
-                    
-                    const btn = form.querySelector('button[type="submit"]');
-                    if (btn) {
-                        const btnText = btn.querySelector('.btn-text');
-                        const btnIcon = btn.querySelector('.btn-icon');
-                        const btnSpinner = btn.querySelector('.btn-spinner');
-                        
-                        if (btnText) btnText.textContent = 'Requesting Auth...';
-                        if (btnIcon) btnIcon.classList.add('hidden');
-                        if (btnSpinner) btnSpinner.classList.remove('hidden');
-                        btn.disabled = true;
-                        btn.classList.add('opacity-80', 'cursor-wait');
-                    }
-                    
-                    showToast('Authentication Successful! Redirecting...', 'success');
-                    setTimeout(() => { window.location.href = 'dashboard.html'; }, 1500);
-                    return;
                 }
 
             } else {
diff --git a/Desktop/organchain-main/organchain-main/Version_1_Frontend/src/register.html b/Desktop/organchain-main/organchain-main/Version_1_Frontend/src/register.html
index c7fe8ee..0bd924b 100644
--- a/Desktop/organchain-main/organchain-main/Version_1_Frontend/src/register.html
+++ b/Desktop/organchain-main/organchain-main/Version_1_Frontend/src/register.html
@@ -348,7 +348,7 @@ <h4 class="text-sm font-extrabold text-slate-900 tracking-tight mb-1">Pledge Org
                 if (fname) localStorage.setItem('patientName', fname);
                 if (abha) localStorage.setItem('patientABHA', abha);
                 if (email) localStorage.setItem('registeredEmail', email);
-                if (pwd) localStorage.setItem('registeredPassword', pwd);
+                
 
                 // Show green toast success event
                 showToast('Account Created!', 'Redirecting to Login...', true);