(function(){
    const REDIRECT_TO = "/secret/index.html"; // <- Ziel hier anpassen
    // SHA-256("200416") = 6e65014740d620571badde6674b583f9dcca2caad9f3ed17b8aede12d46815de
    const OK_HASH_HEX = "6e65014740d620571badde6674b583f9dcca2caad9f3ed17b8aede12d46815de";

    const $in = document.getElementById("cg-input");
    const $btn = document.getElementById("cg-btn");
    const $msg = document.getElementById("cg-msg");

    function hex(buf){
      return [...new Uint8Array(buf)].map(b=>b.toString(16).padStart(2,"0")).join("");
    }
    async function sha256(text){
      const enc = new TextEncoder().encode(text);
      const digest = await crypto.subtle.digest("SHA-256", enc);
      return hex(digest);
    }
    function fail(msg="Falscher Code"){ $msg.textContent = msg; }
    function ok(){ window.location.href = REDIRECT_TO; }

    async function verify(){
      const v = ($in.value || "").trim();
      if (!v) return fail("Bitte Code eingeben");
      try{
        const h = await sha256(v);
        if (h === OK_HASH_HEX) ok(); else fail("Falscher Code");
      }catch(e){ fail("Fehler"); }
    }

    $btn.addEventListener("click", verify);
    $in.addEventListener("keydown", e => { if (e.key === "Enter") verify(); });
  })();