From a0f268b0d3f081cdd2b2ab72e424facacd999cd8 Mon Sep 17 00:00:00 2001
From: Dominic Ferrando <dominicf2001@gmail.com>
Date: Wed, 23 Apr 2025 14:23:25 -0400
Subject: [PATCH] Create admin only middleware

---
 internal/util/admins.go | 12 ++++++++++++
 web/main.go             |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/internal/util/admins.go b/internal/util/admins.go
index 7d93275..7a8fe66 100644
--- a/internal/util/admins.go
+++ b/internal/util/admins.go
@@ -3,6 +3,7 @@ package util
 import (
 	"crypto/rand"
 	"encoding/hex"
+	"net/http"
 	"sync"
 	"time"
 )
@@ -65,3 +66,14 @@ func HasExistingAdminSession(username string) bool {
 
 	return false
 }
+
+func AdminOnlyMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		c, err := r.Cookie("comfy_admin")
+		if err != nil || !IsAdminSessionValid(c.Value) {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/web/main.go b/web/main.go
index 3b8dccc..273a94f 100644
--- a/web/main.go
+++ b/web/main.go
@@ -70,7 +70,7 @@ func main() {
 	// -----------------
 
 	// INDEX PAGE
-	r.Get("/", func(w http.ResponseWriter, r *http.Request) {
+	r.With(util.AdminOnlyMiddleware).Get("/", func(w http.ResponseWriter, r *http.Request) {
 		views.Index().Render(r.Context(), w)
 	})