From 6ac3366ea93bb060e8be00a5d69ece7d5423266c Mon Sep 17 00:00:00 2001
From: treamz <treamz@gmail.com>
Date: Sun, 22 Mar 2026 00:28:32 +0300
Subject: [PATCH] =?UTF-8?q?Security:=20lock=20down=20API=20=E2=80=94=20onl?=
 =?UTF-8?q?y=20landing=20endpoints=20public?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Only /api/settings, /api/tools, /api/content/advantages|dashboard public
- All other /api/* require authentication (401)
- Moved API mount after auth middleware, public endpoints before
---
 lib/auth.js |  4 +++-
 server.js   | 11 +++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/lib/auth.js b/lib/auth.js
index 2c5447a..6e5e60f 100644
--- a/lib/auth.js
+++ b/lib/auth.js
@@ -4,12 +4,14 @@
  */
 
 const PUBLIC_PATHS = ['/', '/health', '/favicon.ico'];
-const PUBLIC_PREFIXES = ['/auth/', '/vendor/', '/placeholder-img/', '/api/', '/admin'];
+const PUBLIC_API = ['/api/settings', '/api/tools', '/api/content/advantages', '/api/content/dashboard'];
+const PUBLIC_PREFIXES = ['/auth/', '/vendor/', '/placeholder-img/', '/admin'];
 const PUBLIC_FILES = ['/shared.css', '/shared.js', '/landing.html'];
 
 function authMiddleware(req, res, next) {
   // Public paths
   if (PUBLIC_PATHS.includes(req.path)) return next();
+  if (PUBLIC_API.includes(req.path)) return next();
   if (PUBLIC_FILES.includes(req.path)) return next();
   if (PUBLIC_PREFIXES.some(p => req.path.startsWith(p))) return next();
 
diff --git a/server.js b/server.js
index 9547904..0415422 100755
--- a/server.js
+++ b/server.js
@@ -22,12 +22,19 @@ app.use(express.static('public'));
 // Auth routes (before auth middleware — public)
 app.use('/auth', require('./routes/auth'));
 
-// Public API (settings, tools, content — for landing page)
-app.use('/api', require('./routes/api'));
+// Public API (only specific endpoints for landing page)
+const apiRouter = require('./routes/api');
+app.get('/api/settings', apiRouter);
+app.get('/api/tools', apiRouter);
+app.get('/api/content/advantages', apiRouter);
+app.get('/api/content/dashboard', apiRouter);
 
 // Auth middleware (protects everything below)
 app.use(authMiddleware);
 
+// Protected API (all other /api/* routes)
+app.use('/api', apiRouter);
+
 // Health check (extended)
 const startTime = Date.now();
 app.get('/health', (req, res) => {