/** * Optional password auth middleware. * If AUTH_PASSWORD is set in .env, requires ?key= or session auth. * Static assets and health check are always public. */ const PUBLIC_PATHS = ['/health', '/favicon.ico']; function authMiddleware(req, res, next) { const password = process.env.AUTH_PASSWORD; // No password set — everything is public if (!password) return next(); // Always allow public paths and static assets if (PUBLIC_PATHS.includes(req.path)) return next(); if (req.path.startsWith('/vendor/')) return next(); // Check session if (req.session && req.session.authenticated) return next(); // Check query param if (req.query.key === password) { if (req.session) req.session.authenticated = true; return next(); } // Show login form for GET requests to pages if (req.method === 'GET' && !req.path.startsWith('/api/') && !req.path.startsWith('/download/')) { return res.status(401).send(` Login
`); } return res.status(401).json({ error: 'Unauthorized' }); } module.exports = authMiddleware;