From 1c289533947d0f5c1d26500d0781128a63027f71 Mon Sep 17 00:00:00 2001
From: Etienne Delvarre <etiennedelvarre@Mac-mini-de-Etienne.local>
Date: Thu, 28 May 2026 13:49:14 +0200
Subject: [PATCH] =?UTF-8?q?Fix=20auth=20gate=20=E2=80=94=20protect=20index?=
 =?UTF-8?q?.html=20behind=20login?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server.js | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/server.js b/server.js
index b541aca..d51ba2d 100644
--- a/server.js
+++ b/server.js
@@ -142,11 +142,8 @@ app.post('/api/reorder', requireAuth, async (req, res) => {
   }
 });
 
-// Static files
-app.use(express.static(path.join(__dirname, 'public')));
-
-// SPA fallback
-app.get('*', (req, res) => {
+// Auth gate — redirect to login page if not authenticated
+app.get('/', (req, res) => {
   if (isAuth(req)) {
     res.sendFile(path.join(__dirname, 'public', 'index.html'));
   } else {
@@ -154,4 +151,7 @@ app.get('*', (req, res) => {
   }
 });
 
+// Static files (login.html is public, index.html is gated above)
+app.use(express.static(path.join(__dirname, 'public'), { index: false }));
+
 app.listen(PORT, () => console.log(`TdB RdB — port ${PORT}`));