From 942f5abf3ca1729ed071c13817187b67d343d298 Mon Sep 17 00:00:00 2001
From: IM23a-spirgif <spirgif@bzz.ch>
Date: Tue, 29 Apr 2025 15:58:14 +0200
Subject: [PATCH] Added 'Unauthorized' Page when accessing / without being
 logged in

---
 gambling.js              | 29 ++++++++++++++++++++++++-----
 public/unauthorized.html | 39 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 63 insertions(+), 5 deletions(-)
 create mode 100644 public/unauthorized.html

diff --git a/gambling.js b/gambling.js
index e9d3616..7ad33f6 100644
--- a/gambling.js
+++ b/gambling.js
@@ -111,11 +111,30 @@ app.post("/login", (request, response) => {
     response.json({username, token});
 });
 
-app.get("/", authenticateToken, (request, response) => {
-    /* #swagger.security = [{
-            "bearerAuth": []
-    }] */
-    response.sendFile(path.join(__dirname, "./public/home.html"));
+app.get("/", (req, res) => {
+    const token =
+        req.headers.authorization?.split(" ")[1] ||
+        req.cookies.authorization;
+
+    if (!token) {
+        return res.sendFile(path.join(__dirname, "./public/unauthorized.html"));
+    }
+
+    jwt.verify(token, process.env.TOKEN_SECRET, (err, user) => {
+        if (err) {
+            return res.sendFile(path.join(__dirname, "./public/unauthorized.html"));
+        }
+
+        const users = get_data();
+        const foundUser = users.find(u => u.username === user.username);
+
+        if (!foundUser || foundUser.token !== token) {
+            return res.sendFile(path.join(__dirname, "./public/unauthorized.html"));
+        }
+
+        req.user = user;
+        res.sendFile(path.join(__dirname, "./public/home.html"));
+    });
 });
 
 app.get("/balance", authenticateToken, (request, response) => {
diff --git a/public/unauthorized.html b/public/unauthorized.html
new file mode 100644
index 0000000..ffd8f12
--- /dev/null
+++ b/public/unauthorized.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Access Denied</title>
+  <style>
+    body {
+      background-color: #111;
+      color: #0f0;
+      font-family: Arial, sans-serif;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+      height: 100vh;
+      text-align: center;
+    }
+
+    a.button {
+      margin-top: 20px;
+      padding: 12px 24px;
+      background-color: #0f0;
+      color: #000;
+      font-weight: bold;
+      text-decoration: none;
+      border-radius: 8px;
+      box-shadow: 0 0 10px #0f0, 0 0 5px #0f0 inset;
+    }
+
+    a.button:hover {
+      background-color: #1f1;
+    }
+  </style>
+</head>
+<body>
+<h1>You must be logged in to access this page.</h1>
+<a href="/login" class="button">Go to Login</a>
+</body>
+</html>
\ No newline at end of file