diff --git a/public/public.html b/public/public.html
new file mode 100644
index 0000000..0aa1f88
--- /dev/null
+++ b/public/public.html
@@ -0,0 +1,170 @@
+
+
+
+
+
+Révfülöp · Nyaraló Elérhetőség
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/server.js b/server.js
index 7907445..b424b0b 100644
--- a/server.js
+++ b/server.js
@@ -76,8 +76,8 @@ function getMember(req) {
function authMiddleware(req, res, next) {
if (!AUTH_ENABLED) return next();
- // Skip auth for login, auth-status, and members endpoints
- if (req.path === '/api/login' || req.path === '/api/auth-status' || req.path === '/api/members' || req.path === '/api/config') return next();
+ // Skip auth for login, auth-status, members, config, and public endpoints
+ if (req.path === '/api/login' || req.path === '/api/auth-status' || req.path === '/api/members' || req.path === '/api/config' || req.path === '/api/public/bookings' || req.path === '/public') return next();
const token = req.headers['x-auth-token'];
if (token && sessions.has(token)) {
@@ -198,6 +198,17 @@ app.delete('/api/comments/:id', (req, res) => {
res.json({ success: true });
});
+// Public bookings endpoint - returns only dates, no member info
+app.get('/api/public/bookings', (req, res) => {
+ const bookings = db.prepare('SELECT start_date, end_date FROM bookings ORDER BY start_date').all();
+ res.json(bookings);
+});
+
+// Public calendar page (no auth)
+app.get('/public', (req, res) => {
+ res.sendFile(path.join(__dirname, 'public', 'public.html'));
+});
+
// Serve static frontend
app.use(express.static(path.join(__dirname, 'public')));
app.get('*', (req, res) => {