added public calendar

server.js

@@ -76,8 +76,8 @@ function getMember(req) {
 function authMiddleware(req, res, next) {
   if (!AUTH_ENABLED) return next();
 
-  // Skip auth for login, auth-status, and members endpoints
-  if (req.path === '/api/login' || req.path === '/api/auth-status' || req.path === '/api/members' || req.path === '/api/config') return next();
+  // Skip auth for login, auth-status, members, config, and public endpoints
+  if (req.path === '/api/login' || req.path === '/api/auth-status' || req.path === '/api/members' || req.path === '/api/config' || req.path === '/api/public/bookings' || req.path === '/public') return next();
 
   const token = req.headers['x-auth-token'];
   if (token && sessions.has(token)) {
@@ -198,6 +198,17 @@ app.delete('/api/comments/:id', (req, res) => {
   res.json({ success: true });
 });
 
+// Public bookings endpoint - returns only dates, no member info
+app.get('/api/public/bookings', (req, res) => {
+  const bookings = db.prepare('SELECT start_date, end_date FROM bookings ORDER BY start_date').all();
+  res.json(bookings);
+});
+
+// Public calendar page (no auth)
+app.get('/public', (req, res) => {
+  res.sendFile(path.join(__dirname, 'public', 'public.html'));
+});
+
 // Serve static frontend
 app.use(express.static(path.join(__dirname, 'public')));
 app.get('*', (req, res) => {