From e655204064e0d7a3cd7796c98362a0b5c5c930fa Mon Sep 17 00:00:00 2001
From: Falkan <falkan@openclaw.local>
Date: Tue, 17 Mar 2026 20:45:07 -0400
Subject: [PATCH] fix: block direct /admin access when custom adminPath is
 configured

---
 data/units.json | 16 ++++++++++++++++
 src/hooks.ts    | 18 ++++++++++++++----
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/data/units.json b/data/units.json
index 554be37..d03b109 100644
--- a/data/units.json
+++ b/data/units.json
@@ -71,6 +71,22 @@
       "symbol": "mfcktn",
       "group": "dickloads",
       "toBase": 170.2399999998
+    },
+    {
+      "id": "shitload",
+      "label": "Shitload",
+      "labelPlural": "Shitloads",
+      "symbol": "shtld",
+      "group": "dickloads",
+      "toBase": 12.6666666667
+    },
+    {
+      "id": "shit-ton",
+      "label": "Shit ton",
+      "labelPlural": "Shit tons",
+      "symbol": "shttn",
+      "group": "dickloads",
+      "toBase": 25.3333333333
     }
   ],
   "groups": [
diff --git a/src/hooks.ts b/src/hooks.ts
index 81d10d3..37786cb 100644
--- a/src/hooks.ts
+++ b/src/hooks.ts
@@ -6,22 +6,32 @@ import type { Reroute } from '@sveltejs/kit';
 let adminPath = 'admin';
 try {
   const config = JSON.parse(fs.readFileSync(path.resolve('data', 'config.json'), 'utf8'));
-  adminPath = (config.adminPath ?? 'admin').replace(/^\/|\/$/g, '');
+  adminPath = (config.adminPath ?? 'admin').replace(/^\/|\/$/g, '') || 'admin';
 } catch {
   // config.json missing or unreadable — fall back to 'admin'
 }
 
+export { adminPath };
+
 /**
  * Rewrites /<adminPath>/... to /admin/... before SvelteKit resolves the route.
- * No-op when adminPath is 'admin' (the default).
+ * When adminPath is not 'admin', direct access to /admin is rewritten to /404
+ * so attackers cannot enumerate the admin URL.
  */
 export const reroute: Reroute = ({ url }) => {
-  if (adminPath === 'admin') return url.pathname;
-
   const prefix = `/${adminPath}`;
+
+  // Public path → internal /admin
   if (url.pathname === prefix || url.pathname.startsWith(prefix + '/')) {
     return '/admin' + url.pathname.slice(prefix.length);
   }
 
+  // Block direct /admin access when a custom path is configured
+  if (adminPath !== 'admin') {
+    if (url.pathname === '/admin' || url.pathname.startsWith('/admin/')) {
+      return '/404';
+    }
+  }
+
   return url.pathname;
 };