fix: block direct /admin access when custom adminPath is configured

src/hooks.ts

@@ -6,22 +6,32 @@ import type { Reroute } from '@sveltejs/kit';
 let adminPath = 'admin';
 try {
   const config = JSON.parse(fs.readFileSync(path.resolve('data', 'config.json'), 'utf8'));
-  adminPath = (config.adminPath ?? 'admin').replace(/^\/|\/$/g, '');
+  adminPath = (config.adminPath ?? 'admin').replace(/^\/|\/$/g, '') || 'admin';
 } catch {
   // config.json missing or unreadable — fall back to 'admin'
 }
 
+export { adminPath };
+
 /**
  * Rewrites /<adminPath>/... to /admin/... before SvelteKit resolves the route.
- * No-op when adminPath is 'admin' (the default).
+ * When adminPath is not 'admin', direct access to /admin is rewritten to /404
+ * so attackers cannot enumerate the admin URL.
  */
 export const reroute: Reroute = ({ url }) => {
-  if (adminPath === 'admin') return url.pathname;
-
   const prefix = `/${adminPath}`;
+
+  // Public path → internal /admin
   if (url.pathname === prefix || url.pathname.startsWith(prefix + '/')) {
     return '/admin' + url.pathname.slice(prefix.length);
   }
 
+  // Block direct /admin access when a custom path is configured
+  if (adminPath !== 'admin') {
+    if (url.pathname === '/admin' || url.pathname.startsWith('/admin/')) {
+      return '/404';
+    }
+  }
+
   return url.pathname;
 };