2 files changed, 24 insertions, 3 deletions

diff --git a/routes/admin.js b/routes/admin.js
index 35b208b..bdd4f9b 100644
--- a/routes/admin.js
+++ b/routes/admin.js
@@ -7,7 +7,9 @@ var passport = require('passport');
 var csrfProtection = csrf();
 router.use(csrfProtection); // router is protected
 
-router.get('/', function(req,res){
+
+
+router.get('/', isAdmin, function(req,res){
     res.render('admin', {csrfToken: req.csrfToken()});
 });
 
@@ -102,3 +104,13 @@ function parseStringArray(input){
 
 module.exports = router;
 
+
+/************** Route protection ********************/
+
+function isAdmin(req, res, next) {
+    if (!req.user.email){
+        return next();
+    }
+    res.redirect('/');
+}
+
diff --git a/routes/user.js b/routes/user.js
index 6167713..325b8ff 100644
--- a/routes/user.js
+++ b/routes/user.js
@@ -13,7 +13,7 @@ router.get('/logout', loggedIn, function (req, res, next) {
 });
 
 /* Render/GET user_profile page */
-router.get('/user_profile', loggedIn, function(req, res, next) {
+router.get('/user_profile', loggedIn, isUser, function(req, res, next) {
     res.render('user_profile_alt');
 });
 
@@ -93,6 +93,8 @@ router.post('/signin', loggedOut, function(req, res, next) {
 
 module.exports = router;
 
+/************** Route protection ********************/
+
 function loggedIn(req, res, next) {
     if (req.isAuthenticated()) {
         return next();
@@ -105,4 +107,11 @@ function loggedOut(req, res, next) {
         return next();
     }
     res.redirect('/');
-}
\ No newline at end of file
+}
+
+function isUser(req, res, next) {
+    if (req.user.email) {
+        return next();
+    }
+    res.redirect('/admin');
+}