From bf871cfde6d02c493899d80ffd428a5184eb3b2c Mon Sep 17 00:00:00 2001
From: AaronDewes <aaron.dewes@protonmail.com>
Date: Thu, 9 Jun 2022 05:41:15 +0000
Subject: [PATCH 1/2] Add set update channel script, make sure more routes are
 protected

---
 routes/v2/system.ts | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/routes/v2/system.ts b/routes/v2/system.ts
index 4e2c9bb..2a6c365 100644
--- a/routes/v2/system.ts
+++ b/routes/v2/system.ts
@@ -66,7 +66,7 @@ router.get('/get-update-details', auth.jwt, async (ctx, next) => {
   await next();
 });
 
-router.get('/update-status', async (ctx, next) => {
+router.get('/update-status', auth.jwt, async (ctx, next) => {
   ctx.body = await systemLogic.getUpdateStatus();
   await next();
 });
@@ -76,7 +76,7 @@ router.post('/update', auth.jwt, async (ctx, next) => {
   await next();
 });
 
-router.get('/backup-status', async (ctx, next) => {
+router.get('/backup-status', auth.jwt, async (ctx, next) => {
   ctx.body = await systemLogic.getBackupStatus();
   await next();
 });
@@ -111,21 +111,21 @@ router.get('/memory', async (ctx, next) => {
   await next();
 });
 
-router.get('/temperature', async (ctx, next) => {
+router.get('/temperature', auth.jwt, async (ctx, next) => {
   ctx.body = {
     temperature: await diskLogic.readJsonStatusFile('temperature'),
   };
   await next();
 });
 
-router.get('/uptime', async (ctx, next) => {
+router.get('/uptime', auth.jwt, async (ctx, next) => {
   ctx.body = {
     uptime: await diskLogic.readJsonStatusFile('uptime'),
   };
   await next();
 });
 
-router.get('/disk-type', async (ctx, next) => {
+router.get('/disk-type', auth.jwt, async (ctx, next) => {
   let externalStorage: 'nvme' | 'unknown' = 'unknown';
   try {
     const externalStorageUnformatted = await diskLogic.readTextStatusFile(
@@ -143,13 +143,20 @@ router.get('/disk-type', async (ctx, next) => {
   await next();
 });
 
-router.put('/update-channel', async (ctx, next) => {
+router.put('/update-channel', auth.jwt, async (ctx, next) => {
   typeHelper.isString(ctx.body.channel, ctx);
   await systemLogic.setUpdateChannel(ctx.body.channel as string);
   await next();
 });
 
-router.get('/', async (ctx, next) => {
+router.get('/update-channel', auth.jwt, async (ctx, next) => {
+  ctx.body = {
+    channel: constants.GITHUB_BRANCH,
+  };
+  await next();
+});
+
+router.get('/', auth.jwt, async (ctx, next) => {
   ctx.body = {os: constants.IS_CITADEL_OS ? 'Citadel OS' : 'unknown'};
   await next();
 });

From eea6eb670cbff3a4febfe767bf431ba73c4f852a Mon Sep 17 00:00:00 2001
From: Aaron Dewes <aaron.dewes@protonmail.com>
Date: Thu, 9 Jun 2022 12:10:21 +0200
Subject: [PATCH 2/2] Remove JWT from update status

---
 routes/v2/system.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/routes/v2/system.ts b/routes/v2/system.ts
index 2a6c365..cdef2c5 100644
--- a/routes/v2/system.ts
+++ b/routes/v2/system.ts
@@ -66,7 +66,7 @@ router.get('/get-update-details', auth.jwt, async (ctx, next) => {
   await next();
 });
 
-router.get('/update-status', auth.jwt, async (ctx, next) => {
+router.get('/update-status', async (ctx, next) => {
   ctx.body = await systemLogic.getUpdateStatus();
   await next();
 });