1 files changed, 31 insertions, 0 deletions
diff --git a/modules/services/nixos/jta/main.go b/modules/services/nixos/jta/main.go
index 3e5fc1f..1390d7f 100644
--- a/modules/services/nixos/jta/main.go
+++ b/modules/services/nixos/jta/main.go
@@ -29,8 +29,28 @@ var styleCSS string
 //go:embed index.html
 var indexHTML string
 
+//go:embed assignments.html
+var assignmentsHTML string
+
 var pageTmpl = template.Must(template.New("md_template.html").Parse(mdTemplate))
 
+const authCookieName = "jta_auth"
+
+func isAuthenticated(r *http.Request) bool {
+	expectedHash := strings.TrimSpace(os.Getenv("AUTH_PASSWORD_HASH"))
+	if expectedHash == "" {
+		return false
+	}
+
+	cookie, err := r.Cookie(authCookieName)
+	if err != nil {
+		return false
+	}
+
+	providedHash := strings.TrimSpace(cookie.Value)
+	return strings.EqualFold(providedHash, expectedHash)
+}
+
 func serveMarkdown(w http.ResponseWriter, r *http.Request) {
 	// Prevent path traversal
 	clean := filepath.Clean(r.URL.Path)
@@ -81,6 +101,17 @@ func main() {
 			return
 		}
 
+		if !isAuthenticated(r) {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+
+		if r.URL.Path == "/assignments" || r.URL.Path == "/assignments.html" {
+			w.Header().Set("Content-Type", "text/html; charset=utf-8")
+			w.Write([]byte(assignmentsHTML))
+			return
+		}
+
 		// Intercept markdown files
 		if strings.HasSuffix(r.URL.Path, ".md") {
 			serveMarkdown(w, r)