404 on invalid user

1 files changed, 9 insertions, 0 deletions

diff --git a/src/hooks/index.js b/src/hooks/index.js
index 6a9c8ec5..2284d88d 100644
--- a/src/hooks/index.js
+++ b/src/hooks/index.js
@@ -1,6 +1,10 @@
 import cookie from 'cookie';
+import { get } from '$lib/utils';
+import { protectedRoutes } from '$lib/utils';
+
 export async function handle({ event, resolve }) {
 	let {
+		params,
 		request: { headers }
 	} = event;
 
@@ -8,6 +12,11 @@ export async function handle({ event, resolve }) {
 	let { token } = cookies;
 	event.locals = { token };
 
+	if (protectedRoutes.find((p) => event.url.pathname.match(p))) {
+		let user = await get('/me', { accept: 'application/json', authorization: `Bearer ${token}` });
+		if (user.username !== params.username) throw new Error('user not found');
+	}
+
 	return resolve(event);
 }