5 files changed, 16 insertions, 9 deletions
diff --git a/src/hooks.server.js b/src/hooks.server.js
index a5b1eef3..cfe64cbc 100644
--- a/src/hooks.server.js
+++ b/src/hooks.server.js
@@ -1,16 +1,23 @@
-import { auth, get } from '$lib/utils';
+import { auth, get, protectedRoutes } from '$lib/utils';
 
 export async function handle({ event, resolve }) {
 	let token = event.cookies.get('token');
+	let { params, url } = event;
 
+	let user;
 	if (token) {
 		try {
-			event.locals.user = await get('/me', auth(event.cookies));
+			user = await get('/me', auth(event.cookies));
+			event.locals.user = user;
 		} catch (e) {
 			console.log('failed to get user', e);
 		}
 	}
 
+	if (protectedRoutes.find((p) => url.pathname.match(p))) {
+		if (user?.username !== params.username) return Response.redirect(url.origin + '/login', 307);
+	}
+
 	const response = await resolve(event);
 
 	return response;
diff --git a/src/lib/utils.js b/src/lib/utils.js
index e2c8f955..c33b1cf9 100644
--- a/src/lib/utils.js
+++ b/src/lib/utils.js
@@ -65,7 +65,6 @@ export function reverseFormat(val, locale) {
 }
 
 export let protectedRoutes = [
-	/receive/,
 	/customers/,
 	/dashboard/,
 	/settings/,
diff --git a/src/routes/(app)/+layout.server.js b/src/routes/(app)/+layout.server.js
index 6d1fc3e0..6e17aaae 100644
--- a/src/routes/(app)/+layout.server.js
+++ b/src/routes/(app)/+layout.server.js
@@ -12,15 +12,11 @@ export async function load({ cookies, locals, request, url, params }) {
 	let rates;
 	let subject;
 
-	if (params.username) {
-		subject = await get(`/users/${params.username}`);
-	}
-
 	if (token && token !== 'undefined') {
 		user = locals.user;
 
 		if (protectedRoutes.find((p) => url.pathname.match(p))) {
-			if (user.username !== params.username) throw error(404, 'user not found');
+			if (user.username !== params.username) throw redirect(307, '/login');
 		}
 
 		if (['/login', '/register'].includes(url.pathname))
diff --git a/src/routes/(app)/[username]/+layout.server.js b/src/routes/(app)/[username]/+layout.server.js
new file mode 100644
index 00000000..e875b5e6
--- /dev/null
+++ b/src/routes/(app)/[username]/+layout.server.js
@@ -0,0 +1,5 @@
+import { get } from '$lib/utils';
+
+export let load = async ({ params: { username } }) => ({
+	subject: await get(`/users/${username}`)
+});
diff --git a/src/routes/(app)/[username]/+page.svelte b/src/routes/(app)/[username]/+page.svelte
index 810fb567..fb22c828 100644
--- a/src/routes/(app)/[username]/+page.svelte
+++ b/src/routes/(app)/[username]/+page.svelte
@@ -77,7 +77,7 @@
 			</button>
 		</div>
 		<p class="text-center">
-			This is a <a href="https://lightningaddress.com/" class="underline" target="_blank"
+			This is a <a href="https://lightningaddress.com/" class="underline" target="_blank" rel="noreferrer"
 				>lightning address</a
 			>
 		</p>