Working version before modification.

src/app.js

@@ -1,9 +1,13 @@
+import cookieParser from 'cookie-parser';
 import cors from 'cors';
 import express from 'express';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 
 import { errorHandler, notFoundHandler } from './middleware/errorHandler.js';
+import { requireAdminAuth, requireUserAuth } from './middleware/authMiddleware.js';
+import adminRoutes from './routes/adminRoutes.js';
+import authRoutes from './routes/authRoutes.js';
 import configRoutes from './routes/configRoutes.js';
 import healthRoutes from './routes/healthRoutes.js';
 import lookupRoutes from './routes/lookupRoutes.js';
@@ -26,9 +30,12 @@ const publicDir = fileURLToPath(new URL('../public', import.meta.url));
 const userPagePath = path.join(publicDir, 'user.html');
 const adminPagePath = path.join(publicDir, 'admin.html');
 const portalPath = path.join(publicDir, 'portal.html');
+const loginAdminPath = path.join(publicDir, 'login-admin.html');
+const loginUserPath = path.join(publicDir, 'login-user.html');
 
 app.use(cors());
-app.use(express.json({ limit: '10mb' }));
+app.use(cookieParser());
+app.use(express.json({ limit: '50mb' }));
 
 app.get('/api/v1', (_req, res) => {
   res.json({
@@ -48,11 +55,23 @@ app.use('/api/v1/templates', templateRoutes);
 app.use('/api/v1/lookups', lookupRoutes);
 app.use('/api/v1/config', configRoutes);
 app.use('/api/v1/reports', reportRoutes);
+app.use('/api/v1/admin', adminRoutes);
+app.use('/api/v1/auth', authRoutes);
+
+/*
+ * Login pages are served without authentication.
+ */
+app.get('/login-admin', (_req, res) => {
+  res.sendFile(loginAdminPath);
+});
+
+app.get('/login-user', (_req, res) => {
+  res.sendFile(loginUserPath);
+});
 
 /*
  * The root route intentionally serves a neutral portal page. This gives the
- * project distinct user and administrator entry points without introducing a
- * full authentication flow yet.
+ * project distinct user and administrator entry points.
  */
 app.get('/', (_req, res) => {
   res.sendFile(portalPath);
@@ -60,14 +79,13 @@ app.get('/', (_req, res) => {
 
 /*
  * User and admin workspaces live in separate HTML files so each page only loads
- * the markup it needs. The shared frontend JavaScript (app.js) detects which
- * elements are present and binds behavior accordingly.
+ * the markup it needs. Authentication is required for both areas.
  */
-app.get(['/user', '/user/'], (_req, res) => {
+app.get(['/user', '/user/'], requireUserAuth, (_req, res) => {
   res.sendFile(userPagePath);
 });
 
-app.get(['/admin', '/admin/'], (_req, res) => {
+app.get(['/admin', '/admin/'], requireAdminAuth, (_req, res) => {
   res.sendFile(adminPagePath);
 });
 app.use(express.static(publicDir));