Restricting the API access to logged in admins. Only admin log in is publicly accessible.

lib/beet_round_server_web/router.ex

@@ -20,21 +20,27 @@ defmodule BeetRoundServerWeb.Router do
     plug :accepts, ["json"]
   end
 
+  pipeline :admin do
+    plug :fetch_api_admin
+  end
+
   scope "/", BeetRoundServerWeb do
     pipe_through :browser
 
     get "/", PageController, :home
   end
 
+  ### API ###
   scope "/api", BeetRoundServerWeb do
     pipe_through :api
+
     post "/log_in", AdminController, :log_in
-    post "/admin_create", AdminController, :create
+    # post "/admin_create", AdminController, :create
   end
 
-  # Other scopes may use custom stacks.
+  ### protected API ###
   scope "/api", BeetRoundServerWeb do
-    pipe_through :api
+    pipe_through [:api, :admin]
 
     get "/", DefaultApiController, :index