talk/routes/admin/index.js

const express = require('express');
const router = express.Router();
const csrf = require('csurf');

// setup route middlewares for CSRF protection
const csrfProtection = csrf({cookie: true});

// Get /password-reset expects a signed token (JWT) in the hash.
// Links to this endpoint are generated by /views/password-reset-email.ejs.
router.get('/password-reset', csrfProtection, (req, res, next) => {
  // TODO: store the redirect uri in the token or something fancy.
  // admins and regular users should probably be redirected to different places.
  res.render('password-reset', {redirectUri: process.env.TALK_ROOT_URL, csrfToken: req.csrfToken()});
});

router.get('*', csrfProtection, (req, res) => {
  res.render('admin', {basePath: '/client/coral-admin', csrfToken: req.csrfToken()});
});

module.exports = router;