allow for a starting date and hidden hunt if it hasnt started

src/routes/hunts.js

@@ -10,10 +10,16 @@ router.get('/hunt/:shortName', (req, res) => {
     return res.status(404).render('error', { title: 'Not Found', message: 'Hunt not found.' });
   }
 
+  // Block access if hidden and not started (unless admin/organizer)
+  if (Hunts.isHidden(hunt) && !(req.session && (req.session.isAdmin || req.session.isOrganizer))) {
+    return res.status(404).render('error', { title: 'Not Found', message: 'Hunt not found.' });
+  }
+
   const packages = Packages.getByHunt(hunt.id);
   const isExpired = Hunts.isExpired(hunt);
+  const hasStarted = Hunts.hasStarted(hunt);
 
-  res.render('hunt/profile', { title: hunt.name, hunt, packages, isExpired });
+  res.render('hunt/profile', { title: hunt.name, hunt, packages, isExpired, hasStarted });
 });
 
 // ─── Hunt leaderboard ─────────────────────────────────────
@@ -23,6 +29,10 @@ router.get('/hunt/:shortName/leaderboard', (req, res) => {
     return res.status(404).render('error', { title: 'Not Found', message: 'Hunt not found.' });
   }
 
+  if (Hunts.isHidden(hunt) && !(req.session && (req.session.isAdmin || req.session.isOrganizer))) {
+    return res.status(404).render('error', { title: 'Not Found', message: 'Hunt not found.' });
+  }
+
   const perPage = 25;
   const page = Math.max(1, parseInt(req.query.page) || 1);
   const totalCount = Hunts.getLeaderboardCount(hunt.id);
@@ -128,7 +138,8 @@ router.post('/player/:username/password', requireAuth, (req, res) => {
 
 // ─── Browse all hunts ─────────────────────────────────────
 router.get('/hunts', (req, res) => {
-  const hunts = Hunts.getAll();
+  const allHunts = Hunts.getAll();
+  const hunts = allHunts.filter(h => !Hunts.isHidden(h));
   res.render('hunt/list', { title: 'All Hunts', hunts });
 });