fixes

server.js

@@ -45,13 +45,14 @@ app.use(express.urlencoded({ extended: true })); // Parse URL-encoded request bo
 app.use(express.static(path.join(__dirname, 'public')));
 
 // --- API Routes ---
+// Public Routes (or routes where auth is handled internally/conditionally)
 app.use('/api/auth', authRoutes);
-// Apply authentication middleware to protected routes
-app.use('/api/tournaments', authenticateToken, tournamentRoutes);
-app.use('/api/players', authenticateToken, playerRoutes);
-app.use('/api/matches', authenticateToken, matchRoutes);
-app.use('/api/users', authenticateToken, userRoutes);
-// Add other protected API routes here
+app.use('/api/tournaments', tournamentRoutes); // GET is public, POST/PUT/DELETE require auth (handled in router)
+app.use('/api/players', playerRoutes);       // GET is public, POST/PUT/DELETE require auth (handled in router)
+app.use('/api/matches', matchRoutes);         // GET is public, POST/PUT/DELETE require auth (handled in router)
+
+// Protected Routes (require authentication for all methods)
+app.use('/api/users', authenticateToken, userRoutes); // All user management requires login
 
 // --- Root Route (Optional Redirect or Info) ---
 app.get('/', (req, res) => {