var addFollowers = require('./follow');
var checkAuth = require('./check_auth');
var checkPrivilege = require('./privilege_check');
var githubOAuth = require('./github_oauth');
var users = require('./db').get('users');

module.exports = function(app) {

  app.get('/me', checkAuth, function(req, res) {
    checkPrivilege(req.session.user.login, function(err, privilege) {
      users.find({
        following: req.session.user.login
      }, function(err, following) {
        res.json({
          privilege: privilege,
          following: following
        });
      });
    });
  });

  app.get('/user', checkAuth, function(req, res) {
    return res.json(req.session.user);
  });

  app.post('/follow/:login', function(req, res) {
    if (!req.session.user) {
      return res.status(401).json({
        error: 'Not logged in'
      });
    }

    var amount = req.body.amount;
    if (!amount) {
      amount = 10;
    }

    addFollowers(req.session.user.login, -1, function(err, result) {
      res.json(result);
    });
  });

  githubOAuth.addRoutes(app, function(err, token, res, ignore, req) {
    if (token.error) {
      return res.send('There was an error logging in: ' + token.error_description);
    }
    req.session.token = token.access_token;
    res.redirect('/');
  });

};

@@ -707,16 +707,27 @@
 :login',
+ checkAuth,
  functio
@@ -744,21 +744,31 @@
 ) %7B%0A    
-if (!
+checkPrivilege(
 req.sess
@@ -779,86 +779,110 @@
 user
-) %7B%0A      return res.status(401).json(%7B%0A        error: 'Not logged 
+.login, function(err, privilege) %7B%0A      users.findOne(%7B%0A        login: req.session.user.log
 in
-'
 %0A      %7D
 );%0A 
@@ -881,18 +881,38 @@
    %7D
-);
+, function(error, user) %7B
 %0A    
-%7D%0A%0A
     
@@ -928,70 +928,50 @@
 t = 
-req.body.amount;%0A    if (!amount) %7B%0A      amount = 10
+privilege.following - user.following
 ;%0A    
-%7D%0A%0A
     
@@ -1011,10 +1011,14 @@
 in, 
--1
+amount
 , fu
@@ -1041,24 +1041,28 @@
 lt) %7B%0A      
+    
 res.json(res
@@ -1067,16 +1067,38 @@
 esult);%0A
+        %7D);%0A      %7D);%0A
     %7D);%0A

Add privilege check on follow button