Respond with 400 when no auth supplied to shared link request

lib/plausible_web/controllers/stats_controller.ex

@@ -144,6 +144,10 @@ defmodule PlausibleWeb.StatsController do
     end
   end
 
+  def shared_link(conn, _) do
+    render_error(conn, 400)
+  end
+
   def authenticate_shared_link(conn, %{"slug" => slug, "password" => password}) do
     shared_link =
       Repo.get_by(Plausible.Site.SharedLink, slug: slug)

test/plausible_web/controllers/stats_controller_test.exs

@@ -263,6 +263,11 @@ defmodule PlausibleWeb.StatsControllerTest do
       assert html_response(conn, 200) =~ "Site locked"
       refute String.contains?(html_response(conn, 200), "Back to my sites")
     end
+
+    test "renders bad request when no auth parameter supplied", %{conn: conn} do
+      conn = get(conn, "/share/example.com")
+      assert response(conn, 400) =~ "Bad Request"
+    end
   end
 
   describe "POST /share/:slug/authenticate" do