From d85800c8695771556e096073421d1d2fdc63f01c Mon Sep 17 00:00:00 2001
From: Admin <1+admin@noreply.git.dcntrlized.org>
Date: Sat, 15 Aug 2026 00:44:51 +0100
Subject: [PATCH] feat(auth): add /auth/me direct route and me GET action

- handlers/auth/proxy.go: new MeHandler proxies GET /auth/me to the
  shared auth service (boot revalidation for direct-mode clients).
- main.go: register /auth/me.
- actions/auth.go: Me proxies GET /action/me; Logout is method-aware
  (POST revokes via {refreshToken}, GET stays a bodyless no-op).
- action dispatcher: GET case me, POST case logout.
- go build + go vet clean.
---
 src/actions/auth.go                         | 18 ++++++++++++++++--
 src/handlers/actions/action__actionName_.go |  4 ++++
 src/handlers/auth/proxy.go                  |  8 ++++++++
 src/main.go                                 |  1 +
 4 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/src/actions/auth.go b/src/actions/auth.go
index 61dff05..3266a38 100644
--- a/src/actions/auth.go
+++ b/src/actions/auth.go
@@ -35,13 +35,27 @@ func Register(w http.ResponseWriter, r *http.Request, payload interface{}) {
 	authproxy.ProxyPayload(w, r, "register", payload)
 }
 
-// Logout proxies the GET action variant to /auth/logout (forwarded bodyless;
-// the auth service keeps GET a no-op).
+// Logout proxies the logout action: POST forwards {refreshToken} so the auth
+// service revokes the session (M5 client logout); GET stays a bodyless no-op
+// for the legacy transition.
 func Logout(w http.ResponseWriter, r *http.Request, payload interface{}) {
+	if r.Method == http.MethodPost {
+		Debug("logout", "POST", "proxying to auth service")
+		authproxy.ProxyPayload(w, r, "logout", payload)
+		return
+	}
 	Debug("logout", "GET", "proxying to auth service")
 	authproxy.ProxyEmpty(w, r, "logout")
 }
 
+// Me proxies the GET action variant to /auth/me. The X-Access-Token header is
+// forwarded unchanged so the auth service resolves the caller (boot
+// revalidation, M5).
+func Me(w http.ResponseWriter, r *http.Request) {
+	Debug("me", "GET", "proxying to auth service")
+	authproxy.Proxy(w, r, "me")
+}
+
 // Refresh proxies the Maestro-mode refresh action (M5 auto-refresh path).
 func Refresh(w http.ResponseWriter, r *http.Request, payload interface{}) {
 	Debug("refresh", "POST", "proxying to auth service")
diff --git a/src/handlers/actions/action__actionName_.go b/src/handlers/actions/action__actionName_.go
index 0133346..bf8cc7e 100644
--- a/src/handlers/actions/action__actionName_.go
+++ b/src/handlers/actions/action__actionName_.go
@@ -21,6 +21,8 @@ func ActionActionNameGet(w http.ResponseWriter, r *http.Request, params map[stri
 		actions.GetNote(w, r)
 	case "logout":
 		actions.Logout(w, r, nil)
+	case "me":
+		actions.Me(w, r)
 	default:
 		actions.Warn(action, "GET", "not implemented")
 		http.Error(w, "Action not implemented", http.StatusNotImplemented)
@@ -54,6 +56,8 @@ func ActionActionNamePost(w http.ResponseWriter, r *http.Request, params map[str
 		actions.Refresh(w, r, req.Payload)
 	case "delete":
 		actions.Delete(w, r, req.Payload)
+	case "logout":
+		actions.Logout(w, r, req.Payload)
 	default:
 		actions.Warn(action, "POST", "not implemented")
 		http.Error(w, "Action not implemented", http.StatusNotImplemented)
diff --git a/src/handlers/auth/proxy.go b/src/handlers/auth/proxy.go
index 1b6a21a..1277737 100644
--- a/src/handlers/auth/proxy.go
+++ b/src/handlers/auth/proxy.go
@@ -57,6 +57,14 @@ func RefreshHandler() http.HandlerFunc {
 	}
 }
 
+// MeHandler proxies GET /auth/me; the X-Access-Token header is forwarded
+// unchanged so the auth service resolves the caller (boot revalidation, M5).
+func MeHandler() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		authproxy.Proxy(w, r, "me")
+	}
+}
+
 // DeleteHandler proxies POST /auth/delete {password}; the X-Access-Token
 // header is forwarded unchanged by the proxy.
 func DeleteHandler() http.HandlerFunc {
diff --git a/src/main.go b/src/main.go
index 5a9ce74..b235c96 100644
--- a/src/main.go
+++ b/src/main.go
@@ -39,6 +39,7 @@ func main() {
 	mux.HandleFunc("/auth/register", auth.RegisterHandler())
 	mux.HandleFunc("/auth/logout", auth.LogoutHandler())
 	mux.HandleFunc("/auth/refresh", auth.RefreshHandler())
+	mux.HandleFunc("/auth/me", auth.MeHandler())
 	mux.HandleFunc("/auth/delete", auth.DeleteHandler())
 
 	mux.HandleFunc("/action/", func(w http.ResponseWriter, r *http.Request) {