From 2cda0adbf8c9a845eda3728a8f5128206f3f415c Mon Sep 17 00:00:00 2001 From: Christophe Vila Date: Sat, 25 Jul 2026 18:02:49 +0200 Subject: [PATCH] api: fix chi middleware-ordering panic in resolveUser registration r.Use(s.resolveUser) was registered after /session/me and /session/logout had already been added to the same chi inline-mux group. Chi requires all r.Use() calls on a mux to precede any route registration on it, or it panics with "chi: all middlewares must be defined before routes on a mux" (reproduced against the real chi v5.3.1 dependency). This meant server.Router() would crash at startup, taking down every internal/api test that builds a Router along with it. Separately, since chi captures each route's middleware chain at registration time, /session/me and /session/logout would never have run resolveUser even without the panic -- so handleSessionMe's has_profile/display_name logic could never see a resolved user on that route. Fix: move r.Use(s.resolveUser) immediately after r.Use(auth.RequireSession(...)), before any route in the group is registered, so the ordering is legal and resolveUser applies to /session/me, /session/logout, and /setup alike. --- backend/internal/api/server.go | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/backend/internal/api/server.go b/backend/internal/api/server.go index 6464d33..b0a2686 100644 --- a/backend/internal/api/server.go +++ b/backend/internal/api/server.go @@ -50,11 +50,10 @@ func (s *Server) Router() http.Handler { r.Group(func(r chi.Router) { r.Use(auth.RequireSession(s.Session.Secret)) + r.Use(s.resolveUser) r.Get("/session/me", s.handleSessionMe) r.Post("/session/logout", s.handleSessionLogout) - - r.Use(s.resolveUser) r.Post("/setup", s.handleSetup) r.Route("/profile", func(r chi.Router) {