kriss/geniusrun
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

api: fix chi middleware-ordering panic in resolveUser registration

Browse Source 
r.Use(s.resolveUser) was registered after /session/me and /session/logout
had already been added to the same chi inline-mux group. Chi requires all
r.Use() calls on a mux to precede any route registration on it, or it
panics with "chi: all middlewares must be defined before routes on a mux"
(reproduced against the real chi v5.3.1 dependency). This meant
server.Router() would crash at startup, taking down every internal/api
test that builds a Router along with it.

Separately, since chi captures each route's middleware chain at
registration time, /session/me and /session/logout would never have run
resolveUser even without the panic -- so handleSessionMe's
has_profile/display_name logic could never see a resolved user on that
route.

Fix: move r.Use(s.resolveUser) immediately after
r.Use(auth.RequireSession(...)), before any route in the group is
registered, so the ordering is legal and resolveUser applies to
/session/me, /session/logout, and /setup alike.
This commit is contained in:
Kriss Vila
2026-07-25 18:02:49 +02:00
parent 4dceb03fc0
commit 2cda0adbf8
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
backend/internal/api/server.go
View File

@@ -50,11 +50,10 @@ func (s *Server) Router() http.Handler {
r.Group(func(r chi.Router) { r.Group(func(r chi.Router) {
r.Use(auth.RequireSession(s.Session.Secret)) r.Use(auth.RequireSession(s.Session.Secret))
r.Use(s.resolveUser)
r.Get("/session/me", s.handleSessionMe) r.Get("/session/me", s.handleSessionMe)
r.Post("/session/logout", s.handleSessionLogout) r.Post("/session/logout", s.handleSessionLogout)
r.Use(s.resolveUser)
r.Post("/setup", s.handleSetup) r.Post("/setup", s.handleSetup)
r.Route("/profile", func(r chi.Router) { r.Route("/profile", func(r chi.Router) {