Christophe Vila
2cda0adbf8
r.Use(s.resolveUser) was registered after /session/me and /session/logout had already been added to the same chi inline-mux group. Chi requires all r.Use() calls on a mux to precede any route registration on it, or it panics with "chi: all middlewares must be defined before routes on a mux" (reproduced against the real chi v5.3.1 dependency). This meant server.Router() would crash at startup, taking down every internal/api test that builds a Router along with it. Separately, since chi captures each route's middleware chain at registration time, /session/me and /session/logout would never have run resolveUser even without the panic -- so handleSessionMe's has_profile/display_name logic could never see a resolved user on that route. Fix: move r.Use(s.resolveUser) immediately after r.Use(auth.RequireSession(...)), before any route in the group is registered, so the ordering is legal and resolveUser applies to /session/me, /session/logout, and /setup alike.