feat: share post to other apps

internal/middleware/auth.go

@@ -61,6 +61,39 @@ func RequireAuth(issuer *auth.Issuer, users *repository.UserRepo) func(http.Hand
 	}
 }
 
+// OptionalAuth is the soft-auth sibling of RequireAuth. Same logic, but
+// invalid / missing sessions don't reject the request — they just skip
+// the context population. Use it on routes that are reachable
+// anonymously but want to personalise the response when the viewer
+// happens to be signed in (e.g. `viewer_has_reshared` on a public
+// post).
+func OptionalAuth(issuer *auth.Issuer, users *repository.UserRepo) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			raw := auth.Read(r)
+			if raw == "" {
+				next.ServeHTTP(w, r)
+				return
+			}
+			claims, err := issuer.Parse(raw)
+			if err != nil {
+				next.ServeHTTP(w, r)
+				return
+			}
+			u, err := users.FindByID(r.Context(), claims.UserID)
+			if err != nil || u.TokenVersion != claims.TokenVersion {
+				// Stale or invalid session — proceed anonymously rather
+				// than failing the request. RequireAuth would 401 here.
+				next.ServeHTTP(w, r)
+				return
+			}
+			ctx := context.WithValue(r.Context(), userIDKey, claims.UserID)
+			ctx = context.WithValue(ctx, tokenVersionKey, claims.TokenVersion)
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
+
 // UserID returns the authenticated user's id from the request context.
 // Returns "" if RequireAuth has not run.
 func UserID(ctx context.Context) string {