feat: share post to other apps

internal/server/server.go

@@ -500,9 +500,15 @@ func (s *Server) setupRouter() {
 				r.HandleFunc("/*", s.authUnavailable)
 				return
 			}
-			// Public — read individual posts without auth.
-			r.Get("/{id}", s.postH.Get)
-			// Protected — create / delete / image presign / "my posts".
+			// Public read — anonymous-OK but populates viewer_id when a
+			// session cookie is present, so the response can include
+			// per-viewer fields like `viewer_has_reshared`.
+			r.Group(func(r chi.Router) {
+				r.Use(middleware.OptionalAuth(s.authIssuer, s.userRepo))
+				r.Get("/{id}", s.postH.Get)
+			})
+			// Protected — create / delete / image presign / "my posts" /
+			// reshare actions.
 			r.Group(func(r chi.Router) {
 				r.Use(middleware.RequireAuth(s.authIssuer, s.userRepo))
 				r.Post("/", s.postH.Create)
@@ -510,6 +516,11 @@ func (s *Server) setupRouter() {
 				r.Put("/{id}/images", s.postH.ReplaceImages)
 				r.Get("/mine", s.postH.ListMine)
 				r.Post("/image-presign", s.postH.ImagePresign)
+				// Reshare is auth-required: anonymous users can't claim
+				// to have reshared anything. The action is idempotent so
+				// double-clicks don't 4xx.
+				r.Post("/{id}/reshare", s.postH.Reshare)
+				r.Delete("/{id}/reshare", s.postH.Unreshare)
 			})
 		})
 
@@ -528,12 +539,18 @@ func (s *Server) setupRouter() {
 		// --- Social: collections ---
 		// The single-collection GET is the only route that may be hit
 		// anonymously (public collections); everything else needs auth.
+		// OptionalAuth on the GET lets us populate `viewer_has_reshared`
+		// on each post in the collection's carousel when a viewer is
+		// signed in, without rejecting anonymous traffic.
 		r.Route("/collections", func(r chi.Router) {
 			if s.collectionH == nil {
 				r.HandleFunc("/*", s.authUnavailable)
 				return
 			}
-			r.Get("/{id}", s.collectionH.Get)
+			r.Group(func(r chi.Router) {
+				r.Use(middleware.OptionalAuth(s.authIssuer, s.userRepo))
+				r.Get("/{id}", s.collectionH.Get)
+			})
 			r.Group(func(r chi.Router) {
 				r.Use(middleware.RequireAuth(s.authIssuer, s.userRepo))
 				r.Post("/", s.collectionH.Create)
@@ -549,11 +566,16 @@ func (s *Server) setupRouter() {
 		})
 
 		// --- Public profile + feed ---
+		// OptionalAuth populates viewer_id when a session cookie is
+		// present, so the feed can carry `viewer_has_reshared` on each
+		// post. Without a cookie the routes still respond — they just
+		// return the anonymous shape (all-false).
 		r.Route("/u", func(r chi.Router) {
 			if s.profileH == nil {
 				r.HandleFunc("/*", s.authUnavailable)
 				return
 			}
+			r.Use(middleware.OptionalAuth(s.authIssuer, s.userRepo))
 			r.Get("/{handle}", s.profileH.Get)
 			r.Get("/{handle}/feed", s.profileH.Feed)
 		})