#428

backend/app/controllers/users_controller.rb

@@ -21,6 +21,12 @@ class UsersController < ApplicationController
     render json: { valid: true, user: user.slice(:id, :name, :inheritance_code, :role) }
   end
 
+  def session
+    return head :unauthorized unless current_user
+
+    render json: current_user.slice(:id, :name, :role)
+  end
+
   def renew
     return head :unauthorized unless current_user
 

backend/config/routes.rb

@@ -100,6 +100,7 @@ Rails.application.routes.draw do
     collection do
       post :verify
       get :me
+      get :session
       post 'code/renew', action: :renew
     end
   end

backend/spec/requests/users_spec.rb

@@ -13,6 +13,24 @@ RSpec.describe 'Users', type: :request do
     { 'X-Transfer-Code' => user.inheritance_code }
   end
 
+  describe 'GET /users/session' do
+    it 'requires authentication' do
+      get '/users/session'
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it 'returns public user fields without recording a visit' do
+      user = create(:user, name: 'SSR user')
+      expect {
+        get '/users/session', headers: auth_headers(user)
+      }.not_to change(UserIp, :count)
+
+      expect(response).to have_http_status(:ok)
+      expect(json).to eq('id' => user.id, 'name' => user.name, 'role' => user.role)
+      expect(response.body).not_to include(user.inheritance_code)
+    end
+  end
+
   describe 'POST /users' do
     it 'creates guest user, IpAddress and UserIp, and returns code' do
       expect {