#428

backend/spec/requests/users_spec.rb

@@ -13,6 +13,24 @@ RSpec.describe 'Users', type: :request do
     { 'X-Transfer-Code' => user.inheritance_code }
   end
 
+  describe 'GET /users/session' do
+    it 'requires authentication' do
+      get '/users/session'
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it 'returns public user fields without recording a visit' do
+      user = create(:user, name: 'SSR user')
+      expect {
+        get '/users/session', headers: auth_headers(user)
+      }.not_to change(UserIp, :count)
+
+      expect(response).to have_http_status(:ok)
+      expect(json).to eq('id' => user.id, 'name' => user.name, 'role' => user.role)
+      expect(response.body).not_to include(user.inheritance_code)
+    end
+  end
+
   describe 'POST /users' do
     it 'creates guest user, IpAddress and UserIp, and returns code' do
       expect {