GET user-info instead of POST

docs/API.md

@@ -15,7 +15,7 @@ For integrating Paskia with your app frontend, see [integration](Integration.md)
 | Method | Path | Used for | Notes |
 |---:|---|---|---|
 | GET | `/auth/api/settings` | Paskia configuration | Returns RP info + base paths + session cookie name |
-| POST | `/auth/api/user-info` | Full user profile | Basic information, credentials, sessions, permissions |
+| GET | `/auth/api/user-info` | Full user profile | Basic information, credentials, sessions, permissions |
 | POST | `/auth/api/logout` | Terminate session and delete session cookie | Signs out of the current site |
 | POST | `/auth/api/validate` | Validate and renew session cookie | Optional query: `perm=` (repeatable), `max_age=` |
 | GET | `/auth/api/forward` | Validate access (Caddy/Nginx) | 204 on success; 401/403 otherwise (HTML if requested) |

docs/Integration.md

@@ -91,7 +91,7 @@ if (response.status === 401 || response.status === 403) {
 Get current user details:
 
 ```js
-const user = await apiJson('/auth/api/user-info', { method: 'POST' })
+const user = await apiJson('/auth/api/user-info', { method: 'GET' })
 // Returns: { uuid, display_name, credentials, sessions, permissions, ... }
 ```
 

e2e/tests/fixtures/passkey-helpers.ts

@@ -479,7 +479,7 @@ export async function getUserInfo(
   sessionToken: string
 ): Promise<UserInfo> {
   const cookieName = getSessionCookieName()
-  const response = await page.request.post(`${baseUrl}/auth/api/user-info`, {
+  const response = await page.request.get(`${baseUrl}/auth/api/user-info`, {
     headers: {
       'Cookie': `${cookieName}=${sessionToken}`,
     },

examples/index.html

@@ -27,7 +27,7 @@
             <div class="section">
                 <h2>API Mode (not leaving the page)</h2>
                 <p>For SPAs and fetch() calls - shows auth in an iframe overlay:</p>
-                <button onclick="apiCall('/auth/api/user-info', 'POST')">📋 Get User Info</button>
+                <button onclick="apiCall('/auth/api/user-info', 'GET')">📋 Get User Info</button>
                 <button onclick="apiCall('/auth/api/forward?max_age=10s')">🔄 Reauth (max_age=10s)</button>
                 <button onclick="apiCall('/auth/api/forward?perm=auth:admin')">🛡️ Admin Only</button>
                 <button onclick="logout()">🚪 Logout</button>

frontend/auth/App.vue

@@ -63,7 +63,7 @@ async function loadUserInfo() {
   try {
     const [validateData, userInfoData] = await Promise.all([
       apiJson('/auth/api/validate', { method: 'POST' }),
-      apiJson('/auth/api/user-info', { method: 'POST' })
+      apiJson('/auth/api/user-info', { method: 'GET' })
     ])
     store.userInfo = userInfoData
     store.ctx = validateData.ctx

frontend/src/stores/auth.js

@@ -87,7 +87,7 @@ export const useAuthStore = defineStore('auth', {
     },
     async loadUserInfo() {
       try {
-        this.userInfo = await apiJson('/auth/api/user-info', { method: 'POST' })
+        this.userInfo = await apiJson('/auth/api/user-info', { method: 'GET' })
         updateThemeFromSession(this.ctx)
         console.log('User info loaded:', this.userInfo)
       } catch (error) {

paskia/fastapi/api.py

@@ -203,7 +203,7 @@ async def get_settings():
     )
 
 
-@app.post("/user-info")
+@app.get("/user-info")
 async def api_user_info(
     request: Request,
     response: Response,

tests/test_api.py

@@ -230,12 +230,12 @@ class TestLogoutEndpoint:
 
 
 class TestUserInfoEndpoint:
-    """Tests for POST /auth/api/user-info"""
+    """Tests for GET /auth/api/user-info"""
 
     @pytest.mark.asyncio
     async def test_user_info_without_auth_returns_401(self, client: httpx.AsyncClient):
         """User info without session should return 401."""
-        response = await client.post("/auth/api/user-info")
+        response = await client.get("/auth/api/user-info")
         assert response.status_code == 401
 
     @pytest.mark.asyncio
@@ -243,7 +243,7 @@ class TestUserInfoEndpoint:
         self, client: httpx.AsyncClient, session_token: str, test_user
     ):
         """User info with valid session should return user data."""
-        response = await client.post(
+        response = await client.get(
             "/auth/api/user-info",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
@@ -258,7 +258,7 @@ class TestUserInfoEndpoint:
         self, client: httpx.AsyncClient, session_token: str
     ):
         """User info should include user's credentials."""
-        response = await client.post(
+        response = await client.get(
             "/auth/api/user-info",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
@@ -272,7 +272,7 @@ class TestUserInfoEndpoint:
         self, client: httpx.AsyncClient, session_token: str
     ):
         """User info should include user's active sessions."""
-        response = await client.post(
+        response = await client.get(
             "/auth/api/user-info",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )
@@ -286,7 +286,7 @@ class TestUserInfoEndpoint:
         self, client: httpx.AsyncClient, session_token: str
     ):
         """User info should include user's permissions."""
-        response = await client.post(
+        response = await client.get(
             "/auth/api/user-info",
             headers={**auth_headers(session_token), "Host": "localhost:4401"},
         )