feat: add current user to req

index.js

@@ -135,6 +135,20 @@ function makeLibs(structureId, console) {
   };
 }
 
+// A small, safe projection of the logged-in user for user-route sandboxes.
+// Returns null when nobody is logged in. Never leak the password hash or the
+// raw session — hand structures exactly what they need to say "hi <name>".
+function currentUserFor(req) {
+  const id = req && req.session && req.session.userId;
+  if (!id) return null;
+  try {
+    const u = model.getUserById(id);
+    return u ? { id: u.id, username: u.username } : null;
+  } catch (e) {
+    return null;
+  }
+}
+
 function bootstrapContext(structureId, routeId, initContext) {
   const structure = model.getStructure(structureId);
   const console = makeConsole(structureId, routeId);
@@ -246,6 +260,7 @@ wsRouter.ws("*", (ws, req) => {
     });
 
   ws.clients = clients;
+  req.currentUser = currentUserFor(req);
   ws.render = (template, context = {}) => {
     const structure = model.getStructure(route.structure_id);
     context.route = makeRoute(structure);
@@ -867,6 +882,11 @@ app.all("*", async (req, res) => {
       req.params = routeMatch.params;
       const route = routeMatch.route;
 
+      // Minimal, handcrafted view of the logged-in Bliss user for user routes.
+      // Deliberately NOT the raw session/user object — just {id, username} —
+      // so structures can greet whoever is logged in without exposing internals.
+      req.currentUser = currentUserFor(req);
+
       const structure = model.getStructure(route.structure_id);
 
       try {