neiam /gitgud

defmodule GitGudWeb.Api.Mobile.SessionController do
  @moduledoc """
  Who the presented token belongs to, and what it's allowed to do.

  The mobile client calls this right after a QR scan to confirm the
  pairing worked before it persists the credentials — and on every cold
  start, so a revoked token surfaces as "signed out" rather than as a
  string of failures on whichever screen happened to load first.
  """
  use GitGudWeb, :controller

  alias GitGud.Accounts.PersonalAccessToken
  alias GitGudWeb.Api.Mobile.JSON

  def me(conn, _params) do
    user = conn.assigns.api_user
    scopes = conn.assigns.api_scopes

    json(conn, %{
      "user" => Map.put(JSON.user(user), "email", user.email),
      "scopes" => scopes,
      "mobile" => PersonalAccessToken.mobile?(scopes),
      "instance" => %{
        "url" => GitGudWeb.Endpoint.url(),
        "name" => "GitGud"
      }
    })
  end
end