a18hvcryt: Delete the signed-in person's own post from its menu

src/lib/minnect.ts

@@ -1,4 +1,4 @@
-import { PROFILES_BASE_URL } from "./env";
+import { FEED_BASE_URL, PROFILES_BASE_URL } from "./env";
 import type { SessionPerson } from "./session-store";
 
 // Talks to the Minnect profiles host to turn an email + password into the
@@ -217,6 +217,23 @@ export async function revokeToken(
   }
 }
 
+/** `GET /api/v1/auth/me` on the feed host. Returns data.id, or null on any failure. */
+async function fetchFeedUserId(feedToken: string, doFetch: typeof fetch): Promise<string | null> {
+  try {
+    const res = await doFetch(`${FEED_BASE_URL}/api/v1/auth/me`, {
+      method: "GET",
+      headers: jsonHeaders(feedToken),
+    });
+    if (res.status !== 200) return null;
+    const id = asRecord(asRecord(await parseJson(res)).data).id;
+    if (typeof id === "string" && id.length > 0) return id;
+    if (typeof id === "number" && Number.isFinite(id)) return String(id);
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Runs the three-call sign-in: login -> auth/me -> feed-token exchange.
  * Returns the person to show and the tokens to store server-side.
@@ -278,8 +295,12 @@ export async function loginToMinnect(
     options,
   );
 
+  // 4. The person's id on the feed, used to decide who may delete a post.
+  // Best-effort: without it no delete control is offered.
+  const feedUserId = await fetchFeedUserId(feedAccessToken, doFetch);
+
   return {
-    person: { userId, name, email: personEmail, pictureUrl },
+    person: { userId, name, email: personEmail, pictureUrl, feedUserId },
     tokens: {
       profileAccessToken,
       profileAccessTokenExpiresAt,