Publish current app and server

server/internal/api/update.go

@@ -9,7 +9,6 @@ import (
 	"time"
 
 	"github.com/ponzischeme89/memby/server/internal/appupdate"
-	"github.com/ponzischeme89/memby/server/internal/store"
 )
 
 // membyProtocolVersion changes only when the client/server wire contract is no longer
@@ -73,6 +72,11 @@ func clientProtocol(r *http.Request) string {
 	return strings.TrimSpace(r.Header.Get("X-Memby-Protocol"))
 }
 
+func clientProtocolNumber(r *http.Request) int {
+	reported, _ := strconv.Atoi(clientProtocol(r))
+	return reported
+}
+
 func compatibilityFor(r *http.Request) (bool, string) {
 	reported, err := strconv.Atoi(clientProtocol(r))
 	if err != nil || reported != membyProtocolVersion {
@@ -87,10 +91,10 @@ func compatibilityFor(r *http.Request) (bool, string) {
 
 // handleUpdate answers the client's version check.
 //
-// Its own endpoint rather than a field on /v1/home: the home payload is cached per user,
-// while this answer depends on the requesting client's version, so the two cannot share a
-// cache entry. It costs nothing — the policy is held in memory.
-func (s *Server) handleUpdate(w http.ResponseWriter, r *http.Request, _ store.Session) {
+// Its own public endpoint rather than a field on /v1/home: update policy belongs to the
+// app build, not a viewer or login. The only client input is its build-version header and
+// the answer comes from memory, so checking it never reads or mutates a user session.
+func (s *Server) handleUpdate(w http.ResponseWriter, r *http.Request) {
 	decision := appupdate.Decide(s.updatePolicy.get(), clientVersion(r))
 	writeJSON(w, http.StatusOK, decision)
 }