fix(auth): correct endpoint path /auth/me → /auth/users/me

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.3] - 2026-01-03
+
+### Fixed
+- Fixed auth endpoint path: `/auth/me` → `/auth/users/me`
+
 ## [1.0.2] - 2026-01-03
 
 ### Fixed

lib/core/auth/auth_datasource.dart

@@ -102,7 +102,7 @@ class AuthDatasource {
   /// Returns user profile if authenticated via the proxy.
   /// Throws 401 if not authenticated or accessing directly.
   Future<AuthSyncResponse> getCurrentUser() async {
-    final response = await _dio.get<Map<String, dynamic>>('/auth/me');
+    final response = await _dio.get<Map<String, dynamic>>('/auth/users/me');
     return AuthSyncResponse.fromJson(response.data!);
   }
 

lib/core/auth/auth_provider.dart

@@ -21,7 +21,7 @@ part 'auth_provider.g.dart';
 /// - **Web**: NPM forward auth with Authentik (cookies handled by proxy)
 /// - **Mobile**: OIDC Authorization Code flow with flutter_appauth
 ///
-/// On web, the app calls GET /auth/me to check if user is authenticated
+/// On web, the app calls GET /auth/users/me to check if user is authenticated
 /// via NPM forward auth headers. On mobile, uses OIDC flow then POST /auth/sync.
 @riverpod
 class AuthNotifier extends _$AuthNotifier {
@@ -59,7 +59,7 @@ class AuthNotifier extends _$AuthNotifier {
   /// Returns AuthState if authenticated, null if not.
   Future<AuthState?> _tryWebAuth() async {
     try {
-      developer.log('Attempting web auth via /auth/me', name: 'auth');
+      developer.log('Attempting web auth via /auth/users/me', name: 'auth');
       final authDatasource = ref.read(authDatasourceProvider);
       final syncResponse = await authDatasource.getCurrentUser();
 
@@ -238,7 +238,7 @@ class AuthNotifier extends _$AuthNotifier {
     // User needs to access via the authenticated proxy URL
     if (kIsWeb) {
       developer.log('Web sign-in: user should access via authenticated proxy', name: 'auth');
-      // Try to refresh auth state from /auth/me
+      // Try to refresh auth state from /auth/users/me
       state = const AsyncLoading();
       final webAuth = await _tryWebAuth();
       if (webAuth != null) {

pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.0.2+1
+version: 1.0.3+1
 
 environment:
   sdk: ^3.10.4