0.2.94

README.md

@@ -2,6 +2,18 @@
 
 RustPad is a collaborative Markdown editor with standalone notes and workspaces.
 
+## Release 0.2.94 — authentication session handling
+
+- `GET /api/auth/session` checks the visitor's login state: `200 {"authenticated":false,"session":null}` for guests, missing/expired cookies, or logged-out users; `200 {"authenticated":true,"session":{...}}` for a valid account session. The response is never cached. Expired cookies are cleared; valid session cookies are refreshed as before.
+- `GET /api/auth/me` remains a protected endpoint and returns `401` when unauthenticated. Other authenticated endpoints continue to use `401` for missing sessions.
+- Frontend pages now distinguish a logged-out visitor from a server/network failure while checking the session. Session expiry clears client state once and raises the existing expiry notification; unexpected errors no longer force logout.
+
+Run the frontend session regression tests from the project root with Node.js 22+:
+
+```bash
+node --experimental-vm-modules scripts/test_auth_session.mjs
+```
+
 ## Development setup
 
 ```bash