Phase 1-2 of server consolidation + security hardening

inventory-server/auth/server.js

@@ -156,6 +156,25 @@ app.get('/me', async (req, res) => {
   }
 });
 
+// Caddy forward_auth target: JWT signature check only, no DB hit.
+// Returns 200 with X-User-Id / X-User-Username on success, 401 otherwise.
+// Per-service middleware re-verifies the token independently; these headers
+// are informational and must not be trusted by upstreams.
+app.all('/verify', (req, res) => {
+  const header = req.headers.authorization;
+  if (!header || !header.startsWith('Bearer ')) {
+    return res.status(401).json({ error: 'No token provided' });
+  }
+  try {
+    const decoded = jwt.verify(header.slice(7), process.env.JWT_SECRET);
+    res.set('X-User-Id', String(decoded.userId));
+    if (decoded.username) res.set('X-User-Username', decoded.username);
+    res.status(200).end();
+  } catch (err) {
+    res.status(401).json({ error: err.name === 'TokenExpiredError' ? 'Token expired' : 'Invalid token' });
+  }
+});
+
 // Mount all routes from routes.js
 app.use('/', authRoutes);