Merge pull request #12 from lladawn/codex/production-privacy-encryption-gate

Gate pattern graph and encrypt user content

Author: lladawn

.env.example

@@ -1,4 +1,5 @@
 NEXT_PUBLIC_APP_URL=http://127.0.0.1:3000
+NEXT_ALLOWED_DEV_ORIGINS=
 NEXT_PUBLIC_ENABLE_ANALYTICS=false
 NEXT_PUBLIC_UMAMI_SRC=https://breathe-umami.vercel.app/script.js
 NEXT_PUBLIC_UMAMI_WEBSITE_ID=
@@ -11,6 +12,7 @@ SUPABASE_SERVICE_ROLE_KEY=
 
 # Server-only salts/secrets. Generate long random values before deploy.
 MUMBL_TOKEN_HASH_SECRET=
+MUMBL_CONTENT_ENCRYPTION_KEY=
 MUMBL_SIDE_QUEST_ENCRYPTION_KEY=
 CRON_SECRET=
 
@@ -19,8 +21,18 @@ OPENAI_API_KEY=
 OPENAI_MODEL_FIELD_NOTE=gpt-5.4-nano
 OPENAI_MAX_DAILY_DRAFTS=20
 
-# Server-only memory graph settings for private dump map sync/search.
-SUPERMEMORY_API_KEY=
+# Server-only pattern graph settings for private logged-in dump processing.
+NEXT_PUBLIC_ENABLE_PATTERN_GRAPH=false
+MUMBL_ENABLE_PATTERN_GRAPH=false
+OPENAI_SIGNAL_MODEL=gpt-5.4-nano
+ANTHROPIC_API_KEY=
+ANTHROPIC_INSIGHT_MODEL=claude-haiku-4-5-20251001
+MUMBL_PATTERN_GRAPH_FIRST_INSIGHT_AT=10
+MUMBL_PATTERN_GRAPH_INSIGHT_INTERVAL=25
+MUMBL_ENABLE_PATTERN_TEST_TOOLS=false
+
+# Deprecated Supermemory setting. Kept temporarily while old columns stay inert.
+# SUPERMEMORY_API_KEY=
 
 # Server-only Slack beta app settings.
 SLACK_CLIENT_ID=

README.md

@@ -35,6 +35,7 @@ http://127.0.0.1:3000/
 - Optional creator-managed room note after creation
 - Reads-first room view for published field notes, with legacy feed/wins routes kept for compatibility
 - Slack/private-dump to field-note to team-read loop
+- Private pattern graph for logged-in dumps, with pgvector-backed working map and private insight review
 - Phrase-based reactions with local or logged-in dedupe
 - Edit/delete for new room posts through per-post edit tokens, with optional logged-in continuity across browsers
 - Private dump and field-note edit/delete, including bulk cleanup for selected private dumps
@@ -68,13 +69,20 @@ Weekly heartbeat generation is scheduled through Vercel Cron in `vercel.json` an
 
 The current generator is deterministic/local and reads only published team-read posts (`posts.type = 'field_note'`). Private dumps, Slack history, hidden feed posts, and presence never feed the heartbeat. An AI provider can replace the generator later while keeping the anonymised published-read payload shape. Heartbeat history and vibe-over-time are displayed from stored heartbeat rows.
 
+## Pattern Graph
+
+Logged-in private dumps are processed asynchronously for private pattern features. OpenAI extracts signals and embeddings into Supabase pgvector-backed `dump_signals`; Anthropic generates milestone insights into `patterns`. Anonymous/session-only dumps are excluded. Pattern APIs are owner-scoped and must not expose source dump content.
+
+Users can review insights at `/patterns` and explore the working map at `/dump/map`. Local and staging can enable `MUMBL_ENABLE_PATTERN_TEST_TOOLS=true` for manual QA controls; production should keep it disabled. See [docs/pattern-graph.md](/Users/dawn/Code/mumbl-app/docs/pattern-graph.md).
+
 ## Backend Setup
 
 The frontend now uses these backend route handlers for spaces, posts, reactions, and room reads.
 
 1. Create a Supabase project.
 2. Copy `.env.example` to `.env.local`.
-3. Fill in `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`, `SUPABASE_SERVICE_ROLE_KEY`, `MUMBL_TOKEN_HASH_SECRET`, `MUMBL_SIDE_QUEST_ENCRYPTION_KEY`, and `CRON_SECRET`.
+3. Fill in `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`, `SUPABASE_SERVICE_ROLE_KEY`, `MUMBL_TOKEN_HASH_SECRET`, `MUMBL_CONTENT_ENCRYPTION_KEY`, `MUMBL_SIDE_QUEST_ENCRYPTION_KEY`, and `CRON_SECRET`.
+   Pattern graph work also needs `MUMBL_ENABLE_PATTERN_GRAPH=true`, `OPENAI_API_KEY`, `OPENAI_SIGNAL_MODEL`, `ANTHROPIC_API_KEY`, and `ANTHROPIC_INSIGHT_MODEL`.
 4. Authenticate the Supabase CLI with `npx supabase login`.
 5. Run `npm run db:link -- your-project-ref` or `npm run db:link -- https://your-project.supabase.co`.
    `npm run db:link:staging` reads `.env.local`; `npm run db:link:prod` reads `.env.production.local`.
@@ -87,6 +95,8 @@ Creator access starts with the local room creator token. When a logged-in creato
 
 Creators can delete test or unused rooms from the room danger zone. Deleting a room hard-deletes the room reads/feed signal, frees the slug, and leaves user-owned field notes in the author's dump with their room/post linkage cleared.
 
+User-entered and user-derived text is encrypted into per-row `encrypted_payload` JSON before it is stored. The rollout backfills existing rows, uses `0030_scrub_plaintext_content.sql` as a verification scrub, then `0031_drop_legacy_plaintext_content_columns.sql` removes the legacy plaintext columns. This is server-side field encryption, not end-to-end encryption: Mumbl route handlers can decrypt content when needed to render rooms, draft field notes, generate heartbeats, and serve owner-scoped private data.
+
 Until those variables exist, API routes return a setup `503`.
 
 ## Slack Beta Setup
@@ -101,13 +111,13 @@ In Slack app settings:
 - Slash command request URL: `https://mumbl.wtf/api/slack/commands`
 - Interactivity request URL: `https://mumbl.wtf/api/slack/interactions`
 - Event subscriptions request URL: `https://mumbl.wtf/api/slack/events`
-- Core bot scopes: `commands`, `users:read`, `users:read.email`
-- Optional team-read bot scopes: `chat:write`, `groups:write`, `groups:read`
+- Core bot scopes: `commands`, `users:read`, `users:read.email`, `im:write`, `chat:write`
+- Optional team-read bot scopes: `groups:write`, `groups:read`
 - Subscribe to bot events: `app_home_opened`, `member_joined_channel`
 
 Set `SLACK_CLIENT_ID`, `SLACK_CLIENT_SECRET`, `SLACK_SIGNING_SECRET`, and `MUMBL_SLACK_TOKEN_ENCRYPTION_KEY` in the deployment environment. Install through `/api/slack/install`.
 
-`/mumbl room platform team` creates a Mumbl room from Slack and returns a one-time creator handoff link for opening the room in a browser. `/mumbl start platform team` remains an alias. Slack-created rooms are auto-pinned and linked to creator ownership when Mumbl can match or later connect the Slack user to a Mumbl login. `/mumbl pin platform-team` explicitly adds a Mumbl room to that Slack user's publish list without tracking room membership, and best-effort invites them into the room's Mumbl-created Slack reads channel when one exists. App Home can draft, review, edit, publish private field notes to pinned Mumbl spaces, and manage personal pinned spaces. Optional team-read Slack posting is creator-enabled per room. If a creator switches it on, Mumbl starts an optional Slack permission upgrade that asks for `chat:write`, `groups:write`, and `groups:read` so it can create one private channel, post published team reads there, and auto-pin that Mumbl room when a connected user joins the Mumbl-created Slack channel. It still does not request Slack history scopes.
+`/mumbl room platform team` creates a Mumbl room from Slack and returns a one-time creator handoff link for opening the room in a browser. `/mumbl start platform team` remains an alias. Slack-created rooms are auto-pinned and linked to creator ownership when Mumbl can match or later connect the Slack user to a Mumbl login. `/mumbl pin platform-team` explicitly adds a Mumbl room to that Slack user's publish list without tracking room membership, and best-effort invites them into the room's Mumbl-created Slack reads channel when one exists. App Home can draft, review, edit, publish private field notes to pinned Mumbl spaces, and manage personal pinned spaces. Optional team-read Slack posting is creator-enabled per room. If a creator switches it on, Mumbl starts an optional Slack permission upgrade that asks for `groups:write` and `groups:read` so it can create one private channel, post published team reads there using the core `chat:write` scope, and auto-pin that Mumbl room when a connected user joins the Mumbl-created Slack channel. It still does not request Slack history scopes.
 
 Beta default: Slack team-read channels are private. A future public workspace channel option can use admin-approved Slack permissions such as `channels:manage`, only for creating the reads channel and still without history scopes.
 
@@ -132,6 +142,7 @@ GitHub Actions runs `npm ci` and `npm run build` on pushes and pull requests to
 
 Prompt rotation, heartbeat job queueing, rate limits, and pooler notes are documented in [docs/scaling.md](/Users/dawn/Code/mumbl-app/docs/scaling.md).
 Free-tier tradeoffs and future upgrade paths are documented in [docs/free-tier-compromises.md](/Users/dawn/Code/mumbl-app/docs/free-tier-compromises.md).
+Private pattern graph behavior, pgvector checks, and staging QA steps are documented in [docs/pattern-graph.md](/Users/dawn/Code/mumbl-app/docs/pattern-graph.md).
 
 ## Current Stack
 

app/api/auth/link-session/route.js

@@ -1,6 +1,7 @@
 import { badRequest, ok, serverError } from "../../../../src/server/http";
 import { hashToken } from "../../../../src/server/hash";
 import { resolveRequestOwner } from "../../../../src/server/auth";
+import { isMissingSavedRoomAccessTable } from "../../../../src/server/roomAccess";
 import { getSupabaseAdmin } from "../../../../src/server/supabase";
 import { cleanString } from "../../../../src/server/validation";
 
@@ -9,6 +10,7 @@ export async function POST(request) {
     const body = await request.json();
     const sessionToken = cleanString(body.sessionToken, 256);
     const creatorTokens = parseCreatorTokens(body.creatorTokens);
+    const roomAccessTokens = parseRoomAccessTokens(body.roomAccessTokens);
     const postEditTokens = parsePostEditTokens(body.postEditTokens);
     if (!sessionToken) return badRequest("session token is required");
 
@@ -20,8 +22,8 @@ export async function POST(request) {
       linkTable({ supabase, table: "dumps", owner }),
       linkTable({ supabase, table: "field_notes", owner }),
       linkTable({ supabase, table: "public_profiles", owner, tolerateMissing: true }),
-      linkTable({ supabase, table: "dump_insights", owner, tolerateMissing: true }),
       linkCreatorSpaces({ supabase, owner, creatorTokens }),
+      linkRoomAccess({ supabase, owner, roomAccessTokens }),
       linkPostEditTokens({ supabase, owner, postEditTokens }),
       linkReactions({ supabase, owner }),
     ]);
@@ -31,8 +33,8 @@ export async function POST(request) {
       dumps: updates[0],
       fieldNotes: updates[1],
       publicProfiles: updates[2],
-      dumpInsights: updates[3],
-      creatorSpaces: updates[4],
+      creatorSpaces: updates[3],
+      savedRooms: updates[4],
       editablePosts: updates[5],
       reactions: updates[6],
     });
@@ -63,6 +65,17 @@ function parsePostEditTokens(value) {
     .slice(0, 200);
 }
 
+function parseRoomAccessTokens(value) {
+  if (!Array.isArray(value)) return [];
+  return value
+    .map((item) => ({
+      slug: cleanString(item?.slug, 64),
+      token: cleanString(item?.token, 256),
+    }))
+    .filter((item) => item.slug && item.token)
+    .slice(0, 100);
+}
+
 async function linkCreatorSpaces({ supabase, owner, creatorTokens }) {
   if (!creatorTokens.length) return 0;
   let linked = 0;
@@ -97,6 +110,36 @@ async function linkPostEditTokens({ supabase, owner, postEditTokens }) {
   return linked;
 }
 
+async function linkRoomAccess({ supabase, owner, roomAccessTokens }) {
+  if (!roomAccessTokens.length || !owner.userId) return 0;
+  let linked = 0;
+  for (const item of roomAccessTokens) {
+    const tokenHash = hashToken(item.token);
+    const { data: space, error: spaceError } = await supabase
+      .from("spaces")
+      .select("id,read_token_hash")
+      .eq("slug", item.slug)
+      .eq("read_token_hash", tokenHash)
+      .maybeSingle();
+    if (spaceError) throw spaceError;
+    if (!space?.id) continue;
+
+    const { error } = await supabase.from("saved_room_access").upsert(
+      {
+        user_id: owner.userId,
+        space_id: space.id,
+        read_token_hash: tokenHash,
+        last_opened_at: new Date().toISOString(),
+      },
+      { onConflict: "user_id,space_id" },
+    );
+    if (isMissingSavedRoomAccessTable(error)) return linked;
+    if (error) throw error;
+    linked += 1;
+  }
+  return linked;
+}
+
 async function linkReactions({ supabase, owner }) {
   if (!owner.sessionTokenHash || !owner.userId) return 0;
   const authReactionHash = hashToken(`auth-reaction:${owner.userId}`);

app/api/cron/heartbeats/route.js

@@ -1,4 +1,5 @@
 import { makeHeartbeat } from "../../../../src/lib/heartbeat";
+import { decryptContentFields, decryptContentRows, encryptContentFields } from "../../../../src/server/encryption";
 import { getServerEnv } from "../../../../src/server/env";
 import { makeHeartbeatCardFields } from "../../../../src/server/heartbeatCard";
 import { badRequest, ok, serverError } from "../../../../src/server/http";
@@ -84,16 +85,18 @@ async function processHeartbeatJobs(supabase, weekOf) {
 async function generateHeartbeatForSpace(supabase, spaceId, weekOf) {
   const { data: space, error: spaceError } = await supabase.from("spaces").select("*").eq("id", spaceId).single();
   if (spaceError) throw spaceError;
+  const readableSpace = decryptContentFields("spaces", space, ["name", "description", "public_name"]);
 
   const { data: posts, error: postsError } = await supabase
     .from("posts")
-    .select("id,type,content")
+    .select("id,type,encrypted_payload")
     .eq("space_id", space.id)
     .eq("type", "field_note")
     .gte("created_at", weekOf + "T00:00:00.000Z");
   if (postsError) throw postsError;
+  const readablePosts = decryptContentRows("posts", posts || [], ["content", "display_name", "field_note_title"]);
 
-  const postIds = posts.map((post) => post.id);
+  const postIds = readablePosts.map((post) => post.id);
   const { data: reactions, error: reactionsError } = postIds.length
     ? await supabase.from("reactions").select("post_id,label").in("post_id", postIds)
     : { data: [], error: null };
@@ -104,40 +107,42 @@ async function generateHeartbeatForSpace(supabase, spaceId, weekOf) {
     return counts;
   }, {});
 
-  const anonymisedPosts = posts.map((post) => ({
+  const anonymisedPosts = readablePosts.map((post) => ({
     type: post.type,
     content: post.content,
     reaction_count: reactionCounts[post.id] || 0,
   }));
 
   const heartbeat = makeHeartbeat({
-    ...space,
-    vibe: space.vibe,
+    ...readableSpace,
+    vibe: readableSpace.vibe,
     posts: anonymisedPosts.map((post) => ({
       type: post.type,
       content: post.content,
       reactions: { total: Array.from({ length: post.reaction_count }) },
     })),
   });
-  const card = makeHeartbeatCardFields({ heartbeat, posts, reactions });
+  const card = makeHeartbeatCardFields({ heartbeat, posts: readablePosts, reactions });
 
   const { error: upsertError } = await supabase.from("heartbeats").upsert(
     {
       space_id: space.id,
       week_of: weekOf,
-      vibe_read: heartbeat.vibeRead,
-      digest: heartbeat.digest,
-      uplift: heartbeat.uplift,
-      vibe_word: card.vibeWord,
-      top_theme: card.topTheme,
       energy_level: card.energyLevel,
-      card_line: card.cardLine,
+      encrypted_payload: encryptContentFields("heartbeats", {
+        vibe_read: heartbeat.vibeRead,
+        digest: heartbeat.digest,
+        uplift: heartbeat.uplift,
+        vibe_word: card.vibeWord,
+        top_theme: card.topTheme,
+        card_line: card.cardLine,
+      }),
     },
     { onConflict: "space_id,week_of" },
   );
   if (upsertError) throw upsertError;
 
-  return { slug: space.slug, posts: anonymisedPosts.length };
+  return { slug: readableSpace.slug, posts: anonymisedPosts.length };
 }
 
 function currentMonday() {

app/api/dumps/[dumpId]/route.js

@@ -1,5 +1,7 @@
 import { badRequest, notFound, ok, serverError } from "../../../../src/server/http";
 import { applyOwnerFilter, assertExpectedAuthenticatedOwner, resolveRequestOwner } from "../../../../src/server/auth";
+import { cleanupPatternGraphAfterDumpDelete } from "../../../../src/server/dumpPatterns";
+import { encryptContentFields } from "../../../../src/server/encryption";
 import { makeLocalReflection, serializeDump } from "../../../../src/server/dumps";
 import { getSupabaseAdmin } from "../../../../src/server/supabase";
 import { cleanString } from "../../../../src/server/validation";
@@ -20,12 +22,24 @@ export async function PATCH(request, { params }) {
     const supabase = getSupabaseAdmin();
     const owner = await resolveRequestOwner({ request, sessionToken });
     assertExpectedAuthenticatedOwner(owner, expectsAuthenticatedOwner);
+    const { data: existingDump, error: existingError } = await applyOwnerFilter(
+      supabase.from("dumps").select("id,encrypted_payload").eq("id", dumpId),
+      owner,
+    ).single();
+    if (existingError?.code === "PGRST116") return notFound("dump not found");
+    if (existingError) throw existingError;
+    const aiReflection = wantsReflection ? makeLocalReflection(content) : null;
     const { data: dump, error } = await applyOwnerFilter(
       supabase
         .from("dumps")
         .update({
-          content,
-          ai_reflection: wantsReflection ? makeLocalReflection(content) : null,
+          encrypted_payload: {
+            ...(existingDump.encrypted_payload || {}),
+            ...encryptContentFields("dumps", {
+              content,
+              ai_reflection: aiReflection,
+            }),
+          },
           updated_at: new Date().toISOString(),
         })
         .eq("id", dumpId),
@@ -58,6 +72,9 @@ export async function DELETE(request, { params }) {
     const { error, count } = await applyOwnerFilter(supabase.from("dumps").delete({ count: "exact" }).eq("id", dumpId), owner);
     if (error) throw error;
     if (!count) return notFound("dump not found");
+    if (owner.userId) {
+      await cleanupPatternGraphAfterDumpDelete({ supabase, userId: owner.userId, dumpIds: [dumpId], source: "web" });
+    }
 
     return ok({ deleted: true });
   } catch (error) {