Link room creator access to login

Author: lladawn

README.md

@@ -83,6 +83,8 @@ The frontend now uses these backend route handlers for spaces, posts, reactions,
 
 For dump login, enable Supabase Google OAuth and allow `/auth/callback` in the Supabase Auth redirect URLs for each environment, for example `http://127.0.0.1:3000/auth/callback` locally and `https://mumbl.wtf/auth/callback` in production. Email magic-link code is kept dormant for now; custom SMTP is recommended before exposing it again.
 
+Creator access starts with the local room creator token. When a logged-in creator presents that token, Mumbl links the room to their auth account so creator controls survive across browsers without tracking normal room membership.
+
 Until those variables exist, API routes return a setup `503`.
 
 ## Slack Beta Setup

app/api/auth/link-session/route.js

@@ -1,4 +1,5 @@
 import { badRequest, ok, serverError } from "../../../../src/server/http";
+import { hashToken } from "../../../../src/server/hash";
 import { resolveRequestOwner } from "../../../../src/server/auth";
 import { getSupabaseAdmin } from "../../../../src/server/supabase";
 import { cleanString } from "../../../../src/server/validation";
@@ -7,6 +8,7 @@ export async function POST(request) {
   try {
     const body = await request.json();
     const sessionToken = cleanString(body.sessionToken, 256);
+    const creatorTokens = parseCreatorTokens(body.creatorTokens);
     if (!sessionToken) return badRequest("session token is required");
 
     const owner = await resolveRequestOwner({ request, sessionToken });
@@ -18,6 +20,7 @@ export async function POST(request) {
       linkTable({ supabase, table: "field_notes", owner }),
       linkTable({ supabase, table: "public_profiles", owner, tolerateMissing: true }),
       linkTable({ supabase, table: "dump_insights", owner, tolerateMissing: true }),
+      linkCreatorSpaces({ supabase, owner, creatorTokens }),
     ]);
 
     return ok({
@@ -26,12 +29,41 @@ export async function POST(request) {
       fieldNotes: updates[1],
       publicProfiles: updates[2],
       dumpInsights: updates[3],
+      creatorSpaces: updates[4],
     });
   } catch (error) {
     return serverError(error);
   }
 }
 
+function parseCreatorTokens(value) {
+  if (!Array.isArray(value)) return [];
+  return value
+    .map((item) => ({
+      slug: cleanString(item?.slug, 64),
+      token: cleanString(item?.token, 256),
+    }))
+    .filter((item) => item.slug && item.token)
+    .slice(0, 50);
+}
+
+async function linkCreatorSpaces({ supabase, owner, creatorTokens }) {
+  if (!creatorTokens.length) return 0;
+  let linked = 0;
+  for (const item of creatorTokens) {
+    const { count, error } = await supabase
+      .from("spaces")
+      .update({ creator_user_id: owner.userId }, { count: "exact" })
+      .eq("slug", item.slug)
+      .eq("creator_token_hash", hashToken(item.token))
+      .is("creator_user_id", null);
+    if (isMissingColumnError(error)) return 0;
+    if (error) throw error;
+    linked += count || 0;
+  }
+  return linked;
+}
+
 async function linkTable({ supabase, table, owner, tolerateMissing = false }) {
   const { count, error } = await supabase
     .from(table)

app/api/spaces/[slug]/first-post-dismissed/route.js

@@ -1,29 +1,28 @@
 import { badRequest, notFound, ok, serverError } from "../../../../../src/server/http";
-import { hashToken } from "../../../../../src/server/hash";
+import { claimCreatorAccess, resolveCreatorAccess } from "../../../../../src/server/creatorAccess";
 import { getSupabaseAdmin } from "../../../../../src/server/supabase";
-import { cleanString } from "../../../../../src/server/validation";
 
 export async function POST(request, { params }) {
   try {
     const { slug } = await params;
     const body = await request.json();
-    const creatorToken = cleanString(body.creatorToken, 256);
 
     if (!slug) return badRequest("space slug is required");
-    if (!creatorToken) return badRequest("creator token is required");
 
     const supabase = getSupabaseAdmin();
     const { data: space, error: spaceError } = await supabase
       .from("spaces")
-      .select("id,creator_token_hash")
+      .select("id,creator_token_hash,creator_user_id")
       .eq("slug", slug)
       .single();
     if (spaceError?.code === "PGRST116") return notFound("space not found");
     if (spaceError) throw spaceError;
 
-    if (space.creator_token_hash !== hashToken(creatorToken)) {
+    const access = await resolveCreatorAccess({ request, body, space });
+    if (!access.canManage) {
       return badRequest("creator token did not match");
     }
+    if (access.shouldClaim) await claimCreatorAccess({ supabase, spaceId: space.id, userId: access.owner.userId });
 
     const { error: updateError } = await supabase.from("spaces").update({ first_post_done: true }).eq("id", space.id);
     if (updateError) throw updateError;

app/api/spaces/[slug]/route.js

@@ -1,4 +1,6 @@
 import { badRequest, notFound, ok, serverError } from "../../../../src/server/http";
+import { resolveRequestOwner } from "../../../../src/server/auth";
+import { claimCreatorAccess, resolveCreatorAccess } from "../../../../src/server/creatorAccess";
 import { hashToken } from "../../../../src/server/hash";
 import { getOrCreateKnownPublicRoom } from "../../../../src/server/demoRoom";
 import { getTopReactionLabels, startOfTodayIso } from "../../../../src/server/roomVibe";
@@ -18,6 +20,7 @@ export async function GET(request, { params }) {
     const url = new URL(request.url);
     const sessionToken = url.searchParams.get("sessionToken");
     const sessionTokenHash = sessionToken ? hashToken(sessionToken) : null;
+    const owner = await resolveRequestOwner({ request, sessionToken: cleanString(sessionToken, 256) });
     const postLimit = parsePostLimit(url.searchParams.get("limit"));
     const postCursor = parsePostCursor(url.searchParams.get("before"));
     const postType = parsePostType(url.searchParams.get("type"));
@@ -98,6 +101,7 @@ export async function GET(request, { params }) {
         {
           roomVibe: getTopReactionLabels(todayReactionsResult.data),
           slackTeamReads: slackTeamReadsResult.error ? null : slackTeamReadsResult.data,
+          canManage: Boolean(owner.userId && space.creator_user_id === owner.userId),
           postsPage: {
             limit: postLimit,
             count: postCount || 0,
@@ -140,7 +144,6 @@ export async function PATCH(request, { params }) {
   try {
     const { slug } = await params;
     const body = await request.json();
-    const creatorToken = cleanString(body.creatorToken, 256);
     const updates = {};
 
     if (Object.hasOwn(body, "isPublic")) {
@@ -154,21 +157,22 @@ export async function PATCH(request, { params }) {
     }
 
     if (!slug) return badRequest("space slug is required");
-    if (!creatorToken) return badRequest("creator token is required");
     if (!Object.keys(updates).length) return badRequest("no space settings to update");
 
     const supabase = getSupabaseAdmin();
     const { data: space, error: spaceError } = await supabase
       .from("spaces")
-      .select("id,creator_token_hash")
+      .select("id,creator_token_hash,creator_user_id")
       .eq("slug", slug)
       .single();
     if (spaceError?.code === "PGRST116") return notFound("space not found");
     if (spaceError) throw spaceError;
 
-    if (space.creator_token_hash !== hashToken(creatorToken)) {
+    const access = await resolveCreatorAccess({ request, body, space });
+    if (!access.canManage) {
       return badRequest("creator token did not match");
     }
+    if (access.shouldClaim) await claimCreatorAccess({ supabase, spaceId: space.id, userId: access.owner.userId });
 
     const { data: updatedSpace, error: updateError } = await supabase
       .from("spaces")

app/api/spaces/[slug]/slack/team-reads/route.js

@@ -1,23 +1,22 @@
 import { badRequest, notFound, ok, serverError } from "../../../../../../src/server/http";
-import { hashToken } from "../../../../../../src/server/hash";
+import { claimCreatorAccess, resolveCreatorAccess } from "../../../../../../src/server/creatorAccess";
 import { updateSlackSpacePosting } from "../../../../../../src/server/slack";
 import { getSupabaseAdmin } from "../../../../../../src/server/supabase";
-import { cleanString } from "../../../../../../src/server/validation";
 
 export async function PATCH(request, { params }) {
   try {
     const { slug } = await params;
     const body = await request.json();
-    const creatorToken = cleanString(body.creatorToken, 256);
     if (!slug) return badRequest("space slug is required");
-    if (!creatorToken) return badRequest("creator token is required");
     if (!Object.hasOwn(body, "postingEnabled")) return badRequest("postingEnabled is required");
 
     const supabase = getSupabaseAdmin();
-    const { data: space, error } = await supabase.from("spaces").select("id,creator_token_hash").eq("slug", slug).single();
+    const { data: space, error } = await supabase.from("spaces").select("id,creator_token_hash,creator_user_id").eq("slug", slug).single();
     if (error?.code === "PGRST116") return notFound("space not found");
     if (error) throw error;
-    if (space.creator_token_hash !== hashToken(creatorToken)) return badRequest("creator token did not match");
+    const access = await resolveCreatorAccess({ request, body, space });
+    if (!access.canManage) return badRequest("creator token did not match");
+    if (access.shouldClaim) await claimCreatorAccess({ supabase, spaceId: space.id, userId: access.owner.userId });
 
     const slackTeamReads = await updateSlackSpacePosting({ spaceId: space.id, postingEnabled: body.postingEnabled === true });
     return ok({ slackTeamReads });

app/api/spaces/[slug]/slack/team-reads/setup/route.js

@@ -1,22 +1,21 @@
 import { badRequest, notFound, ok, serverError } from "../../../../../../../src/server/http";
-import { hashToken } from "../../../../../../../src/server/hash";
+import { claimCreatorAccess, resolveCreatorAccess } from "../../../../../../../src/server/creatorAccess";
 import { createTeamReadsSetup, slackTeamReadsInstallUrl } from "../../../../../../../src/server/slack";
 import { getSupabaseAdmin } from "../../../../../../../src/server/supabase";
-import { cleanString } from "../../../../../../../src/server/validation";
 
 export async function POST(request, { params }) {
   try {
     const { slug } = await params;
     const body = await request.json();
-    const creatorToken = cleanString(body.creatorToken, 256);
     if (!slug) return badRequest("space slug is required");
-    if (!creatorToken) return badRequest("creator token is required");
 
     const supabase = getSupabaseAdmin();
-    const { data: space, error } = await supabase.from("spaces").select("id,creator_token_hash").eq("slug", slug).single();
+    const { data: space, error } = await supabase.from("spaces").select("id,creator_token_hash,creator_user_id").eq("slug", slug).single();
     if (error?.code === "PGRST116") return notFound("space not found");
     if (error) throw error;
-    if (space.creator_token_hash !== hashToken(creatorToken)) return badRequest("creator token did not match");
+    const access = await resolveCreatorAccess({ request, body, space });
+    if (!access.canManage) return badRequest("creator token did not match");
+    if (access.shouldClaim) await claimCreatorAccess({ supabase, spaceId: space.id, userId: access.owner.userId });
 
     const setup = await createTeamReadsSetup({ spaceId: space.id });
     return ok({ installUrl: slackTeamReadsInstallUrl(setup) });

app/api/spaces/route.js

@@ -1,4 +1,5 @@
 import { ok, badRequest, serverError } from "../../../src/server/http";
+import { resolveRequestOwner } from "../../../src/server/auth";
 import { createToken, hashToken } from "../../../src/server/hash";
 import { getSupabaseAdmin } from "../../../src/server/supabase";
 import { cleanString, isValidVibe, slugify } from "../../../src/server/validation";
@@ -13,6 +14,7 @@ export async function POST(request) {
     if (!isValidVibe(vibe)) return badRequest("unsupported vibe");
 
     const supabase = getSupabaseAdmin();
+    const owner = await resolveRequestOwner({ request, sessionToken: cleanString(body.sessionToken, 256) || "space-create" });
     const creatorToken = createToken();
     const baseSlug = slugify(name) || "team-mumbl";
     let slug = baseSlug;
@@ -26,6 +28,7 @@ export async function POST(request) {
           name,
           vibe,
           creator_token_hash: hashToken(creatorToken),
+          ...(owner.userId ? { creator_user_id: owner.userId } : {}),
         })
         .select()
         .single();

docs/backend-plan.md

@@ -110,6 +110,8 @@ Prototype public profiles now exist as a no-signup bridge: a browser session can
 
 Email magic-link login now exists only for private dump persistence. Anonymous dumping still works without signup. When a user logs in, Mumbl links the current browser session's dumps, field-note drafts, public profile, and dump insights to the Supabase Auth user id. Visibility does not change, and room posts/reactions continue to use the anonymous browser session token so auth never becomes room identity.
 
+Creator-token room ownership can also be claimed by a logged-in creator. The local creator token remains the recovery/portable key, but once a logged-in user proves possession of it, `spaces.creator_user_id` lets creator controls survive across browsers. This must not become room membership tracking; only creator access is persisted.
+
 ## Local Setup
 
 1. Create a Supabase project.

src/components/SpacePageClient.jsx

@@ -42,8 +42,8 @@ export default function SpacePageClient({ slug, tab }) {
   const [toast, setToast] = useState("");
 
   useEffect(() => {
-    setHasCreatorToken(Boolean(getCreatorToken(slug)));
-  }, [slug]);
+    setHasCreatorToken(Boolean(getCreatorToken(slug)) || space?.canManage === true);
+  }, [slug, space?.canManage]);
 
   async function copyText(text, message, target = "copy") {
     try {

src/lib/api.js

@@ -12,12 +12,14 @@ export async function joinWaitlist({ email }) {
 
 export async function fetchSpace(slug, { limit, before, type } = {}) {
   const sessionToken = loadSession();
+  const auth = await authRequestContext();
   const params = new URLSearchParams({ sessionToken });
   if (limit) params.set("limit", String(limit));
   if (before) params.set("before", before);
   if (type) params.set("type", type);
 
   const response = await fetch(`/api/spaces/${slug}?${params.toString()}`, {
+    headers: auth.headers,
     cache: "no-store",
   });
   const data = await parseJson(response);
@@ -26,10 +28,11 @@ export async function fetchSpace(slug, { limit, before, type } = {}) {
 }
 
 export async function createRemoteSpace({ name, vibe }) {
+  const auth = await authRequestContext();
   const response = await fetch("/api/spaces", {
     method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ name, vibe }),
+    headers: { "content-type": "application/json", ...auth.headers },
+    body: JSON.stringify({ name, vibe, sessionToken: loadSession() }),
   });
   const data = await parseJson(response);
   saveCreatorToken(data.slug, data.creatorToken);
@@ -158,9 +161,10 @@ export async function deleteFieldNote(fieldNoteId) {
 }
 
 export async function updateRemoteSpaceVisibility({ slug, isPublic, publicName }) {
+  const auth = await authRequestContext();
   const response = await fetch(`/api/spaces/${slug}`, {
     method: "PATCH",
-    headers: { "content-type": "application/json" },
+    headers: { "content-type": "application/json", ...auth.headers },
     body: JSON.stringify({
       creatorToken: getCreatorToken(slug),
       isPublic,
@@ -171,9 +175,10 @@ export async function updateRemoteSpaceVisibility({ slug, isPublic, publicName }
 }
 
 export async function updateRemoteSpaceDescription({ slug, description }) {
+  const auth = await authRequestContext();
   const response = await fetch(`/api/spaces/${slug}`, {
     method: "PATCH",
-    headers: { "content-type": "application/json" },
+    headers: { "content-type": "application/json", ...auth.headers },
     body: JSON.stringify({
       creatorToken: getCreatorToken(slug),
       description,
@@ -183,18 +188,20 @@ export async function updateRemoteSpaceDescription({ slug, description }) {
 }
 
 export async function startSlackTeamReadsSetup({ slug }) {
+  const auth = await authRequestContext();
   const response = await fetch(`/api/spaces/${slug}/slack/team-reads/setup`, {
     method: "POST",
-    headers: { "content-type": "application/json" },
+    headers: { "content-type": "application/json", ...auth.headers },
     body: JSON.stringify({ creatorToken: getCreatorToken(slug) }),
   });
   return parseJson(response);
 }
 
 export async function updateSlackTeamReadsPosting({ slug, postingEnabled }) {
+  const auth = await authRequestContext();
   const response = await fetch(`/api/spaces/${slug}/slack/team-reads`, {
     method: "PATCH",
-    headers: { "content-type": "application/json" },
+    headers: { "content-type": "application/json", ...auth.headers },
     body: JSON.stringify({ creatorToken: getCreatorToken(slug), postingEnabled }),
   });
   return parseJson(response);
@@ -210,9 +217,10 @@ export async function pinSlackSpaceForPublishing({ slug }) {
 }
 
 export async function dismissRemoteFirstPost(slug) {
+  const auth = await authRequestContext();
   const response = await fetch(`/api/spaces/${slug}/first-post-dismissed`, {
     method: "POST",
-    headers: { "content-type": "application/json" },
+    headers: { "content-type": "application/json", ...auth.headers },
     body: JSON.stringify({ creatorToken: getCreatorToken(slug) }),
   });
   return parseJson(response);