Metadata attribution batch: fallback creator/editor resolution and admin repair utility

Author: wilhel1812

docs/BACKLOG.md

@@ -49,8 +49,10 @@ State: stabilization pass (no net-new product features unless explicitly approve
 ### Admin tooling
 - [ ] Build in-app admin utilities to reduce manual D1 SQL operations
 - Progress: added in-app deleted-user lock manager (list + restore) to remove direct SQL need for this flow.
+- Progress: added in-app metadata repair utility for created/last-edited backfill from ownership/change history.
 - [ ] Add user moderation actions and review queue ergonomics
 - [ ] Add simulation/site ownership repair tools in UI
+- Progress: ownership-related display gaps now repaired via metadata repair + fallback mapping; explicit owner reassignment UI still pending.
 - [ ] Add admin-safe bulk operations with confirmations and logs
 
 ### UI and wording consistency

functions/_lib/db.ts

@@ -818,12 +818,22 @@ const canEditByRole = (role: string | null, visibility: Visibility): boolean =>
 type LibraryRow = {
   payload_json: string;
   owner_user_id: string;
+  owner_name: string | null;
+  owner_avatar_url: string | null;
   visibility: Visibility;
   role: string | null;
   created_by_user_id: string | null;
   created_by_name: string | null;
+  created_by_avatar_url: string | null;
+  first_actor_user_id: string | null;
+  first_actor_name: string | null;
+  first_actor_avatar_url: string | null;
   last_edited_by_user_id: string | null;
   last_edited_by_name: string | null;
+  last_edited_by_avatar_url: string | null;
+  last_actor_user_id: string | null;
+  last_actor_name: string | null;
+  last_actor_avatar_url: string | null;
   created_at: string | null;
   last_edited_at: string | null;
 };
@@ -836,14 +846,25 @@ export const fetchLibraryForUser = async (
   const siteRows = await env.DB
     .prepare(
       `SELECT s.payload_json, s.owner_user_id, s.visibility, r.role,
+              owner_u.username AS owner_name,
+              owner_u.avatar_url AS owner_avatar_url,
               s.created_by_user_id,
               (SELECT u.username FROM users u WHERE u.id = s.created_by_user_id) AS created_by_name,
+              (SELECT u.avatar_url FROM users u WHERE u.id = s.created_by_user_id) AS created_by_avatar_url,
+              (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'site' AND rc.resource_id = s.id ORDER BY rc.changed_at ASC LIMIT 1) AS first_actor_user_id,
+              (SELECT u.username FROM users u WHERE u.id = (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'site' AND rc.resource_id = s.id ORDER BY rc.changed_at ASC LIMIT 1)) AS first_actor_name,
+              (SELECT u.avatar_url FROM users u WHERE u.id = (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'site' AND rc.resource_id = s.id ORDER BY rc.changed_at ASC LIMIT 1)) AS first_actor_avatar_url,
               s.last_edited_by_user_id,
               (SELECT u.username FROM users u WHERE u.id = s.last_edited_by_user_id) AS last_edited_by_name,
+              (SELECT u.avatar_url FROM users u WHERE u.id = s.last_edited_by_user_id) AS last_edited_by_avatar_url,
+              (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'site' AND rc.resource_id = s.id ORDER BY rc.changed_at DESC LIMIT 1) AS last_actor_user_id,
+              (SELECT u.username FROM users u WHERE u.id = (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'site' AND rc.resource_id = s.id ORDER BY rc.changed_at DESC LIMIT 1)) AS last_actor_name,
+              (SELECT u.avatar_url FROM users u WHERE u.id = (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'site' AND rc.resource_id = s.id ORDER BY rc.changed_at DESC LIMIT 1)) AS last_actor_avatar_url,
               s.created_at,
               s.last_edited_at
        FROM sites s
        LEFT JOIN site_roles r ON r.site_id = s.id AND r.user_id = ?
+       LEFT JOIN users owner_u ON owner_u.id = s.owner_user_id
        WHERE s.owner_user_id = ? OR r.user_id IS NOT NULL OR s.visibility IN ('public_read', 'public_write')`,
     )
     .bind(userId, userId)
@@ -852,14 +873,25 @@ export const fetchLibraryForUser = async (
   const simulationRows = await env.DB
     .prepare(
       `SELECT s.payload_json, s.owner_user_id, s.visibility, r.role,
+              owner_u.username AS owner_name,
+              owner_u.avatar_url AS owner_avatar_url,
               s.created_by_user_id,
               (SELECT u.username FROM users u WHERE u.id = s.created_by_user_id) AS created_by_name,
+              (SELECT u.avatar_url FROM users u WHERE u.id = s.created_by_user_id) AS created_by_avatar_url,
+              (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'simulation' AND rc.resource_id = s.id ORDER BY rc.changed_at ASC LIMIT 1) AS first_actor_user_id,
+              (SELECT u.username FROM users u WHERE u.id = (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'simulation' AND rc.resource_id = s.id ORDER BY rc.changed_at ASC LIMIT 1)) AS first_actor_name,
+              (SELECT u.avatar_url FROM users u WHERE u.id = (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'simulation' AND rc.resource_id = s.id ORDER BY rc.changed_at ASC LIMIT 1)) AS first_actor_avatar_url,
               s.last_edited_by_user_id,
               (SELECT u.username FROM users u WHERE u.id = s.last_edited_by_user_id) AS last_edited_by_name,
+              (SELECT u.avatar_url FROM users u WHERE u.id = s.last_edited_by_user_id) AS last_edited_by_avatar_url,
+              (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'simulation' AND rc.resource_id = s.id ORDER BY rc.changed_at DESC LIMIT 1) AS last_actor_user_id,
+              (SELECT u.username FROM users u WHERE u.id = (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'simulation' AND rc.resource_id = s.id ORDER BY rc.changed_at DESC LIMIT 1)) AS last_actor_name,
+              (SELECT u.avatar_url FROM users u WHERE u.id = (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'simulation' AND rc.resource_id = s.id ORDER BY rc.changed_at DESC LIMIT 1)) AS last_actor_avatar_url,
               s.created_at,
               s.last_edited_at
        FROM simulations s
        LEFT JOIN simulation_roles r ON r.simulation_id = s.id AND r.user_id = ?
+       LEFT JOIN users owner_u ON owner_u.id = s.owner_user_id
        WHERE s.owner_user_id = ? OR r.user_id IS NOT NULL OR s.visibility IN ('public_read', 'public_write')`,
     )
     .bind(userId, userId)
@@ -870,15 +902,27 @@ export const fetchLibraryForUser = async (
       .map((row) => {
         try {
           const parsed = JSON.parse(row.payload_json) as CloudResourceRecord;
+          const createdByUserId = row.created_by_user_id ?? row.first_actor_user_id ?? row.owner_user_id;
+          const createdByName = row.created_by_name ?? row.first_actor_name ?? row.owner_name ?? "Unknown";
+          const createdByAvatarUrl =
+            row.created_by_avatar_url ?? row.first_actor_avatar_url ?? row.owner_avatar_url ?? "";
+          const lastEditedByUserId =
+            row.last_edited_by_user_id ?? row.last_actor_user_id ?? createdByUserId ?? row.owner_user_id;
+          const lastEditedByName =
+            row.last_edited_by_name ?? row.last_actor_name ?? createdByName ?? row.owner_name ?? "Unknown";
+          const lastEditedByAvatarUrl =
+            row.last_edited_by_avatar_url ?? row.last_actor_avatar_url ?? createdByAvatarUrl ?? row.owner_avatar_url ?? "";
           return {
             ...parsed,
             ownerUserId: row.owner_user_id,
             visibility: row.visibility,
-            createdByUserId: row.created_by_user_id,
-            createdByName: row.created_by_name,
+            createdByUserId,
+            createdByName,
+            createdByAvatarUrl,
             createdAt: row.created_at,
-            lastEditedByUserId: row.last_edited_by_user_id,
-            lastEditedByName: row.last_edited_by_name,
+            lastEditedByUserId,
+            lastEditedByName,
+            lastEditedByAvatarUrl,
             lastEditedAt: row.last_edited_at,
             effectiveRole:
               row.owner_user_id === userId
@@ -897,6 +941,71 @@ export const fetchLibraryForUser = async (
   };
 };
 
+export const backfillResourceMetadata = async (
+  env: Env,
+): Promise<{ sitesUpdated: number; simulationsUpdated: number }> => {
+  await ensureSchema(env);
+
+  const siteResult = await env.DB
+    .prepare(
+      `UPDATE sites
+       SET created_by_user_id = COALESCE(
+             created_by_user_id,
+             (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'site' AND rc.resource_id = sites.id ORDER BY rc.changed_at ASC LIMIT 1),
+             owner_user_id
+           ),
+           last_edited_by_user_id = COALESCE(
+             last_edited_by_user_id,
+             (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'site' AND rc.resource_id = sites.id ORDER BY rc.changed_at DESC LIMIT 1),
+             created_by_user_id,
+             owner_user_id
+           ),
+           created_at = COALESCE(
+             created_at,
+             (SELECT rc.changed_at FROM resource_changes rc WHERE rc.resource_kind = 'site' AND rc.resource_id = sites.id ORDER BY rc.changed_at ASC LIMIT 1),
+             updated_at
+           ),
+           last_edited_at = COALESCE(
+             last_edited_at,
+             (SELECT rc.changed_at FROM resource_changes rc WHERE rc.resource_kind = 'site' AND rc.resource_id = sites.id ORDER BY rc.changed_at DESC LIMIT 1),
+             updated_at
+           )`,
+    )
+    .run();
+
+  const simulationResult = await env.DB
+    .prepare(
+      `UPDATE simulations
+       SET created_by_user_id = COALESCE(
+             created_by_user_id,
+             (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'simulation' AND rc.resource_id = simulations.id ORDER BY rc.changed_at ASC LIMIT 1),
+             owner_user_id
+           ),
+           last_edited_by_user_id = COALESCE(
+             last_edited_by_user_id,
+             (SELECT rc.actor_user_id FROM resource_changes rc WHERE rc.resource_kind = 'simulation' AND rc.resource_id = simulations.id ORDER BY rc.changed_at DESC LIMIT 1),
+             created_by_user_id,
+             owner_user_id
+           ),
+           created_at = COALESCE(
+             created_at,
+             (SELECT rc.changed_at FROM resource_changes rc WHERE rc.resource_kind = 'simulation' AND rc.resource_id = simulations.id ORDER BY rc.changed_at ASC LIMIT 1),
+             updated_at
+           ),
+           last_edited_at = COALESCE(
+             last_edited_at,
+             (SELECT rc.changed_at FROM resource_changes rc WHERE rc.resource_kind = 'simulation' AND rc.resource_id = simulations.id ORDER BY rc.changed_at DESC LIMIT 1),
+             updated_at
+           )`,
+    )
+    .run();
+
+  return {
+    sitesUpdated: Number((siteResult.meta as { changes?: number } | undefined)?.changes ?? 0),
+    simulationsUpdated: Number((simulationResult.meta as { changes?: number } | undefined)?.changes ?? 0),
+  };
+};
+
 export const fetchResourceChanges = async (
   env: Env,
   kind: "site" | "simulation",

functions/api/admin-repair-metadata.ts

@@ -0,0 +1,23 @@
+import { verifyAuth } from "../_lib/auth";
+import { assertUserAccess, backfillResourceMetadata, ensureUser, fetchUserProfile } from "../_lib/db";
+import { errorResponse, handleOptions, json, withCors } from "../_lib/http";
+import type { Env } from "../_lib/types";
+
+export const onRequestOptions: PagesFunction<Env> = async ({ request }) => handleOptions(request);
+
+export const onRequestPost: PagesFunction<Env> = async ({ request, env }) => {
+  try {
+    const auth = await verifyAuth(request, env);
+    if (!auth) return withCors(request, json({ error: "Unauthorized" }, { status: 401 }));
+    await ensureUser(env, auth.userId, auth.tokenPayload);
+    await assertUserAccess(env, auth.userId);
+    const me = await fetchUserProfile(env, auth.userId);
+    if (!me) return withCors(request, json({ error: "Unauthorized" }, { status: 401 }));
+    if (!me.isAdmin) return withCors(request, json({ error: "Forbidden" }, { status: 403 }));
+
+    const result = await backfillResourceMetadata(env);
+    return withCors(request, json({ ok: true, ...result }));
+  } catch (error) {
+    return errorResponse(request, error, 500);
+  }
+};

src/components/Sidebar.tsx

@@ -390,8 +390,10 @@ export function Sidebar() {
     label: string;
     createdByUserId: string | null;
     createdByName: string;
+    createdByAvatarUrl: string;
     lastEditedByUserId: string | null;
     lastEditedByName: string;
+    lastEditedByAvatarUrl: string;
   } | null>(null);
   const [storageOriginWarning, setStorageOriginWarning] = useState("");
   const [storageSnapshotInfo, setStorageSnapshotInfo] = useState(() => ({
@@ -982,25 +984,31 @@ export function Sidebar() {
     label,
     createdByUserId,
     createdByName,
+    createdByAvatarUrl,
     lastEditedByUserId,
     lastEditedByName,
+    lastEditedByAvatarUrl,
   }: {
     kind: "site" | "simulation";
     resourceId: string;
     label: string;
     createdByUserId: string | null;
     createdByName: string;
+    createdByAvatarUrl: string;
     lastEditedByUserId: string | null;
     lastEditedByName: string;
+    lastEditedByAvatarUrl: string;
   }) => {
     setResourceDetailsPopup({
       kind,
       resourceId,
       label,
       createdByUserId,
       createdByName,
+      createdByAvatarUrl,
       lastEditedByUserId,
       lastEditedByName,
+      lastEditedByAvatarUrl,
     });
   };
 
@@ -1826,14 +1834,15 @@ export function Sidebar() {
                 onClick={() => void openUserProfilePopup(resourceDetailsPopup.createdByUserId)}
                 type="button"
               >
-                Created by <UserBadge name={resourceDetailsPopup.createdByName} />
+                Created by <UserBadge avatarUrl={resourceDetailsPopup.createdByAvatarUrl} name={resourceDetailsPopup.createdByName} />
               </button>
               <button
                 className="inline-action"
                 onClick={() => void openUserProfilePopup(resourceDetailsPopup.lastEditedByUserId)}
                 type="button"
               >
-                Last edited by <UserBadge name={resourceDetailsPopup.lastEditedByName} />
+                Last edited by{" "}
+                <UserBadge avatarUrl={resourceDetailsPopup.lastEditedByAvatarUrl} name={resourceDetailsPopup.lastEditedByName} />
               </button>
               <button
                 className="inline-action"
@@ -1942,10 +1951,14 @@ export function Sidebar() {
                           label: preset.name,
                           createdByUserId: (preset as unknown as { createdByUserId?: string }).createdByUserId ?? null,
                           createdByName: (preset as unknown as { createdByName?: string }).createdByName ?? "Unknown",
+                          createdByAvatarUrl:
+                            (preset as unknown as { createdByAvatarUrl?: string }).createdByAvatarUrl ?? "",
                           lastEditedByUserId:
                             (preset as unknown as { lastEditedByUserId?: string }).lastEditedByUserId ?? null,
                           lastEditedByName:
                             (preset as unknown as { lastEditedByName?: string }).lastEditedByName ?? "Unknown",
+                          lastEditedByAvatarUrl:
+                            (preset as unknown as { lastEditedByAvatarUrl?: string }).lastEditedByAvatarUrl ?? "",
                         })
                       }
                       type="button"
@@ -2251,10 +2264,14 @@ export function Sidebar() {
                           label: entry.name,
                           createdByUserId: (entry as unknown as { createdByUserId?: string }).createdByUserId ?? null,
                           createdByName: (entry as unknown as { createdByName?: string }).createdByName ?? "Unknown",
+                          createdByAvatarUrl:
+                            (entry as unknown as { createdByAvatarUrl?: string }).createdByAvatarUrl ?? "",
                           lastEditedByUserId:
                             (entry as unknown as { lastEditedByUserId?: string }).lastEditedByUserId ?? null,
                           lastEditedByName:
                             (entry as unknown as { lastEditedByName?: string }).lastEditedByName ?? "Unknown",
+                          lastEditedByAvatarUrl:
+                            (entry as unknown as { lastEditedByAvatarUrl?: string }).lastEditedByAvatarUrl ?? "",
                         })
                       }
                       type="button"

src/components/UserAdminPanel.tsx

@@ -6,6 +6,7 @@ import {
   fetchMe,
   fetchSchemaDiagnostics,
   fetchUsers,
+  runMetadataRepair,
   restoreDeletedCloudUser,
   updateMyProfile,
   updateUserAdmin,
@@ -124,6 +125,23 @@ export function UserAdminPanel() {
     });
   };
 
+  const repairMetadata = async () => {
+    setBusy(true);
+    setStatus("");
+    try {
+      const result = await runMetadataRepair();
+      await refreshAdminData();
+      setStatus(
+        `Metadata repair completed. Sites updated: ${result.sitesUpdated}. Simulations updated: ${result.simulationsUpdated}.`,
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      setStatus(`Metadata repair failed: ${message}`);
+    } finally {
+      setBusy(false);
+    }
+  };
+
   const loadNotifications = async () => {
     if (!canAdmin) return;
     setNotificationBusy(true);
@@ -464,9 +482,14 @@ export function UserAdminPanel() {
               <div className="user-manager-list">
                 <div className="section-heading">
                   <p className="field-help">System diagnostics</p>
-                  <button className="inline-action" disabled={busy} onClick={() => void load()} type="button">
-                    Refresh
-                  </button>
+                  <div className="chip-group">
+                    <button className="inline-action" disabled={busy} onClick={() => void load()} type="button">
+                      Refresh
+                    </button>
+                    <button className="inline-action" disabled={busy} onClick={() => void repairMetadata()} type="button">
+                      Repair Metadata
+                    </button>
+                  </div>
                 </div>
                 {authWarnings.length ? (
                   <div className="notification-banner" role="status">

src/lib/cloudUser.ts

@@ -66,6 +66,12 @@ export type SchemaDiagnostics = {
   };
 };
 
+export type MetadataRepairResult = {
+  ok: boolean;
+  sitesUpdated: number;
+  simulationsUpdated: number;
+};
+
 const apiCall = async <T>(path: string, init?: RequestInit): Promise<T> => {
   const response = await fetch(path, {
     ...init,
@@ -184,3 +190,6 @@ export const fetchAuthDiagnostics = async (): Promise<AuthDiagnostics> =>
 
 export const fetchSchemaDiagnostics = async (): Promise<SchemaDiagnostics> =>
   apiCall<SchemaDiagnostics>("/api/schema-diagnostics", { method: "GET" });
+
+export const runMetadataRepair = async (): Promise<MetadataRepairResult> =>
+  apiCall<MetadataRepairResult>("/api/admin-repair-metadata", { method: "POST" });