Phase 8: optional accounts, per-user data, shared demo key

Guest-first multi-user mode behind AIDND_MULTI_USER (local installs
unchanged): signed-cookie guest sessions bootstrapped by /api/auth/me,
register upgrades the guest in place, login/logout, per-IP rate limits.
Every router scoped by user_id; Settings become per-user with the API
key Fernet-encrypted at rest and write-only through the API. Users
without a key get a server-funded demo key (OpenRouter free models,
20 turns/day, memory bank disabled on demo turns). Public read-only
demo scenarios (seed_demo.py); debug log restricted to local mode.
Frontend: auth modal + guest nudge, 401 re-establish/retry, demo
banner and key management in Settings.

Migrations 13-23 adopt existing data under a local user and encrypt
stored keys. Verified: migration on a copy of real data.db, two-session
isolation + register/login via curl and Chrome, demo cap 429, live
OpenRouter turn through the encrypted-key path, vite build + oxlint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KFsGHju9szibJJa2YJcdbg

backend/app/routers/scripts.py

@@ -1,7 +1,7 @@
 from fastapi import APIRouter, Body, Depends, HTTPException
 from sqlalchemy.orm import Session
 
-from .. import models, schemas
+from .. import auth, models, schemas
 from ..database import get_db
 from ..scripting import run_hook
 
@@ -10,34 +10,55 @@ router = APIRouter(prefix="/api/scripts", tags=["scripts"])
 HOOK_FIELDS = {"input": "input_js", "context": "context_js", "output": "output_js"}
 
 
-def get_script_or_404(script_id: int, db: Session) -> models.Script:
+def get_script_or_404(script_id: int, db: Session, user: models.User) -> models.Script:
     script = db.get(models.Script, script_id)
-    if script is None:
+    if script is None or script.user_id != user.id:
         raise HTTPException(404, "Script not found")
     return script
 
 
 @router.get("", response_model=list[schemas.ScriptOut])
-def list_scripts(db: Session = Depends(get_db)):
-    return db.query(models.Script).order_by(models.Script.updated_at.desc()).all()
+def list_scripts(
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
+    return (
+        db.query(models.Script)
+        .filter(models.Script.user_id == user.id)
+        .order_by(models.Script.updated_at.desc())
+        .all()
+    )
 
 
 @router.post("", response_model=schemas.ScriptOut, status_code=201)
-def create_script(payload: schemas.ScriptCreate, db: Session = Depends(get_db)):
-    script = models.Script(**payload.model_dump())
+def create_script(
+    payload: schemas.ScriptCreate,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
+    script = models.Script(**payload.model_dump(), user_id=user.id)
     db.add(script)
     db.commit()
     return script
 
 
 @router.get("/{script_id}", response_model=schemas.ScriptOut)
-def get_script(script_id: int, db: Session = Depends(get_db)):
-    return get_script_or_404(script_id, db)
+def get_script(
+    script_id: int,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
+    return get_script_or_404(script_id, db, user)
 
 
 @router.patch("/{script_id}", response_model=schemas.ScriptOut)
-def update_script(script_id: int, payload: schemas.ScriptUpdate, db: Session = Depends(get_db)):
-    script = get_script_or_404(script_id, db)
+def update_script(
+    script_id: int,
+    payload: schemas.ScriptUpdate,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
+    script = get_script_or_404(script_id, db, user)
     for field, value in payload.model_dump(exclude_unset=True).items():
         setattr(script, field, value)
     db.commit()
@@ -45,17 +66,24 @@ def update_script(script_id: int, payload: schemas.ScriptUpdate, db: Session = D
 
 
 @router.delete("/{script_id}", status_code=204)
-def delete_script(script_id: int, db: Session = Depends(get_db)):
-    db.delete(get_script_or_404(script_id, db))
+def delete_script(
+    script_id: int,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
+    db.delete(get_script_or_404(script_id, db, user))
     db.commit()
 
 
 @router.post("/{script_id}/test")
 def test_script(
-    script_id: int, payload: schemas.ScriptTestRequest, db: Session = Depends(get_db)
+    script_id: int,
+    payload: schemas.ScriptTestRequest,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
 ):
     """Dry-run one hook against sample text — no AI call, no persistence."""
-    script = get_script_or_404(script_id, db)
+    script = get_script_or_404(script_id, db, user)
     result = run_hook(
         script.library_js,
         getattr(script, HOOK_FIELDS[payload.hook]),
@@ -78,9 +106,13 @@ def test_script(
 # ---------- Import / Export ----------
 
 @router.get("/{script_id}/export")
-def export_script(script_id: int, db: Session = Depends(get_db)):
+def export_script(
+    script_id: int,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
     """JSON bundle matching how AI Dungeon scripts circulate."""
-    script = get_script_or_404(script_id, db)
+    script = get_script_or_404(script_id, db, user)
     return {
         "name": script.name,
         "description": script.description,
@@ -92,7 +124,11 @@ def export_script(script_id: int, db: Session = Depends(get_db)):
 
 
 @router.post("/import", response_model=schemas.ScriptOut, status_code=201)
-def import_script(bundle: dict = Body(...), db: Session = Depends(get_db)):
+def import_script(
+    bundle: dict = Body(...),
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
     """Accepts our export bundle; tolerates *_js key names too."""
     def pick(*keys: str) -> str:
         for key in keys:
@@ -102,6 +138,7 @@ def import_script(bundle: dict = Body(...), db: Session = Depends(get_db)):
         return ""
 
     script = models.Script(
+        user_id=user.id,
         name=pick("name") or "Imported Script",
         description=pick("description"),
         library_js=pick("library", "library_js", "sharedLibrary"),