fix: claiming a name keeps your account instead of abandoning it

The séance tells guests "claim a name to keep your codex". It was a lie.
register() unconditionally created a brand-new User row with a fresh UUID,
so a wanderer's essence, discovered entities, sightings, ritual/judgment
history and Ghost Log — every one of them foreign-keyed to the guest's
user_id — were silently orphaned the moment they registered. Now that
every visitor starts as a guest, that hit essentially everyone who ever
signed up.

A wanderer hitting /register now renames that same row in place, keeping
all relationships intact. The existing AuthSession stays valid (same
user_id), so claiming a name doesn't even log you out.

Scoped deliberately to wanderers. My first attempt rejected ANY
authenticated caller with a 409, which broke registering a second account
while logged in — a legitimate flow (shared computer, alt account) that
tests/test_device.py::test_device_feed_only_broadcasts_to_the_owning_user
caught immediately: its second register 409'd, its login then failed, and
"user B's" device got paired to user A, silently defeating a
cross-user-isolation assertion. A named caller's cookie is now ignored and
the normal create-a-new-row path runs.

Adds get_optional_current_user (None instead of 401) for endpoints that
behave differently for anonymous vs. authenticated callers but must stay
reachable without auth.

This was one of eight findings from an adversarial audit whose verifier
agents all died on session limits, so nothing was machine-verified — I
confirmed this one by reading the code and then proving it end-to-end.
The other seven remain unchecked.

331 backend tests pass. Verified live: guest 23846555 -> livehunter1, same
id, same session still valid.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/app/deps.py

@@ -28,3 +28,21 @@ async def get_current_user(
     if user is None:
         raise HTTPException(status.HTTP_401_UNAUTHORIZED, "user not found")
     return user
+
+
+async def get_optional_current_user(
+    qm_session: str | None = Cookie(default=None, alias=SESSION_COOKIE_NAME),
+    db: AsyncSession = Depends(get_db),
+) -> User | None:
+    """Same lookup as get_current_user, but None instead of a 401 when
+    there is no valid session — for endpoints (like /auth/register) that
+    behave differently for an anonymous caller vs. an already-authenticated
+    one, but must not require auth to be reachable at all."""
+    if qm_session is None:
+        return None
+    token_hash = hash_token(qm_session)
+    result = await db.execute(select(AuthSession).where(AuthSession.token_hash == token_hash))
+    session = result.scalar_one_or_none()
+    if session is None or session.expires_at < datetime.now(timezone.utc):
+        return None
+    return await db.get(User, session.user_id)

backend/app/routes/auth.py

@@ -6,7 +6,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.db import get_db
-from app.deps import SESSION_COOKIE_NAME, get_current_user
+from app.deps import SESSION_COOKIE_NAME, get_current_user, get_optional_current_user
 from app.models.auth_session import AuthSession, SESSION_TTL, generate_session_token, hash_token
 from app.models.unlock import UnlockRecord
 from app.models.user import User
@@ -27,13 +27,46 @@ guest_limiter = RateLimiter(max_requests=5, window_seconds=3600)
 # namespace is effectively exhausted, not that we got unlucky.
 _GUEST_NAME_ATTEMPTS = 8
 
+# Shared with the guest-provisioning endpoint below, and with the frontend's
+# own username-prefix check (SeancePage's claim-a-name nudge) — a wanderer
+# is any user row whose username starts with this.
+WANDERER_PREFIX = "wanderer-"
+
 
 @router.post("/register", response_model=UserOut, status_code=status.HTTP_201_CREATED)
-async def register(payload: RegisterRequest, db: AsyncSession = Depends(get_db)):
+async def register(
+    payload: RegisterRequest,
+    db: AsyncSession = Depends(get_db),
+    current_user: User | None = Depends(get_optional_current_user),
+):
     existing = await db.scalar(select(User).where(User.username == payload.username))
     if existing is not None:
         raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="username taken")
 
+    # A *wanderer* hitting /register is claiming a name for the account they
+    # already have, not opening a new one — this is what makes the séance's
+    # "claim a name to keep your codex" nudge true rather than a lie.
+    # Previously register() always created a brand-new User row, so a
+    # guest's essence, discovered entities, ritual/judgment history and
+    # Ghost Log (all foreign-keyed to the guest's user_id) were silently
+    # abandoned the moment they registered — the exact opposite of what the
+    # UI promises. Renaming the SAME row in place keeps every one of those
+    # relationships intact, and the existing AuthSession stays valid (same
+    # user_id), so claiming a name doesn't log you out.
+    #
+    # Deliberately scoped to wanderers only: a caller who already has a real
+    # name is registering a SECOND account (a legitimate thing to do while
+    # logged in — shared computer, alt account), so their cookie is ignored
+    # and the normal create-a-new-row path runs. An earlier version of this
+    # rejected that case outright and broke exactly that flow.
+    if current_user is not None and current_user.username.startswith(WANDERER_PREFIX):
+        current_user.username = payload.username
+        current_user.password_hash = hash_password(payload.password)
+        current_user.email = payload.email
+        await db.commit()
+        await db.refresh(current_user)
+        return current_user
+
     user = User(
         username=payload.username,
         password_hash=hash_password(payload.password),
@@ -61,7 +94,7 @@ async def guest(
         )
 
     for _ in range(_GUEST_NAME_ATTEMPTS):
-        username = f"wanderer-{secrets.token_hex(2)}"
+        username = f"{WANDERER_PREFIX}{secrets.token_hex(2)}"
         existing = await db.scalar(select(User).where(User.username == username))
         if existing is None:
             break

backend/tests/test_auth_guest.py

@@ -58,3 +58,90 @@ async def test_guest_username_collision_retries(client, monkeypatch):
     response = await client.post("/auth/guest")
     assert response.status_code == 201
     assert response.json()["username"] == "wanderer-f4ee"
+
+
+@pytest.mark.asyncio
+async def test_registering_as_a_wanderer_claims_the_same_account_in_place(client, db_session):
+    """The whole point of 'claim a name to keep your codex': registering
+    while a guest must upgrade the SAME row, not abandon it for a new one.
+    Proven by crediting essence to the guest first, then checking it
+    survives registration under the guest's still-valid cookie."""
+    from sqlalchemy import select
+
+    from app.inventory import credit_essence
+    from app.models.user import User
+
+    guest_resp = await client.post("/auth/guest")
+    guest_id = guest_resp.json()["id"]
+    guest_username = guest_resp.json()["username"]
+
+    user = await db_session.get(User, guest_id)
+    credit_essence(user, 37)
+    await db_session.commit()
+
+    register_resp = await client.post(
+        "/auth/register", json={"username": "claimedname", "password": "spookyspooky1"}
+    )
+    assert register_resp.status_code == 201
+    body = register_resp.json()
+    # Same id, same essence — this is an upgrade, not a fresh account.
+    assert body["id"] == guest_id
+    assert body["username"] == "claimedname"
+    assert body["essence"] == 37
+
+    # The old wanderer username no longer resolves to a row at all — it was
+    # renamed in place, not duplicated.
+    old = await db_session.scalar(select(User).where(User.username == guest_username))
+    assert old is None
+
+    # The guest's original cookie is still a valid session for this same,
+    # now-named, account — claiming a name doesn't log you out.
+    me_resp = await client.get("/auth/me")
+    assert me_resp.status_code == 200
+    assert me_resp.json()["id"] == guest_id
+    assert me_resp.json()["username"] == "claimedname"
+
+    # And the new credentials actually work, for a future login elsewhere.
+    login_resp = await client.post(
+        "/auth/login", json={"username": "claimedname", "password": "spookyspooky1"}
+    )
+    assert login_resp.status_code == 200
+    assert login_resp.json()["id"] == guest_id
+
+
+@pytest.mark.asyncio
+async def test_registering_while_already_named_creates_a_separate_account(client, db_session):
+    """Registering a second account while logged in is legitimate (shared
+    computer, alt account), so a named caller's cookie is ignored and a
+    genuinely new row is created — the in-place claim is for wanderers only.
+    It must NOT rename the logged-in account out from under them."""
+    first = await client.post(
+        "/auth/register", json={"username": "alreadynamed", "password": "spookyspooky1"}
+    )
+    first_id = first.json()["id"]
+    await client.post(
+        "/auth/login", json={"username": "alreadynamed", "password": "spookyspooky1"}
+    )
+
+    second = await client.post(
+        "/auth/register", json={"username": "somethingelse", "password": "spookyspooky2"}
+    )
+    assert second.status_code == 201
+    assert second.json()["id"] != first_id
+
+    # The original account still exists under its own name, untouched.
+    from app.models.user import User
+
+    still_there = await db_session.get(User, first_id)
+    assert still_there is not None
+    assert still_there.username == "alreadynamed"
+
+
+@pytest.mark.asyncio
+async def test_anonymous_registration_is_unaffected(client):
+    # No cookie at all — the original, pre-guest behaviour must be intact.
+    resp = await client.post(
+        "/auth/register", json={"username": "freshaccount", "password": "spookyspooky1"}
+    )
+    assert resp.status_code == 201
+    assert resp.json()["username"] == "freshaccount"