feat: let guests publish a CommunityRule and claim it on this browser later

Finalize no longer requires a magic link. Guest rows stay off the catalog until sign-in on the same browser attaches ownership, and the login modal kebab no longer acts as a second close.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/(app)/create/CreateFlowLayoutClient.tsx

@@ -191,7 +191,7 @@ function CreateFlowLayoutContent({
     useState(false);
   const [completedFlowBanner, setCompletedFlowBanner] = useState<{
     key: string;
-    status: "positive" | "danger";
+    status: "positive" | "danger" | "warning";
     title: string;
     description?: string;
   } | null>(null);
@@ -257,6 +257,25 @@ function CreateFlowLayoutContent({
     openLogin,
     updateState,
     loginReturnPath,
+    sessionUser,
+    onGuestPublished: ({ skippedInvites }) => {
+      const completedCopy = create.reviewAndComplete.completed;
+      if (skippedInvites) {
+        setCompletedFlowBanner({
+          key: "guestInvitesSkipped",
+          status: "warning",
+          title: completedCopy.guestInvitesSkippedTitle,
+          description: completedCopy.guestInvitesSkippedDescription,
+        });
+        return;
+      }
+      setCompletedFlowBanner({
+        key: "guestClaimHint",
+        status: "warning",
+        title: completedCopy.guestClaimHintTitle,
+        description: completedCopy.guestClaimHintDescription,
+      });
+    },
   });
 
   const {
@@ -518,7 +537,7 @@ function CreateFlowLayoutContent({
    */
   const topBanners: Array<{
     key: string;
-    status: "danger" | "positive";
+    status: "danger" | "positive" | "warning";
     title: string;
     description?: string;
     onClose: () => void;
@@ -655,7 +674,7 @@ function CreateFlowLayoutContent({
       <CreateFlowTopNav
         hasShare={isCompletedStep}
         hasExport={isCompletedStep}
-        hasEdit={isCompletedStep}
+        hasEdit={isCompletedStep && Boolean(sessionUser)}
         hasManageStakeholders={isEditRuleStep}
         saveDraftOnExit={saveDraftOnExit}
         onShare={
@@ -882,7 +901,9 @@ function CreateFlowLayoutContent({
                 buttonType="filled"
                 palette="default"
                 size="xsmall"
-                disabled={isPublishing}
+                disabled={
+                  isPublishing || (isFinalReviewLike && !sessionResolved)
+                }
                 className={CREATE_FLOW_FOOTER_BUTTON_CLASS}
                 onClick={() => {
                   if (isFinalReviewLike) {

app/(app)/create/hooks/useCompletedRuleShareExport.ts

@@ -24,7 +24,7 @@ import {
 
 export type CompletedFlowActionBanner = {
   key: string;
-  status: "positive" | "danger";
+  status: "positive" | "danger" | "warning";
   title: string;
   description?: string;
 };

app/(app)/create/hooks/useCreateFlowFinalize.ts

@@ -20,6 +20,8 @@ type OpenLogin = (args: {
   backdropVariant: "blurredYellow";
 }) => void;
 
+type SessionUser = { id: string; email: string };
+
 export type UseCreateFlowFinalizeResult = {
   publishBannerMessage: string | null;
   setPublishBannerMessage: (_message: string | null) => void;
@@ -34,6 +36,8 @@ export function useCreateFlowFinalize({
   openLogin,
   updateState,
   loginReturnPath,
+  sessionUser,
+  onGuestPublished,
 }: {
   state: CreateFlowState;
   router: AppRouterLike;
@@ -41,6 +45,13 @@ export function useCreateFlowFinalize({
   updateState: (_patch: Partial<CreateFlowState>) => void;
   /** Session gate return path (`?syncDraft=1`) — differs for `/create/edit-rule` vs `/create/final-review`. */
   loginReturnPath: string;
+  /**
+   * `undefined` while `/api/auth/session` is in flight — finalize is a no-op
+   * until it resolves. `null` is a guest (anonymous publish).
+   */
+  sessionUser: SessionUser | null | undefined;
+  /** Guest publish succeeded; `skippedInvites` when stakeholder emails were not sent. */
+  onGuestPublished?: (_info: { skippedInvites: boolean }) => void;
 }): UseCreateFlowFinalizeResult {
   const [publishBannerMessage, setPublishBannerMessage] = useState<
     string | null
@@ -48,6 +59,8 @@ export function useCreateFlowFinalize({
   const [isPublishing, setIsPublishing] = useState(false);
 
   const finalize = useCallback(async () => {
+    if (sessionUser === undefined) return;
+
     setPublishBannerMessage(null);
     const payloadResult = buildPublishPayload(state);
     if (payloadResult.ok === false) {
@@ -100,9 +113,13 @@ export function useCreateFlowFinalize({
       return;
     }
 
-    const stakeholderEmails = (state.stakeholderEmails ?? []).filter(
+    const isGuest = sessionUser === null;
+    const rawStakeholderEmails = (state.stakeholderEmails ?? []).filter(
       (e) => typeof e === "string" && e.trim() !== "",
     );
+    const stakeholderEmails = isGuest ? [] : rawStakeholderEmails;
+    const skippedGuestInvites = isGuest && rawStakeholderEmails.length > 0;
+
     const publishResult = await publishRule({
       title,
       summary,
@@ -117,6 +134,9 @@ export function useCreateFlowFinalize({
         summary: summary ?? null,
         document: ruleDocument,
       });
+      if (isGuest) {
+        onGuestPublished?.({ skippedInvites: skippedGuestInvites });
+      }
       router.push(
         createFlowStepPath("completed", {
           [CREATE_FLOW_COMPLETED_CELEBRATE_QUERY]:
@@ -138,7 +158,15 @@ export function useCreateFlowFinalize({
         ? publishResult.error
         : messages.create.reviewAndComplete.publish.genericPublishFailed,
     );
-  }, [state, router, openLogin, updateState, loginReturnPath]);
+  }, [
+    state,
+    router,
+    openLogin,
+    updateState,
+    loginReturnPath,
+    sessionUser,
+    onGuestPublished,
+  ]);
 
   return {
     publishBannerMessage,

app/api/rules/route.ts

@@ -4,6 +4,7 @@ import { prisma } from "../../../lib/server/db";
 import { getSessionPepper, isDatabaseConfigured } from "../../../lib/server/env";
 import {
   hashSessionToken,
+  hashRuleClaimToken,
   newSessionToken,
 } from "../../../lib/server/hash";
 import { sendRuleStakeholderInviteEmail } from "../../../lib/server/mail";
@@ -13,12 +14,12 @@ import {
   errorJson,
   rateLimited,
   serverMisconfigured,
-  unauthorized,
 } from "../../../lib/server/responses";
 import { logRouteError } from "../../../lib/server/requestId";
 import { stakeholderInviteVerifyUrl } from "../../../lib/server/ruleStakeholderInviteOps";
 import { STAKEHOLDER_INVITE_TTL_MS } from "../../../lib/server/ruleStakeholders";
 import { getSessionUser } from "../../../lib/server/session";
+import { issueGuestRuleClaimCookie } from "../../../lib/server/guestRuleClaim";
 import { apiRoute } from "../../../lib/server/apiRoute";
 import { getPublicOrigin } from "../../../lib/server/publicOrigin";
 import {
@@ -28,6 +29,17 @@ import {
 import { readLimitedJson } from "../../../lib/server/validation/requestBody";
 import { jsonFromZodError } from "../../../lib/server/validation/zodHttp";
 
+/** One anonymous publish per IP per minute (in-memory limiter). */
+const ANONYMOUS_PUBLISH_IP_MIN_INTERVAL_MS = 60_000;
+
+function clientIp(request: NextRequest): string {
+  return (
+    request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
+    request.headers.get("x-real-ip") ??
+    "unknown"
+  );
+}
+
 export const GET = apiRoute("rules.list", async (request: NextRequest) => {
   if (!isDatabaseConfigured()) {
     return dbUnavailable();
@@ -36,8 +48,12 @@ export const GET = apiRoute("rules.list", async (request: NextRequest) => {
   const { searchParams } = new URL(request.url);
   const take = Math.min(Number(searchParams.get("limit") ?? "50") || 50, 100);
 
-  /** Public catalog: mirror profile “my rules” recency semantics (last touched first). */
+  /**
+   * Public catalog: owned rules only (last touched first). Guest / orphan rows
+   * (`userId` null) stay reachable at `/rules/[id]` and `GET /api/rules/[id]`.
+   */
   const rules = await prisma.publishedRule.findMany({
+    where: { userId: { not: null } },
     orderBy: [{ updatedAt: "desc" }, { id: "asc" }],
     take,
     select: {
@@ -60,9 +76,6 @@ export const POST = apiRoute(
     }
 
     const user = await getSessionUser();
-    if (!user) {
-      return unauthorized();
-    }
 
     const parsedBody = await readLimitedJson(request);
     if (parsedBody.ok === false) {
@@ -75,16 +88,65 @@ export const POST = apiRoute(
     }
 
     const { title, summary, document, stakeholderEmails } = validated.data;
+
+    if (!user) {
+      const ip = clientIp(request);
+      const rl = rateLimitKey(
+        `publish-anonymous-ip:${ip}`,
+        ANONYMOUS_PUBLISH_IP_MIN_INTERVAL_MS,
+      );
+      if (rl.ok === false) {
+        return rateLimited(rl.retryAfterMs);
+      }
+
+      let pepper: string;
+      try {
+        pepper = getSessionPepper();
+      } catch (err) {
+        logRouteError("rules.publish", requestId, err, {
+          phase: "getSessionPepper",
+        });
+        return serverMisconfigured();
+      }
+
+      const claimToken = newSessionToken();
+      const claimTokenHash = hashRuleClaimToken(claimToken, pepper);
+
+      const rule = await prisma.publishedRule.create({
+        data: {
+          userId: null,
+          title,
+          summary,
+          document: document as Prisma.InputJsonValue,
+          claimTokenHash,
+        },
+      });
+
+      try {
+        await issueGuestRuleClaimCookie(claimToken);
+      } catch (err) {
+        logRouteError("rules.publish", requestId, err, {
+          phase: "issueGuestRuleClaimCookie",
+        });
+      }
+
+      return NextResponse.json({
+        rule: {
+          id: rule.id,
+          title: rule.title,
+          summary: rule.summary,
+          createdAt: rule.createdAt,
+        },
+      });
+    }
+
     const inviteEmails = uniqueStakeholderEmailsForPublish(
       stakeholderEmails,
       user.email,
     );
 
     if (inviteEmails.length > 0) {
-      const ip =
-        request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
-        request.headers.get("x-real-ip") ??
-        "unknown";
+      const ip = clientIp(request);
       const rl = rateLimitKey(`publish-stakeholders-ip:${ip}`, 60_000);
       if (rl.ok === false) {
         return rateLimited(rl.retryAfterMs);

app/components/modals/Login/Login.view.tsx

@@ -43,7 +43,7 @@ export function LoginView({
         className={`flex min-h-0 max-h-[90vh] w-full max-w-[560px] shrink-0 flex-col overflow-hidden rounded-[var(--radius-500,20px)] bg-[var(--color-surface-default-primary)] shadow-[0px_0px_48px_0px_rgba(0,0,0,0.1)] z-[9999] ${className}`}
         onClick={(e) => e.stopPropagation()}
       >
-        <ModalHeader onClose={onClose} onMoreOptions={onClose} />
+        <ModalHeader onClose={onClose} showMoreOptionsButton={false} />
         <div className="scrollbar-design flex min-h-0 flex-1 flex-col overflow-x-clip overflow-y-auto px-6 pb-8 pt-0">
           {children}
         </div>