feat: let guests publish a CommunityRule and claim it on this browser later

Finalize no longer requires a magic link. Guest rows stay off the catalog until sign-in on the same browser attaches ownership, and the login modal kebab no longer acts as a second close.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/api/rules/route.ts

@@ -4,6 +4,7 @@ import { prisma } from "../../../lib/server/db";
 import { getSessionPepper, isDatabaseConfigured } from "../../../lib/server/env";
 import {
   hashSessionToken,
+  hashRuleClaimToken,
   newSessionToken,
 } from "../../../lib/server/hash";
 import { sendRuleStakeholderInviteEmail } from "../../../lib/server/mail";
@@ -13,12 +14,12 @@ import {
   errorJson,
   rateLimited,
   serverMisconfigured,
-  unauthorized,
 } from "../../../lib/server/responses";
 import { logRouteError } from "../../../lib/server/requestId";
 import { stakeholderInviteVerifyUrl } from "../../../lib/server/ruleStakeholderInviteOps";
 import { STAKEHOLDER_INVITE_TTL_MS } from "../../../lib/server/ruleStakeholders";
 import { getSessionUser } from "../../../lib/server/session";
+import { issueGuestRuleClaimCookie } from "../../../lib/server/guestRuleClaim";
 import { apiRoute } from "../../../lib/server/apiRoute";
 import { getPublicOrigin } from "../../../lib/server/publicOrigin";
 import {
@@ -28,6 +29,17 @@ import {
 import { readLimitedJson } from "../../../lib/server/validation/requestBody";
 import { jsonFromZodError } from "../../../lib/server/validation/zodHttp";
 
+/** One anonymous publish per IP per minute (in-memory limiter). */
+const ANONYMOUS_PUBLISH_IP_MIN_INTERVAL_MS = 60_000;
+
+function clientIp(request: NextRequest): string {
+  return (
+    request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
+    request.headers.get("x-real-ip") ??
+    "unknown"
+  );
+}
+
 export const GET = apiRoute("rules.list", async (request: NextRequest) => {
   if (!isDatabaseConfigured()) {
     return dbUnavailable();
@@ -36,8 +48,12 @@ export const GET = apiRoute("rules.list", async (request: NextRequest) => {
   const { searchParams } = new URL(request.url);
   const take = Math.min(Number(searchParams.get("limit") ?? "50") || 50, 100);
 
-  /** Public catalog: mirror profile “my rules” recency semantics (last touched first). */
+  /**
+   * Public catalog: owned rules only (last touched first). Guest / orphan rows
+   * (`userId` null) stay reachable at `/rules/[id]` and `GET /api/rules/[id]`.
+   */
   const rules = await prisma.publishedRule.findMany({
+    where: { userId: { not: null } },
     orderBy: [{ updatedAt: "desc" }, { id: "asc" }],
     take,
     select: {
@@ -60,9 +76,6 @@ export const POST = apiRoute(
     }
 
     const user = await getSessionUser();
-    if (!user) {
-      return unauthorized();
-    }
 
     const parsedBody = await readLimitedJson(request);
     if (parsedBody.ok === false) {
@@ -75,16 +88,65 @@ export const POST = apiRoute(
     }
 
     const { title, summary, document, stakeholderEmails } = validated.data;
+
+    if (!user) {
+      const ip = clientIp(request);
+      const rl = rateLimitKey(
+        `publish-anonymous-ip:${ip}`,
+        ANONYMOUS_PUBLISH_IP_MIN_INTERVAL_MS,
+      );
+      if (rl.ok === false) {
+        return rateLimited(rl.retryAfterMs);
+      }
+
+      let pepper: string;
+      try {
+        pepper = getSessionPepper();
+      } catch (err) {
+        logRouteError("rules.publish", requestId, err, {
+          phase: "getSessionPepper",
+        });
+        return serverMisconfigured();
+      }
+
+      const claimToken = newSessionToken();
+      const claimTokenHash = hashRuleClaimToken(claimToken, pepper);
+
+      const rule = await prisma.publishedRule.create({
+        data: {
+          userId: null,
+          title,
+          summary,
+          document: document as Prisma.InputJsonValue,
+          claimTokenHash,
+        },
+      });
+
+      try {
+        await issueGuestRuleClaimCookie(claimToken);
+      } catch (err) {
+        logRouteError("rules.publish", requestId, err, {
+          phase: "issueGuestRuleClaimCookie",
+        });
+      }
+
+      return NextResponse.json({
+        rule: {
+          id: rule.id,
+          title: rule.title,
+          summary: rule.summary,
+          createdAt: rule.createdAt,
+        },
+      });
+    }
+
     const inviteEmails = uniqueStakeholderEmailsForPublish(
       stakeholderEmails,
       user.email,
     );
 
     if (inviteEmails.length > 0) {
-      const ip =
-        request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
-        request.headers.get("x-real-ip") ??
-        "unknown";
+      const ip = clientIp(request);
       const rl = rateLimitKey(`publish-stakeholders-ip:${ip}`, 60_000);
       if (rl.ok === false) {
         return rateLimited(rl.retryAfterMs);