feat(#49): scope history deletes to the caller, add PULLMD_ALLOW_SIGNUP

[syswave-dev]

Closes #49.

Two things were asked for: let a logged-in non-admin clear entries from their own history, and make self-registration switchable so a public demo instance can run in multi-user mode without collecting stranger accounts. Diagnosing the first turned up three more defects in the same code paths, fixed here as well.

Delete scope instead of a 403

adminOnly is gone. Both delete routes now pick a scope rather than rejecting:

Caller	DELETE /api/cache/:id	DELETE /api/cache
Non-admin	unlinks their own user_fetches row. Shared conversions row and /s/:id survive, other users unaffected	clears only their own history
Admin, or any caller when auth is disabled/unconfigured	drops the shared row (unchanged)	global purge (unchanged)

Responses gained scope: "user" \| "global", and delete-all gained removed. Existing status codes are unchanged: 400 on an unparsable id, 404 when nothing was deleted, 401 unauthenticated. The predicate isGlobalScope is character-for-character the condition the deleted middleware used, so admin semantics are preserved rather than reimplemented.

Behaviour change worth a CHANGELOG line: in single-admin/multi-user, a non-admin DELETE /api/cache* now answers 200 with scope: "user" instead of 403 {"error":"Admin required"}.

PULLMD_ALLOW_SIGNUP

Default on, so existing multi-user instances are unaffected. Only false/0/no/off closes registration, in which case the /signup routes are not mounted at all (404 for GET and POST, no user creatable), the login page drops its "create an account" link, and /api/config reports signupOpen: false.

createAuth exposes allowSignup (raw) and signupOpen (effective: mode === 'multi-user' && allowSignup). Only the effective value is read anywhere in production code.

This also fixes a live bug: loginPage() rendered the /signup link unconditionally, so in single-admin mode the login page linked to a route that does not exist.

create-user in the admin CLI

node scripts/admin.js create-user <email> with a password prompt, so "registration closed" is not a state an operator cannot escape.

Three defects found along the way

• Orphaned user_fetches rows. pruneOld runs on every put() and drops conversions older than 90 days, but never removed the matching fetch rows, and countForUser counts without the join that historyPageForUser uses. The archive therefore reported more entries than it could return, and the drift was permanent. Cleanup is now explicit SQL, plus a one-time sweep at createCache. A real FK with ON DELETE CASCADE was deliberately not used: enabling PRAGMA foreign_keys would start enforcing constraints across the oauth and session tables too. Measured cost of the sweep: 4 ms on a synthetic 50k/50k database.
• readPassword() read nothing from non-TTY stdin. node:readline/promises' question() returns a promise and ignores a callback, but the non-TTY fallback passed one. Any piped invocation printed the prompt and exited 0 having done nothing. This affected the pre-existing reset-password for as long as that command has existed. Guarded now by a child-process test.
• showError() was invisible while the archive view was open. showArchive() puts an inline display:none on the shared error element, which outranks the .error.visible class rule, and both archive delete buttons live inside that view. Two of the three delete paths would have kept failing silently.

Frontend

All three delete paths surface failures through the existing showError(). The tooltip and the delete-all confirmation state their scope, derived from a predicate mirroring the server's. That flag is deliberately tri-state: 'unknown' (/api/me answered nothing) is treated as a global delete, because claiming "global" for a delete that turns out to be scoped costs nothing while the reverse puts a harmless label on a destructive action.

Verification

• node --test: 1091 pass / 0 fail (1038 on main).
• python3 markitdown-sidecar/test_limits.py and test_youtube.py: 4 and 9 passed. These are not covered by node --test.
• Both new regression tests were proven non-vacuous by reverting the fix they guard and observing exactly that test fail.
• create-user smoke-tested end to end: creation via pipe, email trimmed and lowercased, duplicate in different case rejected, short password rejected, reset-password working via pipe, both accounts authenticating afterwards.

package.json is untouched; the version bump belongs to the release. Backward compatible for anyone setting none of the new variables, so this is a minor.

Deliberately deferred

db.transaction construction placement in two admin-frequency cache methods, an idempotence test for the orphan sweep, !auth coverage for the delete-all route, and a symmetric override truth table. None affect behaviour; each was triaged as ship-as-is.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KfovDXWcqT7abP6EqFedk5