migrate auth v2 code

frontend/src/routes/[fam]/[username]/+page.server.ts

@@ -5,15 +5,17 @@ import { PROXY_URL } from '$app/env/public';
 const HONO_URL = PROXY_URL;
 
 export async function load(event) {
-	const session = event.locals.session;
+	const session = event.locals.user;
 
-	// Parent (session auth) → admin overview
-	if (session) {
+	// Parent (role=parent, session auth) → admin overview.
+	// Branch on role, NOT presence: a child who OTP-logged-in also has a
+	// `users` session (locals.user) and must not hit the parent path.
+	if (session && session.role === 'parent') {
 		const famId = session.famId;
 		const famSlug = event.params.fam;
 		const username = event.params.username;
-		if (session.memberName && session.memberName !== username) {
-			throw redirect(303, `/${famSlug}/${session.memberName}`);
+		if (session.name && session.username && session.username !== username) {
+			throw redirect(303, `/${famSlug}/${session.username}`);
 		}
 		const [
 			members,
@@ -51,70 +53,55 @@ export async function load(event) {
 		};
 	}
 
-	// Child (device token) → kanban
-	const deviceToken =
-		event.cookies.get('device_token') || event.url.searchParams.get('token') || '';
+	// Child (users auth, role=child) → kanban
 	const famSlug = event.params.fam;
 	const username = event.params.username;
 
-	if (!deviceToken) {
-		return {
-			role: 'child',
-			token: '',
-			memberId: '',
-			verified: false,
-			famId: '',
-			templates: [],
-			assigned: [],
-			completions: [],
-			rewards: [],
-			bonusConfigs: [],
-			tallies: {}
-		};
+	// A child should always land on their own kanban route.
+	if (session?.username && session.username !== username) {
+		throw redirect(303, `/${famSlug}/${session.username}`);
 	}
 
+	const pbToken = event.cookies.get('pb_token') || '';
+	const famId = session?.famId || '';
+	const childId = session?.id || '';
+
+	const empty = {
+		role: 'child' as const,
+		token: pbToken,
+		memberId: childId,
+		famId,
+		verified: false,
+		memberName: session?.name || '',
+		memberColor: session?.color || '',
+		templates: [] as never[],
+		assigned: [] as never[],
+		completions: [] as never[],
+		rewards: [] as never[],
+		bonusConfigs: [] as never[],
+		tallies: {} as Record<string, unknown>,
+		payday: 1,
+		paydayTime: '18:00',
+		timezone: 'auto'
+	};
+
+	if (!pbToken || !famId) return empty;
+
 	try {
-		const res = await fetch(`${HONO_URL}/api/members/verify-token`, {
+		const choresRes = await fetch(`${HONO_URL}/api/members/my-chores`, {
 			method: 'POST',
-			headers: { 'Content-Type': 'application/json' },
-			body: JSON.stringify({ deviceToken, famSlug })
+			headers: { Authorization: `Bearer ${pbToken}` }
 		});
-		const data = await res.json();
-		if (!res.ok || data.name !== username) {
-			return {
-				role: 'child',
-				token: deviceToken,
-				memberId: '',
-				verified: false,
-				famId: '',
-				memberName: '',
-				memberColor: '',
-				templates: [],
-				assigned: [],
-				completions: [],
-				rewards: [],
-				bonusConfigs: [],
-				tallies: {}
-			};
-		}
-
-		let chores: any = {};
-		try {
-			const choresRes = await fetch(`${HONO_URL}/api/members/my-chores`, {
-				method: 'POST',
-				headers: { 'x-device-token': deviceToken, 'x-device-famid': data.famId }
-			});
-			chores = await choresRes.json();
-		} catch {}
-
+		if (!choresRes.ok) return empty;
+		const chores = await choresRes.json();
 		return {
 			role: 'child',
-			token: deviceToken,
-			memberId: data.memberId,
-			famId: data.famId,
+			token: pbToken,
+			memberId: childId,
+			famId,
 			verified: true,
-			memberName: data.name,
-			memberColor: data.color,
+			memberName: session?.name || '',
+			memberColor: session?.color || '',
 			templates: chores.templates || [],
 			assigned: chores.assigned || [],
 			completions: chores.completions || [],
@@ -127,29 +114,14 @@ export async function load(event) {
 			simulateEow: !!chores.simulateEow
 		};
 	} catch {
-		return {
-			role: 'child',
-			token: deviceToken,
-			memberId: '',
-			verified: false,
-			famId: '',
-			templates: [],
-			assigned: [],
-			completions: [],
-			rewards: [],
-			bonusConfigs: [],
-			tallies: {},
-			payday: 1,
-			paydayTime: '18:00',
-			timezone: 'auto'
-		};
+		return empty;
 	}
 }
 
 export const actions = {
 	setEow: async (event) => {
-		if (!event.locals.session) throw redirect(303, '/login');
-		const famId = event.locals.session.famId;
+		if (!event.locals.user) throw redirect(303, '/login');
+		const famId = event.locals.user.famId;
 		const fd = await event.request.formData();
 		const on = fd.get('on') === 'true';
 		try {
@@ -161,8 +133,8 @@ export const actions = {
 	},
 
 	previewEow: async (event) => {
-		if (!event.locals.session) throw redirect(303, '/login');
-		const famId = event.locals.session.famId;
+		if (!event.locals.user) throw redirect(303, '/login');
+		const famId = event.locals.user.famId;
 		try {
 			const preview = await hono.admin.eowPreview(event, famId);
 			await hono.admin.updateSettings(event, famId, { simulateEow: true });
@@ -173,8 +145,8 @@ export const actions = {
 	},
 
 	claim: async (event) => {
-		if (!event.locals.session) throw redirect(303, '/login');
-		const famId = event.locals.session.famId;
+		if (!event.locals.user) throw redirect(303, '/login');
+		const famId = event.locals.user.famId;
 		const fd = await event.request.formData();
 		const rewardId = fd.get('id') as string;
 		try {
@@ -186,8 +158,8 @@ export const actions = {
 	},
 
 	issueAll: async (event) => {
-		if (!event.locals.session) throw redirect(303, '/login');
-		const famId = event.locals.session.famId;
+		if (!event.locals.user) throw redirect(303, '/login');
+		const famId = event.locals.user.famId;
 		const fd = await event.request.formData();
 		const memberId = fd.get('memberId') as string;
 		try {
@@ -199,8 +171,8 @@ export const actions = {
 	},
 
 	revoke: async (event) => {
-		if (!event.locals.session) throw redirect(303, '/login');
-		const famId = event.locals.session.famId;
+		if (!event.locals.user) throw redirect(303, '/login');
+		const famId = event.locals.user.famId;
 		const fd = await event.request.formData();
 		const completionId = fd.get('id') as string;
 		try {
@@ -212,8 +184,8 @@ export const actions = {
 	},
 
 	trigger: async (event) => {
-		if (!event.locals.session) throw redirect(303, '/login');
-		const famId = event.locals.session.famId;
+		if (!event.locals.user) throw redirect(303, '/login');
+		const famId = event.locals.user.famId;
 		const fd = await event.request.formData();
 		const configId = fd.get('configId') as string;
 		const memberId = fd.get('memberId') as string;