feat: add auth system, boss pokemon details, moves/abilities API, and run ownership

Add user authentication with login/signup/protected routes, boss pokemon
detail fields and result team tracking, moves and abilities selector
components and API, run ownership and visibility controls, and various
UI improvements across encounters, run list, and journal pages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/src/app/api/bosses.py

@@ -5,10 +5,13 @@ from sqlalchemy import or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
+from app.core.auth import AuthUser, require_auth
 from app.core.database import get_session
 from app.models.boss_battle import BossBattle
 from app.models.boss_pokemon import BossPokemon
 from app.models.boss_result import BossResult
+from app.models.boss_result_team import BossResultTeam
+from app.models.encounter import Encounter
 from app.models.game import Game
 from app.models.nuzlocke_run import NuzlockeRun
 from app.models.pokemon import Pokemon
@@ -28,6 +31,18 @@ from app.seeds.loader import upsert_bosses
 router = APIRouter()
 
 
+def _boss_pokemon_load_options():
+    """Standard eager-loading options for BossPokemon relationships."""
+    return (
+        selectinload(BossBattle.pokemon).selectinload(BossPokemon.pokemon),
+        selectinload(BossBattle.pokemon).selectinload(BossPokemon.ability),
+        selectinload(BossBattle.pokemon).selectinload(BossPokemon.move1),
+        selectinload(BossBattle.pokemon).selectinload(BossPokemon.move2),
+        selectinload(BossBattle.pokemon).selectinload(BossPokemon.move3),
+        selectinload(BossBattle.pokemon).selectinload(BossPokemon.move4),
+    )
+
+
 async def _get_version_group_id(session: AsyncSession, game_id: int) -> int:
     game = await session.get(Game, game_id)
     if game is None:
@@ -53,7 +68,7 @@ async def list_bosses(
     query = (
         select(BossBattle)
         .where(BossBattle.version_group_id == vg_id)
-        .options(selectinload(BossBattle.pokemon).selectinload(BossPokemon.pokemon))
+        .options(*_boss_pokemon_load_options())
         .order_by(BossBattle.order)
     )
 
@@ -71,6 +86,7 @@ async def reorder_bosses(
     game_id: int,
     data: BossReorderRequest,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 
@@ -101,7 +117,7 @@ async def reorder_bosses(
     result = await session.execute(
         select(BossBattle)
         .where(BossBattle.version_group_id == vg_id)
-        .options(selectinload(BossBattle.pokemon).selectinload(BossPokemon.pokemon))
+        .options(*_boss_pokemon_load_options())
         .order_by(BossBattle.order)
     )
     return result.scalars().all()
@@ -114,6 +130,7 @@ async def create_boss(
     game_id: int,
     data: BossBattleCreate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 
@@ -133,7 +150,7 @@ async def create_boss(
     result = await session.execute(
         select(BossBattle)
         .where(BossBattle.id == boss.id)
-        .options(selectinload(BossBattle.pokemon).selectinload(BossPokemon.pokemon))
+        .options(*_boss_pokemon_load_options())
     )
     return result.scalar_one()
 
@@ -144,6 +161,7 @@ async def update_boss(
     boss_id: int,
     data: BossBattleUpdate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 
@@ -158,7 +176,7 @@ async def update_boss(
     result = await session.execute(
         select(BossBattle)
         .where(BossBattle.id == boss_id, BossBattle.version_group_id == vg_id)
-        .options(selectinload(BossBattle.pokemon).selectinload(BossPokemon.pokemon))
+        .options(*_boss_pokemon_load_options())
     )
     boss = result.scalar_one_or_none()
     if boss is None:
@@ -174,7 +192,7 @@ async def update_boss(
     result = await session.execute(
         select(BossBattle)
         .where(BossBattle.id == boss.id)
-        .options(selectinload(BossBattle.pokemon).selectinload(BossPokemon.pokemon))
+        .options(*_boss_pokemon_load_options())
     )
     return result.scalar_one()
 
@@ -184,6 +202,7 @@ async def delete_boss(
     game_id: int,
     boss_id: int,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 
@@ -206,6 +225,7 @@ async def bulk_import_bosses(
     game_id: int,
     items: list[BulkBossItem],
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 
@@ -248,6 +268,7 @@ async def set_boss_team(
     boss_id: int,
     team: list[BossPokemonInput],
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 
@@ -272,6 +293,13 @@ async def set_boss_team(
             level=item.level,
             order=item.order,
             condition_label=item.condition_label,
+            ability_id=item.ability_id,
+            held_item=item.held_item,
+            nature=item.nature,
+            move1_id=item.move1_id,
+            move2_id=item.move2_id,
+            move3_id=item.move3_id,
+            move4_id=item.move4_id,
         )
         session.add(bp)
 
@@ -286,7 +314,7 @@ async def set_boss_team(
     result = await session.execute(
         select(BossBattle)
         .where(BossBattle.id == boss.id)
-        .options(selectinload(BossBattle.pokemon).selectinload(BossPokemon.pokemon))
+        .options(*_boss_pokemon_load_options())
     )
     return result.scalar_one()
 
@@ -301,7 +329,10 @@ async def list_boss_results(run_id: int, session: AsyncSession = Depends(get_ses
         raise HTTPException(status_code=404, detail="Run not found")
 
     result = await session.execute(
-        select(BossResult).where(BossResult.run_id == run_id).order_by(BossResult.id)
+        select(BossResult)
+        .where(BossResult.run_id == run_id)
+        .options(selectinload(BossResult.team))
+        .order_by(BossResult.id)
     )
     return result.scalars().all()
 
@@ -313,6 +344,7 @@ async def create_boss_result(
     run_id: int,
     data: BossResultCreate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     run = await session.get(NuzlockeRun, run_id)
     if run is None:
@@ -322,12 +354,30 @@ async def create_boss_result(
     if boss is None:
         raise HTTPException(status_code=404, detail="Boss battle not found")
 
+    # Validate team encounter IDs belong to this run
+    if data.team:
+        encounter_ids = [t.encounter_id for t in data.team]
+        enc_result = await session.execute(
+            select(Encounter).where(
+                Encounter.id.in_(encounter_ids), Encounter.run_id == run_id
+            )
+        )
+        found_encounters = {e.id for e in enc_result.scalars().all()}
+        missing = [eid for eid in encounter_ids if eid not in found_encounters]
+        if missing:
+            raise HTTPException(
+                status_code=400,
+                detail=f"Encounters not found in this run: {missing}",
+            )
+
     # Check for existing result (upsert)
     existing = await session.execute(
-        select(BossResult).where(
+        select(BossResult)
+        .where(
             BossResult.run_id == run_id,
             BossResult.boss_battle_id == data.boss_battle_id,
         )
+        .options(selectinload(BossResult.team))
     )
     result = existing.scalar_one_or_none()
 
@@ -335,6 +385,10 @@ async def create_boss_result(
         result.result = data.result
         result.attempts = data.attempts
         result.completed_at = datetime.now(UTC) if data.result == "won" else None
+        # Clear existing team and add new
+        for tm in result.team:
+            await session.delete(tm)
+        await session.flush()
     else:
         result = BossResult(
             run_id=run_id,
@@ -344,10 +398,26 @@ async def create_boss_result(
             completed_at=datetime.now(UTC) if data.result == "won" else None,
         )
         session.add(result)
+        await session.flush()
+
+    # Add team members
+    for tm in data.team:
+        team_member = BossResultTeam(
+            boss_result_id=result.id,
+            encounter_id=tm.encounter_id,
+            level=tm.level,
+        )
+        session.add(team_member)
 
     await session.commit()
-    await session.refresh(result)
-    return result
+
+    # Re-fetch with team loaded
+    fresh = await session.execute(
+        select(BossResult)
+        .where(BossResult.id == result.id)
+        .options(selectinload(BossResult.team))
+    )
+    return fresh.scalar_one()
 
 
 @router.delete("/runs/{run_id}/boss-results/{result_id}", status_code=204)
@@ -355,6 +425,7 @@ async def delete_boss_result(
     run_id: int,
     result_id: int,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     result = await session.execute(
         select(BossResult).where(

backend/src/app/api/encounters.py

@@ -5,6 +5,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import joinedload, selectinload
 
+from app.core.auth import AuthUser, require_auth
 from app.core.database import get_session
 from app.models.encounter import Encounter
 from app.models.evolution import Evolution
@@ -35,6 +36,7 @@ async def create_encounter(
     run_id: int,
     data: EncounterCreate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     # Validate run exists
     run = await session.get(NuzlockeRun, run_id)
@@ -137,6 +139,7 @@ async def update_encounter(
     encounter_id: int,
     data: EncounterUpdate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     encounter = await session.get(Encounter, encounter_id)
     if encounter is None:
@@ -163,7 +166,9 @@ async def update_encounter(
 
 @router.delete("/encounters/{encounter_id}", status_code=204)
 async def delete_encounter(
-    encounter_id: int, session: AsyncSession = Depends(get_session)
+    encounter_id: int,
+    session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     encounter = await session.get(Encounter, encounter_id)
     if encounter is None:
@@ -195,6 +200,7 @@ async def delete_encounter(
 async def bulk_randomize_encounters(
     run_id: int,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     # 1. Validate run
     run = await session.get(NuzlockeRun, run_id)

backend/src/app/api/games.py

@@ -6,6 +6,7 @@ from sqlalchemy import delete, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
+from app.core.auth import AuthUser, require_auth
 from app.core.database import get_session
 from app.models.boss_battle import BossBattle
 from app.models.game import Game
@@ -228,7 +229,11 @@ async def list_game_routes(
 
 
 @router.post("", response_model=GameResponse, status_code=201)
-async def create_game(data: GameCreate, session: AsyncSession = Depends(get_session)):
+async def create_game(
+    data: GameCreate,
+    session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
+):
     existing = await session.execute(select(Game).where(Game.slug == data.slug))
     if existing.scalar_one_or_none() is not None:
         raise HTTPException(
@@ -244,7 +249,10 @@ async def create_game(data: GameCreate, session: AsyncSession = Depends(get_sess
 
 @router.put("/{game_id}", response_model=GameResponse)
 async def update_game(
-    game_id: int, data: GameUpdate, session: AsyncSession = Depends(get_session)
+    game_id: int,
+    data: GameUpdate,
+    session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     game = await session.get(Game, game_id)
     if game is None:
@@ -269,7 +277,11 @@ async def update_game(
 
 
 @router.delete("/{game_id}", status_code=204)
-async def delete_game(game_id: int, session: AsyncSession = Depends(get_session)):
+async def delete_game(
+    game_id: int,
+    session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
+):
     result = await session.execute(
         select(Game).where(Game.id == game_id).options(selectinload(Game.runs))
     )
@@ -323,7 +335,10 @@ async def delete_game(game_id: int, session: AsyncSession = Depends(get_session)
 
 @router.post("/{game_id}/routes", response_model=RouteResponse, status_code=201)
 async def create_route(
-    game_id: int, data: RouteCreate, session: AsyncSession = Depends(get_session)
+    game_id: int,
+    data: RouteCreate,
+    session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 
@@ -339,6 +354,7 @@ async def reorder_routes(
     game_id: int,
     data: RouteReorderRequest,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 
@@ -365,6 +381,7 @@ async def update_route(
     route_id: int,
     data: RouteUpdate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 
@@ -385,6 +402,7 @@ async def delete_route(
     game_id: int,
     route_id: int,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 
@@ -419,6 +437,7 @@ async def bulk_import_routes(
     game_id: int,
     items: list[BulkRouteItem],
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     vg_id = await _get_version_group_id(session, game_id)
 

backend/src/app/api/genlockes.py

@@ -6,6 +6,7 @@ from sqlalchemy import update as sa_update
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
+from app.core.auth import AuthUser, require_auth
 from app.core.database import get_session
 from app.models.encounter import Encounter
 from app.models.evolution import Evolution
@@ -437,7 +438,9 @@ async def get_genlocke_lineages(
 
 @router.post("", response_model=GenlockeResponse, status_code=201)
 async def create_genlocke(
-    data: GenlockeCreate, session: AsyncSession = Depends(get_session)
+    data: GenlockeCreate,
+    session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     if not data.game_ids:
         raise HTTPException(status_code=400, detail="At least one game is required")
@@ -568,6 +571,7 @@ async def advance_leg(
     leg_order: int,
     data: AdvanceLegRequest | None = None,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     # Load genlocke with legs
     result = await session.execute(
@@ -822,6 +826,7 @@ async def update_genlocke(
     genlocke_id: int,
     data: GenlockeUpdate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     result = await session.execute(
         select(Genlocke)
@@ -858,6 +863,7 @@ async def update_genlocke(
 async def delete_genlocke(
     genlocke_id: int,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     genlocke = await session.get(Genlocke, genlocke_id)
     if genlocke is None:
@@ -889,6 +895,7 @@ async def add_leg(
     genlocke_id: int,
     data: AddLegRequest,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     genlocke = await session.get(Genlocke, genlocke_id)
     if genlocke is None:
@@ -931,6 +938,7 @@ async def remove_leg(
     genlocke_id: int,
     leg_id: int,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     result = await session.execute(
         select(GenlockeLeg).where(

backend/src/app/api/journal_entries.py

@@ -5,6 +5,7 @@ from fastapi import APIRouter, Depends, HTTPException, Response
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.auth import AuthUser, require_auth
 from app.core.database import get_session
 from app.models.boss_result import BossResult
 from app.models.journal_entry import JournalEntry
@@ -45,6 +46,7 @@ async def create_journal_entry(
     run_id: int,
     data: JournalEntryCreate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     # Validate run exists
     run = await session.get(NuzlockeRun, run_id)
@@ -97,6 +99,7 @@ async def update_journal_entry(
     entry_id: UUID,
     data: JournalEntryUpdate,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     result = await session.execute(
         select(JournalEntry).where(
@@ -135,6 +138,7 @@ async def delete_journal_entry(
     run_id: int,
     entry_id: UUID,
     session: AsyncSession = Depends(get_session),
+    _user: AuthUser = Depends(require_auth),
 ):
     result = await session.execute(
         select(JournalEntry).where(

backend/src/app/api/moves_abilities.py

@@ -0,0 +1,95 @@
+from fastapi import APIRouter, Depends, Query
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_session
+from app.models.ability import Ability
+from app.models.move import Move
+from app.schemas.move import (
+    AbilityResponse,
+    MoveResponse,
+    PaginatedAbilityResponse,
+    PaginatedMoveResponse,
+)
+
+router = APIRouter()
+
+
+@router.get("/moves", response_model=PaginatedMoveResponse)
+async def list_moves(
+    search: str | None = None,
+    limit: int = Query(default=20, ge=1, le=100),
+    offset: int = Query(default=0, ge=0),
+    session: AsyncSession = Depends(get_session),
+):
+    query = select(Move)
+
+    if search:
+        query = query.where(Move.name.ilike(f"%{search}%"))
+
+    query = query.order_by(Move.name).offset(offset).limit(limit)
+    result = await session.execute(query)
+    items = result.scalars().all()
+
+    # Count total
+    count_query = select(func.count()).select_from(Move)
+    if search:
+        count_query = count_query.where(Move.name.ilike(f"%{search}%"))
+    total_result = await session.execute(count_query)
+    total = total_result.scalar() or 0
+
+    return PaginatedMoveResponse(items=items, total=total, limit=limit, offset=offset)
+
+
+@router.get("/moves/{move_id}", response_model=MoveResponse)
+async def get_move(
+    move_id: int,
+    session: AsyncSession = Depends(get_session),
+):
+    move = await session.get(Move, move_id)
+    if move is None:
+        from fastapi import HTTPException
+
+        raise HTTPException(status_code=404, detail="Move not found")
+    return move
+
+
+@router.get("/abilities", response_model=PaginatedAbilityResponse)
+async def list_abilities(
+    search: str | None = None,
+    limit: int = Query(default=20, ge=1, le=100),
+    offset: int = Query(default=0, ge=0),
+    session: AsyncSession = Depends(get_session),
+):
+    query = select(Ability)
+
+    if search:
+        query = query.where(Ability.name.ilike(f"%{search}%"))
+
+    query = query.order_by(Ability.name).offset(offset).limit(limit)
+    result = await session.execute(query)
+    items = result.scalars().all()
+
+    # Count total
+    count_query = select(func.count()).select_from(Ability)
+    if search:
+        count_query = count_query.where(Ability.name.ilike(f"%{search}%"))
+    total_result = await session.execute(count_query)
+    total = total_result.scalar() or 0
+
+    return PaginatedAbilityResponse(
+        items=items, total=total, limit=limit, offset=offset
+    )
+
+
+@router.get("/abilities/{ability_id}", response_model=AbilityResponse)
+async def get_ability(
+    ability_id: int,
+    session: AsyncSession = Depends(get_session),
+):
+    ability = await session.get(Ability, ability_id)
+    if ability is None:
+        from fastapi import HTTPException
+
+        raise HTTPException(status_code=404, detail="Ability not found")
+    return ability

backend/src/app/api/routes.py

@@ -9,13 +9,16 @@ from app.api import (
     genlockes,
     health,
     journal_entries,
+    moves_abilities,
     pokemon,
     runs,
     stats,
+    users,
 )
 
 api_router = APIRouter()
 api_router.include_router(health.router)
+api_router.include_router(users.router, prefix="/users", tags=["users"])
 api_router.include_router(games.router, prefix="/games", tags=["games"])
 api_router.include_router(pokemon.router, tags=["pokemon"])
 api_router.include_router(evolutions.router, tags=["evolutions"])
@@ -25,4 +28,5 @@ api_router.include_router(genlockes.router, prefix="/genlockes", tags=["genlocke
 api_router.include_router(encounters.router, tags=["encounters"])
 api_router.include_router(stats.router, prefix="/stats", tags=["stats"])
 api_router.include_router(bosses.router, tags=["bosses"])
+api_router.include_router(moves_abilities.router, tags=["moves", "abilities"])
 api_router.include_router(export.router, prefix="/export", tags=["export"])

backend/src/app/api/runs.py

@@ -1,10 +1,12 @@
 from datetime import UTC, datetime
+from uuid import UUID
 
-from fastapi import APIRouter, Depends, HTTPException, Response
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import joinedload, selectinload
 
+from app.core.auth import AuthUser, get_current_user, require_auth
 from app.core.database import get_session
 from app.models.boss_result import BossResult
 from app.models.encounter import Encounter
@@ -12,8 +14,10 @@ from app.models.evolution import Evolution
 from app.models.game import Game
 from app.models.genlocke import GenlockeLeg
 from app.models.genlocke_transfer import GenlockeTransfer
-from app.models.nuzlocke_run import NuzlockeRun
+from app.models.nuzlocke_run import NuzlockeRun, RunVisibility
+from app.models.user import User
 from app.schemas.run import (
+    OwnerResponse,
     RunCreate,
     RunDetailResponse,
     RunGenlockeContext,
@@ -157,41 +161,136 @@ async def _compute_lineage_suggestion(
     return f"{base_name} {numeral}"
 
 
+def _build_run_response(run: NuzlockeRun) -> RunResponse:
+    """Build RunResponse with owner info if present."""
+    owner = None
+    if run.owner:
+        owner = OwnerResponse(id=run.owner.id, display_name=run.owner.display_name)
+    return RunResponse(
+        id=run.id,
+        game_id=run.game_id,
+        name=run.name,
+        status=run.status,
+        rules=run.rules,
+        hof_encounter_ids=run.hof_encounter_ids,
+        naming_scheme=run.naming_scheme,
+        visibility=run.visibility,
+        owner=owner,
+        started_at=run.started_at,
+        completed_at=run.completed_at,
+    )
+
+
+def _check_run_access(
+    run: NuzlockeRun, user: AuthUser | None, require_owner: bool = False
+) -> None:
+    """
+    Check if user can access the run.
+    Raises 403 for private runs if user is not owner.
+    If require_owner=True, always requires ownership (for mutations).
+    """
+    if run.owner_id is None:
+        # Unowned runs are accessible by everyone (legacy)
+        if require_owner:
+            raise HTTPException(
+                status_code=403, detail="Only the run owner can perform this action"
+            )
+        return
+
+    user_id = UUID(user.id) if user else None
+
+    if require_owner:
+        if user_id != run.owner_id:
+            raise HTTPException(
+                status_code=403, detail="Only the run owner can perform this action"
+            )
+        return
+
+    if run.visibility == RunVisibility.PRIVATE and user_id != run.owner_id:
+        raise HTTPException(status_code=403, detail="This run is private")
+
+
 @router.post("", response_model=RunResponse, status_code=201)
-async def create_run(data: RunCreate, session: AsyncSession = Depends(get_session)):
+async def create_run(
+    data: RunCreate,
+    session: AsyncSession = Depends(get_session),
+    user: AuthUser = Depends(require_auth),
+):
     # Validate game exists
     game = await session.get(Game, data.game_id)
     if game is None:
         raise HTTPException(status_code=404, detail="Game not found")
 
+    # Ensure user exists in local DB
+    user_id = UUID(user.id)
+    db_user = await session.get(User, user_id)
+    if db_user is None:
+        db_user = User(id=user_id, email=user.email or "")
+        session.add(db_user)
+
     run = NuzlockeRun(
         game_id=data.game_id,
+        owner_id=user_id,
         name=data.name,
         status="active",
+        visibility=data.visibility,
         rules=data.rules,
         naming_scheme=data.naming_scheme,
     )
     session.add(run)
     await session.commit()
-    await session.refresh(run)
-    return run
+
+    # Reload with owner relationship
+    result = await session.execute(
+        select(NuzlockeRun)
+        .where(NuzlockeRun.id == run.id)
+        .options(joinedload(NuzlockeRun.owner))
+    )
+    run = result.scalar_one()
+    return _build_run_response(run)
 
 
 @router.get("", response_model=list[RunResponse])
-async def list_runs(session: AsyncSession = Depends(get_session)):
-    result = await session.execute(
-        select(NuzlockeRun).order_by(NuzlockeRun.started_at.desc())
-    )
-    return result.scalars().all()
+async def list_runs(
+    request: Request,
+    session: AsyncSession = Depends(get_session),
+    user: AuthUser | None = Depends(get_current_user),
+):
+    """
+    List runs. Shows public runs and user's own private runs.
+    """
+    query = select(NuzlockeRun).options(joinedload(NuzlockeRun.owner))
+
+    if user:
+        user_id = UUID(user.id)
+        # Show public runs OR runs owned by current user
+        query = query.where(
+            (NuzlockeRun.visibility == RunVisibility.PUBLIC)
+            | (NuzlockeRun.owner_id == user_id)
+        )
+    else:
+        # Anonymous: only public runs
+        query = query.where(NuzlockeRun.visibility == RunVisibility.PUBLIC)
+
+    query = query.order_by(NuzlockeRun.started_at.desc())
+    result = await session.execute(query)
+    runs = result.scalars().all()
+    return [_build_run_response(run) for run in runs]
 
 
 @router.get("/{run_id}", response_model=RunDetailResponse)
-async def get_run(run_id: int, session: AsyncSession = Depends(get_session)):
+async def get_run(
+    run_id: int,
+    request: Request,
+    session: AsyncSession = Depends(get_session),
+    user: AuthUser | None = Depends(get_current_user),
+):
     result = await session.execute(
         select(NuzlockeRun)
         .where(NuzlockeRun.id == run_id)
         .options(
             joinedload(NuzlockeRun.game),
+            joinedload(NuzlockeRun.owner),
             selectinload(NuzlockeRun.encounters).joinedload(Encounter.pokemon),
             selectinload(NuzlockeRun.encounters).joinedload(Encounter.current_pokemon),
             selectinload(NuzlockeRun.encounters).joinedload(Encounter.route),
@@ -201,6 +300,9 @@ async def get_run(run_id: int, session: AsyncSession = Depends(get_session)):
     if run is None:
         raise HTTPException(status_code=404, detail="Run not found")
 
+    # Check visibility access
+    _check_run_access(run, user)
+
     # Check if this run belongs to a genlocke
     genlocke_context = None
     leg_result = await session.execute(
@@ -262,11 +364,20 @@ async def update_run(
     run_id: int,
     data: RunUpdate,
     session: AsyncSession = Depends(get_session),
+    user: AuthUser = Depends(require_auth),
 ):
-    run = await session.get(NuzlockeRun, run_id)
+    result = await session.execute(
+        select(NuzlockeRun)
+        .where(NuzlockeRun.id == run_id)
+        .options(joinedload(NuzlockeRun.owner))
+    )
+    run = result.scalar_one_or_none()
     if run is None:
         raise HTTPException(status_code=404, detail="Run not found")
 
+    # Check ownership for mutations (unowned runs allow anyone for backwards compat)
+    _check_run_access(run, user, require_owner=run.owner_id is not None)
+
     update_data = data.model_dump(exclude_unset=True)
 
     # Validate hof_encounter_ids if provided
@@ -352,16 +463,30 @@ async def update_run(
                     genlocke.status = "completed"
 
     await session.commit()
-    await session.refresh(run)
-    return run
+
+    # Reload with owner relationship
+    result = await session.execute(
+        select(NuzlockeRun)
+        .where(NuzlockeRun.id == run.id)
+        .options(joinedload(NuzlockeRun.owner))
+    )
+    run = result.scalar_one()
+    return _build_run_response(run)
 
 
 @router.delete("/{run_id}", status_code=204)
-async def delete_run(run_id: int, session: AsyncSession = Depends(get_session)):
+async def delete_run(
+    run_id: int,
+    session: AsyncSession = Depends(get_session),
+    user: AuthUser = Depends(require_auth),
+):
     run = await session.get(NuzlockeRun, run_id)
     if run is None:
         raise HTTPException(status_code=404, detail="Run not found")
 
+    # Check ownership for deletion (unowned runs allow anyone for backwards compat)
+    _check_run_access(run, user, require_owner=run.owner_id is not None)
+
     # Block deletion if run is linked to a genlocke leg
     leg_result = await session.execute(
         select(GenlockeLeg).where(GenlockeLeg.run_id == run_id)

backend/src/app/api/users.py

@@ -0,0 +1,106 @@
+from uuid import UUID
+
+from fastapi import APIRouter, Depends
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.auth import AuthUser, require_auth
+from app.core.database import get_session
+from app.models.user import User
+from app.schemas.base import CamelModel
+
+router = APIRouter()
+
+
+class UserResponse(CamelModel):
+    id: UUID
+    email: str
+    display_name: str | None = None
+
+
+@router.post("/me", response_model=UserResponse)
+async def sync_current_user(
+    session: AsyncSession = Depends(get_session),
+    auth_user: AuthUser = Depends(require_auth),
+):
+    """
+    Sync the current authenticated user from Supabase to local DB.
+    Creates user on first login, updates email if changed.
+    """
+    user_id = UUID(auth_user.id)
+
+    result = await session.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+
+    if user is None:
+        # First login - create user record
+        user = User(
+            id=user_id,
+            email=auth_user.email or "",
+            display_name=None,
+        )
+        session.add(user)
+    elif auth_user.email and user.email != auth_user.email:
+        # Email changed in Supabase - update local record
+        user.email = auth_user.email
+
+    await session.commit()
+    await session.refresh(user)
+    return user
+
+
+@router.get("/me", response_model=UserResponse)
+async def get_current_user(
+    session: AsyncSession = Depends(get_session),
+    auth_user: AuthUser = Depends(require_auth),
+):
+    """Get the current authenticated user's profile."""
+    user_id = UUID(auth_user.id)
+
+    result = await session.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+
+    if user is None:
+        # Auto-create if not exists (shouldn't happen if /me POST is called on login)
+        user = User(
+            id=user_id,
+            email=auth_user.email or "",
+            display_name=None,
+        )
+        session.add(user)
+        await session.commit()
+        await session.refresh(user)
+
+    return user
+
+
+class UserUpdateRequest(CamelModel):
+    display_name: str | None = None
+
+
+@router.patch("/me", response_model=UserResponse)
+async def update_current_user(
+    data: UserUpdateRequest,
+    session: AsyncSession = Depends(get_session),
+    auth_user: AuthUser = Depends(require_auth),
+):
+    """Update the current user's profile (display name)."""
+    user_id = UUID(auth_user.id)
+
+    result = await session.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+
+    if user is None:
+        user = User(
+            id=user_id,
+            email=auth_user.email or "",
+            display_name=data.display_name,
+        )
+        session.add(user)
+    else:
+        if data.display_name is not None:
+            user.display_name = data.display_name
+
+    await session.commit()
+    await session.refresh(user)
+    return user