chore: bean organisation

.beans/archive/nuzlocke-tracker-h8zw--crash-hide-edit-controls-for-non-owners-in-fronten.md

@@ -0,0 +1,28 @@
+---
+# nuzlocke-tracker-h8zw
+title: 'Crash: Hide edit controls for non-owners in frontend'
+status: completed
+type: bug
+priority: high
+created_at: 2026-03-21T12:49:42Z
+updated_at: 2026-03-21T12:50:37Z
+parent: nuzlocke-tracker-bw1m
+blocking:
+    - nuzlocke-tracker-i2va
+---
+
+Bean was found in 'in-progress' status on startup but no agent was running.
+This likely indicates a crash or unexpected termination.
+
+Manual review required before retrying.
+
+Bean: nuzlocke-tracker-i2va
+Title: Hide edit controls for non-owners in frontend
+
+## Summary of Changes
+
+Investigation shows commit `3bd24fc` already implemented all required changes:
+- Added `useAuth` and `canEdit = isOwner` to both `RunEncounters.tsx` and `RunDashboard.tsx`
+- All mutation UI guarded behind `canEdit` (Log Shiny/Egg, End Run, Randomize All, HoF Edit, Boss Battle, route clicks, visibility, naming scheme)
+- Read-only banners displayed for non-owners
+- No code changes needed — work was already complete

.beans/archive/nuzlocke-tracker-wwnu--auth-hardening-admin-ownership-display-and-mfa.md

@@ -0,0 +1,23 @@
+---
+# nuzlocke-tracker-wwnu
+title: Auth hardening, admin ownership display, and MFA
+status: completed
+type: epic
+priority: high
+created_at: 2026-03-21T12:18:09Z
+updated_at: 2026-03-21T12:38:27Z
+---
+
+Harden authentication and authorization across the app after the initial auth integration went live.
+
+## Goals
+
+- [x] Runs are only editable by their owner (encounters, deaths, bosses, settings)
+- [x] Frontend hides edit controls for non-owners and logged-out users
+- [x] Admin pages show owner info for runs and genlockes
+- [ ] Genlocke visibility/ownership inferred from first leg's run
+- [ ] Optional TOTP MFA for email/password signups
+
+## Context
+
+Auth is live with Google/Discord OAuth + email/password. Backend has `require_auth` on mutations but doesn't check ownership on encounters or genlockes. Frontend `RunEncounters.tsx` has zero auth checks. Admin pages lack owner columns. Genlocke model has no `owner_id` or `visibility`.

.beans/archive/nuzlocke-tracker-wwwq--crash-show-owner-info-in-admin-pages.md

@@ -0,0 +1,24 @@
+---
+# nuzlocke-tracker-wwwq
+title: 'Crash: Show owner info in admin pages'
+status: completed
+type: bug
+priority: high
+created_at: 2026-03-21T12:49:42Z
+updated_at: 2026-03-21T12:51:18Z
+parent: nuzlocke-tracker-bw1m
+blocking:
+    - nuzlocke-tracker-2fp1
+---
+
+Bean was found in 'in-progress' status on startup but no agent was running.
+This likely indicates a crash or unexpected termination.
+
+Manual review required before retrying.
+
+Bean: nuzlocke-tracker-2fp1
+Title: Show owner info in admin pages
+
+## Reasons for Scrapping
+
+The original bean (nuzlocke-tracker-2fp1) had all work completed and committed before the crash occurred. The agent crashed after completing the implementation but before marking the bean as completed. No additional work was needed - just updated the original bean's status to completed.

.beans/nuzlocke-tracker-532i--ux-remove-level-field-from-boss-defeat-modal.md

@@ -0,0 +1,29 @@
+---
+# nuzlocke-tracker-532i
+title: 'UX: Make level field optional in boss defeat modal'
+status: todo
+type: feature
+priority: normal
+created_at: 2026-03-21T21:50:48Z
+updated_at: 2026-03-21T22:04:08Z
+---
+
+## Problem
+
+When recording which team members beat a boss, users must manually enter a level for each pokemon. Since the app does not track levels anywhere else, this is unnecessary friction with no payoff.
+
+## Current Implementation
+
+- Level input in `BossDefeatModal.tsx:200-211`
+- DB column `boss_result_team.level` is `SmallInteger NOT NULL` (in `models.py`)
+- Level is required in the API schema
+
+## Proposed Solution
+
+Remove the level field entirely from the UI and make it optional in the backend:
+
+- [ ] Remove level input from `BossDefeatModal.tsx`
+- [ ] Make `level` column nullable in the database (alembic migration)
+- [ ] Update the API schema to make level optional (default to null)
+- [ ] Update any backend validation that requires level
+- [ ] Verify boss result display still works without level data

.beans/nuzlocke-tracker-8b25--ux-allow-editing-caught-pokemon-details-on-run-pag.md

@@ -0,0 +1,36 @@
+---
+# nuzlocke-tracker-8b25
+title: 'UX: Allow editing caught pokemon details on run page'
+status: draft
+type: feature
+priority: normal
+created_at: 2026-03-21T22:00:55Z
+updated_at: 2026-03-21T22:04:08Z
+---
+
+## Problem
+
+Users can mistype catch level, nickname, or other details when recording an encounter, but there's no way to correct mistakes from the run page. The only option is to go through admin — which doesn't even support editing encounters for a specific run.
+
+## Current State
+
+- **Backend `EncounterUpdate` schema** (`backend/src/app/schemas/encounter.py:18-23`): Supports `nickname`, `status`, `faint_level`, `death_cause`, `current_pokemon_id` — but NOT `catch_level`
+- **Frontend `UpdateEncounterInput`** (`frontend/src/types/game.ts:169-175`): Same fields as backend, missing `catch_level`
+- **Run page encounter modal**: Clicking a route with an existing encounter opens the modal in "edit" mode, but only allows changing pokemon/nickname/status — no catch_level editing
+- The encounter modal is the create/edit modal — editing is done by re-opening it on an existing encounter
+
+## Approach
+
+### Backend
+- [ ] Add `catch_level: int | None = None` to `EncounterUpdate` schema
+- [ ] Verify the PATCH `/encounters/{id}` endpoint applies `catch_level` updates (check `encounters.py` update handler)
+
+### Frontend
+- [ ] Add `catchLevel?: number` to `UpdateEncounterInput` type
+- [ ] Ensure the encounter modal shows catch_level as editable when editing an existing encounter
+- [ ] Add catch_level field to the encounter edit modal (shown when editing existing encounters)
+
+### Testing
+- [ ] Test updating catch_level via API
+- [ ] Test that the frontend sends catch_level in update requests
+- [ ] Verify existing create/update flows still work

.beans/nuzlocke-tracker-9i9m--admin-interface-overhaul.md

@@ -0,0 +1,38 @@
+---
+# nuzlocke-tracker-9i9m
+title: Admin interface overhaul
+status: draft
+type: epic
+created_at: 2026-03-21T21:58:48Z
+updated_at: 2026-03-21T21:58:48Z
+---
+
+Overhaul the admin interface to reduce navigation depth for game data management and add proper run administration.
+
+## Problems
+
+1. **Game data navigation is too deep** — Adding an encounter requires navigating Games → Game Detail → Route Detail (3 levels). This is rare but painful when needed.
+2. **No way to search across admin entities** — You have to manually drill down through the hierarchy to find anything.
+3. **Run admin is view+delete only** — Clicking a run row immediately opens a delete confirmation. No way to edit name, status, owner, visibility, or other metadata.
+
+## Solution
+
+### Game Data Navigation
+- Add a **global search bar** to the admin layout header that lets you jump directly to any game, route, encounter, or pokemon by name
+- Add **flattened views** for routes (`/admin/routes`) and encounters (`/admin/encounters`) as top-level admin pages with game/region filters, so you don't have to drill down through the game hierarchy
+
+### Run Administration
+- Add a **slide-over panel** that opens when clicking a run row (replacing the current delete-on-click behavior)
+- Panel shows editable metadata: name, status, owner, visibility, rules, naming scheme
+- Add admin-only backend endpoint for owner reassignment
+- Keep delete as a button inside the panel (not the primary action)
+
+## Success Criteria
+
+- [ ] Global admin search bar in layout header
+- [ ] Flattened routes page (`/admin/routes`) with game filter
+- [ ] Flattened encounters page (`/admin/encounters`) with game/route filters
+- [ ] Admin nav updated with new pages
+- [ ] Run slide-over panel with metadata editing
+- [ ] Admin endpoint for owner reassignment
+- [ ] Delete moved inside slide-over panel

.beans/nuzlocke-tracker-b4d8--flattened-admin-routes-page.md

@@ -0,0 +1,37 @@
+---
+# nuzlocke-tracker-b4d8
+title: Flattened admin routes page
+status: draft
+type: feature
+created_at: 2026-03-21T21:59:20Z
+updated_at: 2026-03-21T21:59:20Z
+parent: nuzlocke-tracker-9i9m
+---
+
+Add a top-level `/admin/routes` page that shows all routes across all games, with filters for game and region. Eliminates the need to drill into a specific game just to find a route.
+
+## Approach
+
+- New page at `/admin/routes` showing all routes in a table
+- Columns: Route Name, Game, Region/Area, Order, Pokemon Count
+- Filters: game dropdown, text search
+- Clicking a route navigates to the existing `/admin/games/:gameId/routes/:routeId` detail page
+- Reuse existing `useRoutes` or add a new hook that fetches all routes across games
+
+## Files to modify
+
+- `frontend/src/pages/admin/AdminRoutes.tsx` — New page
+- `frontend/src/pages/admin/index.ts` — Export new page
+- `frontend/src/App.tsx` — Add route
+- `frontend/src/components/admin/AdminLayout.tsx` — Add nav item
+- Possibly `frontend/src/hooks/` — Hook for fetching all routes
+- Possibly `backend/app/routes/` — Endpoint for listing all routes (if not already available)
+
+## Checklist
+
+- [ ] AdminRoutes page with table of all routes
+- [ ] Game filter dropdown
+- [ ] Text search filter
+- [ ] Click navigates to route detail page
+- [ ] Nav item added to admin sidebar
+- [ ] Route registered in App.tsx

.beans/nuzlocke-tracker-e372--flattened-admin-encounters-page.md

@@ -0,0 +1,39 @@
+---
+# nuzlocke-tracker-e372
+title: Flattened admin encounters page
+status: draft
+type: feature
+priority: normal
+created_at: 2026-03-21T21:59:20Z
+updated_at: 2026-03-21T22:04:08Z
+parent: nuzlocke-tracker-9i9m
+---
+
+Add a top-level `/admin/encounters` page that shows all encounters across all games and routes, with filters. This is the deepest entity in the current hierarchy and the most painful to reach.
+
+## Approach
+
+- New page at `/admin/encounters` showing all encounters in a table
+- Columns: Pokemon, Route, Game, Encounter Rate, Method
+- Filters: game dropdown, route dropdown (filtered by selected game), pokemon search
+- Clicking an encounter navigates to the route detail page where it can be edited
+- Requires new backend endpoint: GET /admin/encounters returning encounters joined with route name, game name, and pokemon name. Response shape: `{ id, pokemon_name, route_name, game_name, encounter_rate, method }`
+
+## Files to modify
+
+- `frontend/src/pages/admin/AdminEncounters.tsx` — New page
+- `frontend/src/pages/admin/index.ts` — Export new page
+- `frontend/src/App.tsx` — Add route
+- `frontend/src/components/admin/AdminLayout.tsx` — Add nav item
+- `backend/app/routes/` — Endpoint for listing all encounters with game/route context
+
+## Checklist
+
+- [ ] AdminEncounters page with table of all encounters
+- [ ] Game filter dropdown
+- [ ] Route filter dropdown (cascading from game)
+- [ ] Pokemon name search
+- [ ] Click navigates to route detail page
+- [ ] Nav item added to admin sidebar
+- [ ] Route registered in App.tsx
+- [ ] Backend endpoint for listing all encounters

.beans/nuzlocke-tracker-lkro--ux-make-team-section-a-floating-sidebar-on-desktop.md

@@ -0,0 +1,36 @@
+---
+# nuzlocke-tracker-lkro
+title: 'UX: Make team section a floating sidebar on desktop'
+status: todo
+type: feature
+priority: normal
+created_at: 2026-03-21T21:50:48Z
+updated_at: 2026-03-21T22:04:08Z
+---
+
+## Problem
+
+During a run, the team section is rendered inline at the top of the encounters page. When scrolling through routes and bosses, the team disappears and users must scroll back up to evolve pokemon or check their team. This creates constant friction during gameplay.
+
+## Current Implementation
+
+- Team section rendered in `RunEncounters.tsx:1214-1288`
+- Inline in the page flow, above the encounters list
+- No sticky/floating behavior
+
+## Proposed Solution
+
+Make the team section a sticky sidebar on desktop viewports (2-column layout):
+- **Desktop (lg breakpoint, ≥1024px — Tailwind v4 default):** Encounters on the left, team pinned in a right sidebar that scrolls with the page
+- **Mobile:** Keep current stacked layout (team above encounters)
+
+Alternative: A floating action button (FAB) that opens the team in a slide-over panel.
+
+## Checklist
+
+- [ ] Add responsive 2-column layout to RunEncounters page (desktop only)
+- [ ] Move team section into a sticky sidebar column
+- [ ] Ensure sidebar scrolls independently if team is taller than viewport
+- [ ] Keep current stacked layout on mobile/tablet
+- [ ] Test with various team sizes (0-6 pokemon)
+- [ ] Test evolution/nickname editing still works from sidebar

.beans/nuzlocke-tracker-mmre--admin-global-search-bar.md

@@ -0,0 +1,36 @@
+---
+# nuzlocke-tracker-mmre
+title: Admin global search bar
+status: draft
+type: feature
+priority: normal
+created_at: 2026-03-21T21:59:20Z
+updated_at: 2026-03-21T22:04:08Z
+parent: nuzlocke-tracker-9i9m
+---
+
+Add a search bar to the admin layout header that searches across all admin entities (games, routes, encounters, pokemon, evolutions, runs) and lets you jump directly to the relevant page.
+
+## Approach
+
+- Add a search input to `AdminLayout.tsx` above the nav
+- Use a debounced search that queries multiple endpoints (or a single backend search endpoint)
+- Show results in a dropdown grouped by entity type (Games, Routes, Encounters, Pokemon, Runs)
+- Each result links directly to the relevant admin page (e.g., clicking a route goes to `/admin/games/:gameId/routes/:routeId`)
+- Keyboard shortcut (Cmd/Ctrl+K) to focus the search bar
+
+## Files to modify
+
+- `frontend/src/components/admin/AdminLayout.tsx` — Add search bar UI
+- `frontend/src/components/admin/AdminSearchBar.tsx` — New component
+- `frontend/src/hooks/useAdminSearch.ts` — New hook for search logic
+- `backend/src/app/api/search.py` — New unified search endpoint (required — client-side search across 5+ entity types is too slow)
+
+## Checklist
+
+- [ ] Search bar component with debounced input
+- [ ] Search across games, routes, encounters, pokemon, runs
+- [ ] Results dropdown grouped by entity type
+- [ ] Click result navigates to correct admin page
+- [ ] Keyboard shortcut (Cmd/Ctrl+K) to focus
+- [ ] Empty state and loading state

.beans/nuzlocke-tracker-ru96--admin-run-slide-over-panel-with-metadata-editing.md

@@ -0,0 +1,50 @@
+---
+# nuzlocke-tracker-ru96
+title: Admin run slide-over panel with metadata editing
+status: draft
+type: feature
+priority: normal
+created_at: 2026-03-21T21:59:20Z
+updated_at: 2026-03-21T22:04:08Z
+parent: nuzlocke-tracker-9i9m
+---
+
+Replace the current click-to-delete behavior on the runs page with a slide-over panel that shows run details and allows editing metadata.
+
+## Current problem
+
+Clicking any run row in AdminRuns immediately opens a delete confirmation modal. There is no way to view or edit run metadata (name, status, owner, visibility).
+
+## Approach
+
+- Replace `onRowClick` from opening delete modal to opening a slide-over panel
+- Panel slides in from the right over the runs list
+- Panel shows all run metadata with inline editing:
+  - Name (text input)
+  - Status (dropdown: active/completed/failed — matches `RunStatus` type)
+  - Owner (user search/select — requires new admin endpoint)
+  - Visibility (dropdown: public/private/unlisted)
+  - Rules, Naming Scheme (if applicable)
+  - Started At, Completed At (read-only)
+- Save button to persist changes
+- Delete button at bottom of panel (with confirmation)
+- New admin-only backend endpoint: PUT /admin/runs/:id for owner reassignment and other admin-only fields\n- New admin-only endpoint: GET /admin/users for user search/select (currently no list-users endpoint exists — only /users/me)
+
+## Files to modify
+
+- `frontend/src/pages/admin/AdminRuns.tsx` — Replace delete-on-click with slide-over
+- `frontend/src/components/admin/RunSlideOver.tsx` — New slide-over component
+- `frontend/src/hooks/useRuns.ts` — Add admin update mutation
+- `backend/app/routes/admin.py` — Add admin run update endpoint
+- `backend/app/schemas/run.py` — Add admin-specific update schema (with owner_id)
+
+## Checklist
+
+- [ ] SlideOver component (reusable, slides from right)
+- [ ] RunSlideOver with editable fields
+- [ ] AdminRuns opens slide-over on row click (not delete modal)
+- [ ] Save functionality with optimistic updates
+- [ ] Delete button inside slide-over with confirmation
+- [ ] Admin backend endpoint for run updates (including owner reassignment)
+- [ ] Admin run update schema with owner_id field
+- [ ] User search/select for owner reassignment

.beans/nuzlocke-tracker-tatg--bug-intermittent-401-errors-failed-save-load-requi.md

@@ -0,0 +1,33 @@
+---
+# nuzlocke-tracker-tatg
+title: 'Bug: Intermittent 401 errors / failed save-load requiring page reload'
+status: todo
+type: bug
+priority: high
+created_at: 2026-03-21T21:50:48Z
+updated_at: 2026-03-21T21:50:48Z
+---
+
+## Problem
+
+During gameplay, the app intermittently fails to load or save data. A page reload fixes the issue. Likely caused by expired Supabase JWT tokens not being refreshed automatically before API calls.
+
+## Current Implementation
+
+- Auth uses Supabase JWTs verified with HS256 (`backend/auth.py:39-44`)
+- Frontend gets token via `supabase.auth.getSession()` in `client.ts:16-21`
+- `getAuthHeaders()` returns the cached session token without checking expiry
+- When the token expires between interactions, API calls return 401
+- Page reload triggers a fresh `getSession()` which refreshes the token
+
+## Root Cause Analysis
+
+`getSession()` returns the cached token. If it's expired, the frontend sends an expired JWT to the backend, which rejects it with 401. The frontend doesn't call `refreshSession()` or handle token refresh before API calls.
+
+## Proposed Fix
+
+- [ ] Add token refresh logic before API calls (check expiry, call `refreshSession()` if needed)
+- [ ] Add 401 response interceptor that automatically refreshes token and retries the request
+- [ ] Verify Supabase client `autoRefreshToken` option is enabled
+- [ ] Test with short-lived tokens to confirm refresh works
+- [ ] Check if there's a race condition when multiple API calls trigger refresh simultaneously