User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/lib/Store.php

@@ -12,14 +12,20 @@ final class StaleRevisionException extends RuntimeException
 
 /**
  * File-based project store: one JSON document per project in `data/projects/{id}.json`.
- * Each file wraps the project with metadata: { id, name, revision, updatedAt, project }.
+ * Each file wraps the project with metadata: { id, name, owner, revision, updatedAt, project }.
  * Writes are atomic (temp file + rename) and guarded by an integer revision so that a
  * stale client (second tab, old session) cannot silently overwrite newer work.
+ *
+ * A store belongs to one signed-in user: it lists, reads and writes only the projects whose
+ * `owner` is that user. Someone else's project is answered as missing rather than as forbidden,
+ * because "this id exists" is already more than a stranger should learn.
  */
 final class Store
 {
-    public function __construct(private readonly string $dir)
-    {
+    public function __construct(
+        private readonly string $dir,
+        private readonly string $owner,
+    ) {
         if (!is_dir($this->dir) && !mkdir($this->dir, 0775, true) && !is_dir($this->dir)) {
             throw new RuntimeException("Cannot create data directory {$this->dir}");
         }
@@ -41,7 +47,7 @@ final class Store
         $items = [];
         foreach (glob($this->dir . '/*.json') ?: [] as $file) {
             $doc = $this->readFile($file);
-            if ($doc === null) {
+            if ($doc === null || $doc['owner'] !== $this->owner) {
                 continue;
             }
             $items[] = [
@@ -55,13 +61,13 @@ final class Store
         return $items;
     }
 
-    /** @return array{id:string,name:string,revision:int,updatedAt:string,project:array}|null */
+    /** @return array{id:string,name:string,owner:string,revision:int,updatedAt:string,project:array}|null */
     public function load(string $id): ?array
     {
-        return $this->readFile($this->path($id));
+        return $this->own($this->readFile($this->path($id)));
     }
 
-    /** @return array{id:string,name:string,revision:int,updatedAt:string,project:array} */
+    /** @return array{id:string,name:string,owner:string,revision:int,updatedAt:string,project:array} */
     public function create(string $name): array
     {
         do {
@@ -93,7 +99,7 @@ final class Store
             throw new RuntimeException('Cannot acquire project lock');
         }
         try {
-            $current = $this->readFile($path);
+            $current = $this->own($this->readFile($path));
             if ($current === null) {
                 return null;
             }
@@ -114,10 +120,19 @@ final class Store
 
     public function delete(string $id): bool
     {
+        if ($this->load($id) === null) {
+            return false;
+        }
         $path = $this->path($id);
         return file_exists($path) && unlink($path);
     }
 
+    /** The document, or null when it belongs to someone else. */
+    private function own(?array $doc): ?array
+    {
+        return $doc !== null && $doc['owner'] === $this->owner ? $doc : null;
+    }
+
     private function path(string $id): string
     {
         return $this->dir . '/' . $id . '.json';
@@ -128,6 +143,7 @@ final class Store
         return [
             'id' => $id,
             'name' => $name,
+            'owner' => $this->owner,
             'revision' => $revision,
             'updatedAt' => gmdate('c'),
             'project' => $project,
@@ -145,6 +161,9 @@ final class Store
             return null;
         }
         $doc['name'] = is_string($doc['name'] ?? null) ? $doc['name'] : 'Untitled';
+        // A file without an owner belongs to nobody and is therefore invisible to everybody –
+        // the safe way round, and the one that shows up straight away if a migration is missed.
+        $doc['owner'] = is_string($doc['owner'] ?? null) ? $doc['owner'] : '';
         $doc['updatedAt'] = is_string($doc['updatedAt'] ?? null) ? $doc['updatedAt'] : '';
         $doc['revision'] = (int) $doc['revision'];
         return $doc;