feat(auth): sign in with OrangeCat — recognition, never authority

package.json

@@ -26,6 +26,7 @@
     "clsx": "2.1.1",
     "lucide-react": "0.441.0",
     "next": "14.2.5",
+    "next-auth": "^5.0.0-beta.32",
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "tailwindcss": "3.4.9",

scripts/add-member.ts

@@ -9,7 +9,13 @@
  * Usage:
  *   npx tsx scripts/add-member.ts --org orangecat --name "George" \
  *     --type HUMAN --address <bitcoin-address> [--pubkey <hex>] \
- *     [--system orangecat:cat] [--weight 1] [--mint-key]
+ *     [--system orangecat:cat] [--weight 1] [--mint-key] \
+ *     [--oc-actor <orangecat-actor-uuid>]
+ *
+ * --oc-actor (humans only) links the member to an OrangeCat identity so
+ * "Sign in with OrangeCat" recognizes them. The actor id is shown on
+ * /account after the person signs in — recognition only; voting authority
+ * stays with the Bitcoin key regardless.
  *
  * --mint-key (agents only) generates a transport API key, stores its sha256,
  * and prints the plaintext ONCE — it is never stored or shown again.
@@ -29,6 +35,7 @@ const { values } = parseArgs({
     system: { type: "string" },
     weight: { type: "string", default: "1" },
     "mint-key": { type: "boolean", default: false },
+    "oc-actor": { type: "string" },
   },
 });
 
@@ -46,6 +53,10 @@ async function main() {
     console.error("agents need --system (e.g. orangecat:cat) — which system attests this member's votes");
     process.exit(1);
   }
+  if (type === "AGENT" && values["oc-actor"]) {
+    console.error("--oc-actor is for HUMAN members only — agents are recognized by their API key, not a login");
+    process.exit(1);
+  }
 
   const organization = await prisma.organization.findUnique({ where: { slug: org } });
   if (!organization) {
@@ -73,6 +84,7 @@ async function main() {
         publicKeyHex: values.pubkey ?? null,
         votingWeight: values.weight,
         system: values.system ?? null,
+        ocActorId: values["oc-actor"] ?? null,
       },
     });
     await tx.auditEvent.create({
@@ -86,6 +98,7 @@ async function main() {
           memberType: type,
           bitcoinAddress: address,
           ...(values.system ? { system: values.system } : {}),
+          ...(values["oc-actor"] ? { ocActorId: values["oc-actor"] } : {}),
           note: "operator bootstrap — roster changes after genesis go through MEMBERSHIP votes",
         },
       },

src/app/account/page.tsx

@@ -0,0 +1,130 @@
+import Link from "next/link";
+import { auth, signIn, signOut, authEnabled } from "@/lib/auth";
+import { memberForActor } from "@/lib/auth/recognition";
+
+export const metadata = { title: "Account — Solon" };
+export const dynamic = "force-dynamic";
+
+/**
+ * The one personal page. It answers exactly two questions — who does
+ * OrangeCat say you are, and are you a voting member — and is honest about
+ * the boundary between them: membership is granted by a vote (or the
+ * documented operator bootstrap), never by signing up.
+ */
+export default async function AccountPage() {
+  const session = await auth();
+
+  if (!session?.actorId) {
+    return (
+      <main className="max-w-xl mx-auto py-24 text-center">
+        <h1 className="text-2xl font-bold text-navy mb-4">Account</h1>
+        <p className="text-fg-secondary mb-8">
+          Solon has no accounts of its own — no passwords, no registration.
+          Sign in with OrangeCat to be recognized; voting itself never needs
+          a login, only a Bitcoin signature.
+        </p>
+        {authEnabled ? (
+          <form
+            action={async () => {
+              "use server";
+              await signIn("orangecat", { redirectTo: "/account" });
+            }}
+          >
+            <button
+              type="submit"
+              className="px-5 py-2.5 text-sm font-medium bg-navy text-white rounded-md hover:bg-navy-light transition-colors"
+            >
+              Sign in with OrangeCat
+            </button>
+          </form>
+        ) : (
+          <p className="text-sm text-fg-secondary">
+            Sign-in is not configured in this environment.
+          </p>
+        )}
+      </main>
+    );
+  }
+
+  const member = await memberForActor(session.actorId);
+
+  return (
+    <main className="max-w-xl mx-auto py-16">
+      <h1 className="text-2xl font-bold text-navy mb-8">Account</h1>
+
+      <section className="bg-surface-base border border-default rounded-lg p-6 mb-6">
+        <h2 className="text-sm font-semibold text-fg-secondary uppercase tracking-wide mb-4">
+          OrangeCat identity
+        </h2>
+        <dl className="space-y-2 text-sm">
+          <div className="flex justify-between gap-4">
+            <dt className="text-fg-secondary">Name</dt>
+            <dd className="text-fg-primary font-medium">{session.user?.name ?? "—"}</dd>
+          </div>
+          <div className="flex justify-between gap-4">
+            <dt className="text-fg-secondary">Email</dt>
+            <dd className="text-fg-primary">{session.user?.email ?? "—"}</dd>
+          </div>
+          <div className="flex justify-between gap-4">
+            <dt className="text-fg-secondary">Actor id</dt>
+            <dd className="text-fg-primary font-mono text-xs break-all">{session.actorId}</dd>
+          </div>
+        </dl>
+      </section>
+
+      <section className="bg-surface-base border border-default rounded-lg p-6 mb-8">
+        <h2 className="text-sm font-semibold text-fg-secondary uppercase tracking-wide mb-4">
+          Governance membership
+        </h2>
+        {member ? (
+          <dl className="space-y-2 text-sm">
+            <div className="flex justify-between gap-4">
+              <dt className="text-fg-secondary">Member</dt>
+              <dd className="text-fg-primary font-medium">{member.displayName}</dd>
+            </div>
+            <div className="flex justify-between gap-4">
+              <dt className="text-fg-secondary">Organization</dt>
+              <dd className="text-fg-primary">{member.organization.name}</dd>
+            </div>
+            <div className="flex justify-between gap-4">
+              <dt className="text-fg-secondary">Voting weight</dt>
+              <dd className="text-fg-primary">{member.votingWeight.toString()}</dd>
+            </div>
+            <div className="flex justify-between gap-4">
+              <dt className="text-fg-secondary">Bitcoin address</dt>
+              <dd className="text-fg-primary font-mono text-xs break-all">
+                {member.bitcoinAddress}
+              </dd>
+            </div>
+          </dl>
+        ) : (
+          <p className="text-sm text-fg-secondary">
+            You are signed in as an observer. Membership in a Solon
+            organization is granted by a governance vote, not by signing up —
+            there is nothing to register here. Everything on this site is
+            already fully readable to you.
+          </p>
+        )}
+      </section>
+
+      <div className="flex items-center gap-4">
+        <form
+          action={async () => {
+            "use server";
+            await signOut({ redirectTo: "/" });
+          }}
+        >
+          <button
+            type="submit"
+            className="px-4 py-2 text-sm font-medium text-navy border border-default rounded-md hover:bg-surface-raised transition-colors"
+          >
+            Sign out
+          </button>
+        </form>
+        <Link href="/governance/voting" className="text-sm text-navy underline">
+          Go to voting
+        </Link>
+      </div>
+    </main>
+  );
+}

src/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,3 @@
+import { handlers } from "@/lib/auth";
+
+export const { GET, POST } = handlers;