v1.9.4: per-user author attribution, team from users config

When auth is enabled, mutations record the authenticated user as author
instead of the static config author. Team endpoint returns users from
config instead of .team/ files. All mirror events now include `by` field.

Author: prih

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@graphmemory/server",
-  "version": "1.9.3",
+  "version": "1.9.4",
   "description": "MCP server for semantic graph memory from markdown files",
   "main": "dist/cli/index.js",
   "bin": {

package.json

@@ -5,6 +5,23 @@ description: Graph Memory release history and version changes.
 
 # Changelog
 
+## v1.9.4
+
+**March 2026**
+
+### New
+
+- **Per-user author attribution** — when authentication is configured, all mutations (create, update, delete, link, attachment) record the authenticated user as author (`createdBy`/`updatedBy`) instead of the static config `author`. Falls back to config author when auth is disabled
+- **Team from users config** — `GET /api/projects/:id/team` returns users from config when auth is enabled, instead of reading `.team/` directory files. `.team/` files still used when auth is disabled
+- **Author in all mirror events** — relation and attachment events in `events.jsonl` now include `by` field for audit trail
+
+### Tests
+
+- **29 new tests** — author flow: `resolveRequestAuthor`, mirror `by` field, manager author override for Task/Knowledge/Skill managers
+- **Total: 1947 tests across 55 suites**
+
+---
+
 ## v1.9.3
 
 **March 2026**

site/src/pages/changelog.md

@@ -11,7 +11,7 @@ import { createRestApp } from '@/api/rest/index';
 import { attachWebSocket } from '@/api/rest/websocket';
 import { resolveUserFromBearer, resolveAccess, canWrite, canRead } from '@/lib/access';
 import { MAX_BODY_SIZE, SESSION_SWEEP_INTERVAL_MS } from '@/lib/defaults';
-import { GRAPH_NAMES, type GraphName, type AccessLevel } from '@/lib/multi-config';
+import { GRAPH_NAMES, type GraphName, type AccessLevel, resolveRequestAuthor, type UserConfig } from '@/lib/multi-config';
 import type { DocGraph } from '@/graphs/docs';
 import { DocGraphManager } from '@/graphs/docs';
 import type { CodeGraph } from '@/graphs/code-types';
@@ -190,6 +190,7 @@ export function createMcpServer(
   readonlyGraphs?: Set<string>,
   userAccess?: Map<string, AccessLevel>,
   getSessionId?: () => string | undefined,
+  users?: Record<string, UserConfig>,
 ): McpServer {
   // Backward-compat: single EmbedFn → use for both document and query
   const defaultPair: EmbedFns = { document: (q) => embed(q, ''), query: (q) => embed(q, '') };
@@ -221,6 +222,7 @@ export function createMcpServer(
   );
   // Mutation tools are registered through mutServer to serialize concurrent writes
   const mutServer = mutationQueue ? createMutationServer(server, mutationQueue, getSessionId) : server;
+  const resolveAuthor = () => resolveRequestAuthor(sessionContext?.userId, users);
 
   // Check if mutation tools should be registered for a graph:
   // - graph must not be readonly (global setting — tools hidden for all)
@@ -298,13 +300,13 @@ export function createMcpServer(
     listRelations.register(server, knowledgeMgr);
     findLinkedNotes.register(server, knowledgeMgr);
     if (canMutate('knowledge')) {
-      createNote.register(mutServer, knowledgeMgr);
-      updateNote.register(mutServer, knowledgeMgr);
-      deleteNote.register(mutServer, knowledgeMgr);
-      createRelation.register(mutServer, knowledgeMgr);
-      deleteRelation.register(mutServer, knowledgeMgr);
-      addNoteAttachment.register(mutServer, knowledgeMgr);
-      removeNoteAttachment.register(mutServer, knowledgeMgr);
+      createNote.register(mutServer, knowledgeMgr, resolveAuthor);
+      updateNote.register(mutServer, knowledgeMgr, resolveAuthor);
+      deleteNote.register(mutServer, knowledgeMgr, resolveAuthor);
+      createRelation.register(mutServer, knowledgeMgr, resolveAuthor);
+      deleteRelation.register(mutServer, knowledgeMgr, resolveAuthor);
+      addNoteAttachment.register(mutServer, knowledgeMgr, resolveAuthor);
+      removeNoteAttachment.register(mutServer, knowledgeMgr, resolveAuthor);
     }
   }
 
@@ -319,31 +321,31 @@ export function createMcpServer(
     searchTasksTool.register(server, taskMgr);
     findLinkedTasks.register(server, taskMgr);
     if (canMutate('tasks')) {
-      createTask.register(mutServer, taskMgr);
-      updateTask.register(mutServer, taskMgr);
-      deleteTask.register(mutServer, taskMgr);
-      moveTask.register(mutServer, taskMgr);
-      reorderTaskTool.register(mutServer, taskMgr);
-      linkTask.register(mutServer, taskMgr);
-      createTaskLink.register(mutServer, taskMgr);
-      deleteTaskLink.register(mutServer, taskMgr);
-      bulkMove.register(mutServer, taskMgr);
-      bulkPriority.register(mutServer, taskMgr);
-      bulkDelete.register(mutServer, taskMgr);
-      addTaskAttachment.register(mutServer, taskMgr);
-      removeTaskAttachment.register(mutServer, taskMgr);
+      createTask.register(mutServer, taskMgr, resolveAuthor);
+      updateTask.register(mutServer, taskMgr, resolveAuthor);
+      deleteTask.register(mutServer, taskMgr, resolveAuthor);
+      moveTask.register(mutServer, taskMgr, resolveAuthor);
+      reorderTaskTool.register(mutServer, taskMgr, resolveAuthor);
+      linkTask.register(mutServer, taskMgr, resolveAuthor);
+      createTaskLink.register(mutServer, taskMgr, resolveAuthor);
+      deleteTaskLink.register(mutServer, taskMgr, resolveAuthor);
+      bulkMove.register(mutServer, taskMgr, resolveAuthor);
+      bulkPriority.register(mutServer, taskMgr, resolveAuthor);
+      bulkDelete.register(mutServer, taskMgr, resolveAuthor);
+      addTaskAttachment.register(mutServer, taskMgr, resolveAuthor);
+      removeTaskAttachment.register(mutServer, taskMgr, resolveAuthor);
     }
 
     // Epic tools (same graph, same access)
     getEpicTool.register(server, taskMgr);
     listEpicsTool.register(server, taskMgr);
     searchEpicsTool.register(server, taskMgr);
     if (canMutate('tasks')) {
-      createEpicTool.register(mutServer, taskMgr);
-      updateEpicTool.register(mutServer, taskMgr);
-      deleteEpicTool.register(mutServer, taskMgr);
-      linkEpicTaskTool.register(mutServer, taskMgr);
-      unlinkEpicTaskTool.register(mutServer, taskMgr);
+      createEpicTool.register(mutServer, taskMgr, resolveAuthor);
+      updateEpicTool.register(mutServer, taskMgr, resolveAuthor);
+      deleteEpicTool.register(mutServer, taskMgr, resolveAuthor);
+      linkEpicTaskTool.register(mutServer, taskMgr, resolveAuthor);
+      unlinkEpicTaskTool.register(mutServer, taskMgr, resolveAuthor);
     }
   }
 
@@ -359,15 +361,15 @@ export function createMcpServer(
     findLinkedSkills.register(server, skillMgr);
     recallSkills.register(server, skillMgr);
     if (canMutate('skills')) {
-      createSkillTool.register(mutServer, skillMgr);
-      updateSkillTool.register(mutServer, skillMgr);
-      deleteSkillTool.register(mutServer, skillMgr);
-      linkSkill.register(mutServer, skillMgr);
-      createSkillLink.register(mutServer, skillMgr);
-      deleteSkillLink.register(mutServer, skillMgr);
-      addSkillAttachment.register(mutServer, skillMgr);
-      removeSkillAttachment.register(mutServer, skillMgr);
-      bumpSkillUsage.register(mutServer, skillMgr);
+      createSkillTool.register(mutServer, skillMgr, resolveAuthor);
+      updateSkillTool.register(mutServer, skillMgr, resolveAuthor);
+      deleteSkillTool.register(mutServer, skillMgr, resolveAuthor);
+      linkSkill.register(mutServer, skillMgr, resolveAuthor);
+      createSkillLink.register(mutServer, skillMgr, resolveAuthor);
+      deleteSkillLink.register(mutServer, skillMgr, resolveAuthor);
+      addSkillAttachment.register(mutServer, skillMgr, resolveAuthor);
+      removeSkillAttachment.register(mutServer, skillMgr, resolveAuthor);
+      bumpSkillUsage.register(mutServer, skillMgr, resolveAuthor);
     }
   }
 
@@ -684,6 +686,7 @@ export async function startMultiProjectHttpServer(
       mcpReadonlyGraphs,
       mcpUserAccess,
       () => transport.sessionId,
+      users,
     );
     await mcpServer.connect(transport);
     await transport.handleRequest(req, res, body);

src/api/index.ts

@@ -4,8 +4,9 @@ import { validateBody, validateQuery, createEpicSchema, updateEpicSchema, epicSe
 import { requireWriteAccess } from '@/api/rest/index';
 import { VersionConflictError } from '@/graphs/manager-types';
 import type { EpicStatus } from '@/graphs/task-types';
+import { resolveRequestAuthor, type UserConfig } from '@/lib/multi-config';
 
-export function createEpicsRouter(): Router {
+export function createEpicsRouter(users?: Record<string, UserConfig>): Router {
   const router = Router({ mergeParams: true });
 
   function getProject(req: any) {
@@ -59,9 +60,10 @@ export function createEpicsRouter(): Router {
   router.post('/', requireWriteAccess, validateBody(createEpicSchema), async (req, res, next) => {
     try {
       const p = getProject(req);
+      const author = resolveRequestAuthor(req.userId, users);
       const { title, description, status, priority, tags } = req.body;
       const created = await p.mutationQueue.enqueue(async () => {
-        const epicId = await p.taskManager.createEpic(title, description, status, priority, tags);
+        const epicId = await p.taskManager.createEpic(title, description, status, priority, tags, author);
         return p.taskManager.getEpic(epicId);
       });
       res.status(201).json(created);
@@ -72,10 +74,11 @@ export function createEpicsRouter(): Router {
   router.put('/:epicId', requireWriteAccess, validateBody(updateEpicSchema), async (req, res, next) => {
     try {
       const p = getProject(req);
+      const author = resolveRequestAuthor(req.userId, users);
       const epicId = req.params.epicId as string;
       const { version, status, ...patch } = req.body;
       const result = await p.mutationQueue.enqueue(async () => {
-        const ok = await p.taskManager.updateEpic(epicId, patch, status as EpicStatus | undefined, version);
+        const ok = await p.taskManager.updateEpic(epicId, patch, status as EpicStatus | undefined, version, author);
         if (!ok) return null;
         return p.taskManager.getEpic(epicId);
       });
@@ -93,9 +96,10 @@ export function createEpicsRouter(): Router {
   router.delete('/:epicId', requireWriteAccess, async (req, res, next) => {
     try {
       const p = getProject(req);
+      const author = resolveRequestAuthor(req.userId, users);
       const epicId = req.params.epicId as string;
       const ok = await p.mutationQueue.enqueue(async () => {
-        return p.taskManager.deleteEpic(epicId);
+        return p.taskManager.deleteEpic(epicId, author);
       });
       if (!ok) return res.status(404).json({ error: 'Epic not found' });
       res.status(204).end();
@@ -106,10 +110,11 @@ export function createEpicsRouter(): Router {
   router.post('/:epicId/link', requireWriteAccess, validateBody(epicLinkSchema), async (req, res, next) => {
     try {
       const p = getProject(req);
+      const author = resolveRequestAuthor(req.userId, users);
       const epicId = req.params.epicId as string;
       const { taskId } = req.body;
       const ok = await p.mutationQueue.enqueue(async () => {
-        return p.taskManager.linkTaskToEpic(taskId, epicId);
+        return p.taskManager.linkTaskToEpic(taskId, epicId, author);
       });
       if (!ok) return res.status(400).json({ error: 'Failed to link task to epic' });
       res.status(201).json({ taskId, epicId, linked: true });
@@ -120,10 +125,11 @@ export function createEpicsRouter(): Router {
   router.delete('/:epicId/link', requireWriteAccess, validateBody(epicLinkSchema), async (req, res, next) => {
     try {
       const p = getProject(req);
+      const author = resolveRequestAuthor(req.userId, users);
       const epicId = req.params.epicId as string;
       const { taskId } = req.body;
       const ok = await p.mutationQueue.enqueue(async () => {
-        return p.taskManager.unlinkTaskFromEpic(taskId, epicId);
+        return p.taskManager.unlinkTaskFromEpic(taskId, epicId, author);
       });
       if (!ok) return res.status(404).json({ error: 'Link not found' });
       res.status(204).end();

src/api/rest/epics.ts

@@ -404,6 +404,12 @@ export function createRestApp(projectManager: ProjectManager, options?: RestAppO
       );
       if (!hasAnyAccess) return res.status(403).json({ error: 'Access denied' });
     }
+    // When auth is configured, team = users from config (no .team/ files needed)
+    if (hasUsers) {
+      const members = Object.entries(users).map(([id, u]) => ({ id, name: u.name, email: u.email }));
+      return res.json({ results: members });
+    }
+    // No auth — read from .team/ directory
     const p = req.project!;
     const ws = p.workspaceId ? projectManager.getWorkspace(p.workspaceId) : undefined;
     const baseDir = ws ? ws.config.mirrorDir : p.config.projectDir;
@@ -460,10 +466,10 @@ export function createRestApp(projectManager: ProjectManager, options?: RestAppO
 
   // Mount domain routers (gated by manager existence + read access)
   // Mutation endpoints (POST/PUT/DELETE) inside routers check req.accessLevel for write access
-  app.use('/api/projects/:projectId/knowledge', ...graphMiddleware('knowledgeManager', 'knowledge'), createKnowledgeRouter());
-  app.use('/api/projects/:projectId/tasks', ...graphMiddleware('taskManager', 'tasks'), createTasksRouter());
-  app.use('/api/projects/:projectId/epics', ...graphMiddleware('taskManager', 'tasks'), createEpicsRouter());
-  app.use('/api/projects/:projectId/skills', ...graphMiddleware('skillManager', 'skills'), createSkillsRouter());
+  app.use('/api/projects/:projectId/knowledge', ...graphMiddleware('knowledgeManager', 'knowledge'), createKnowledgeRouter(users));
+  app.use('/api/projects/:projectId/tasks', ...graphMiddleware('taskManager', 'tasks'), createTasksRouter(users));
+  app.use('/api/projects/:projectId/epics', ...graphMiddleware('taskManager', 'tasks'), createEpicsRouter(users));
+  app.use('/api/projects/:projectId/skills', ...graphMiddleware('skillManager', 'skills'), createSkillsRouter(users));
   app.use('/api/projects/:projectId/docs', ...graphMiddleware('docManager', 'docs'), createDocsRouter());
   app.use('/api/projects/:projectId/code', ...graphMiddleware('codeManager', 'code'), createCodeRouter());
   app.use('/api/projects/:projectId/files', ...graphMiddleware('fileIndexManager', 'files'), createFilesRouter());

src/api/rest/index.ts

@@ -7,10 +7,11 @@ import { validateBody, validateQuery, createNoteSchema, updateNoteSchema, create
 import { requireWriteAccess } from '@/api/rest/index';
 import { VersionConflictError } from '@/graphs/manager-types';
 import { MAX_UPLOAD_SIZE } from '@/lib/defaults';
+import { resolveRequestAuthor, type UserConfig } from '@/lib/multi-config';
 
 const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: MAX_UPLOAD_SIZE } });
 
-export function createKnowledgeRouter(): Router {
+export function createKnowledgeRouter(users?: Record<string, UserConfig>): Router {
   const router = Router({ mergeParams: true });
 
   function getProject(req: any) {
@@ -60,8 +61,9 @@ export function createKnowledgeRouter(): Router {
     try {
       const p = getProject(req);
       const { title, content, tags } = req.body;
+      const author = resolveRequestAuthor(req.userId, users);
       const created = await p.mutationQueue.enqueue(async () => {
-        const noteId = await p.knowledgeManager.createNote(title, content, tags);
+        const noteId = await p.knowledgeManager.createNote(title, content, tags, author);
         return p.knowledgeManager.getNote(noteId);
       });
       res.status(201).json(created);
@@ -74,8 +76,9 @@ export function createKnowledgeRouter(): Router {
       const p = getProject(req);
       const noteId = req.params.noteId as string;
       const { version, ...patch } = req.body;
+      const author = resolveRequestAuthor(req.userId, users);
       const result = await p.mutationQueue.enqueue(async () => {
-        const ok = await p.knowledgeManager.updateNote(noteId, patch, version);
+        const ok = await p.knowledgeManager.updateNote(noteId, patch, version, author);
         if (!ok) return null;
         return p.knowledgeManager.getNote(noteId);
       });
@@ -94,8 +97,9 @@ export function createKnowledgeRouter(): Router {
     try {
       const p = getProject(req);
       const noteId = req.params.noteId as string;
+      const author = resolveRequestAuthor(req.userId, users);
       const ok = await p.mutationQueue.enqueue(async () => {
-        return p.knowledgeManager.deleteNote(noteId);
+        return p.knowledgeManager.deleteNote(noteId, author);
       });
       if (!ok) return res.status(404).json({ error: 'Note not found' });
       res.status(204).end();
@@ -107,8 +111,9 @@ export function createKnowledgeRouter(): Router {
     try {
       const p = getProject(req);
       const { fromId, toId, kind, targetGraph, projectId } = req.body;
+      const author = resolveRequestAuthor(req.userId, users);
       const ok = await p.mutationQueue.enqueue(async () => {
-        return p.knowledgeManager.createRelation(fromId, toId, kind, targetGraph, projectId);
+        return p.knowledgeManager.createRelation(fromId, toId, kind, targetGraph, projectId, author);
       });
       if (!ok) return res.status(400).json({ error: 'Failed to create relation' });
       res.status(201).json({ fromId, toId, kind, targetGraph: targetGraph || undefined });
@@ -120,8 +125,9 @@ export function createKnowledgeRouter(): Router {
     try {
       const p = getProject(req);
       const { fromId, toId, targetGraph, projectId } = req.body;
+      const author = resolveRequestAuthor(req.userId, users);
       const ok = await p.mutationQueue.enqueue(async () => {
-        return p.knowledgeManager.deleteRelation(fromId, toId, targetGraph, projectId);
+        return p.knowledgeManager.deleteRelation(fromId, toId, targetGraph, projectId, author);
       });
       if (!ok) return res.status(404).json({ error: 'Relation not found' });
       res.status(204).end();
@@ -157,9 +163,10 @@ export function createKnowledgeRouter(): Router {
       const file = req.file;
       if (!file) return res.status(400).json({ error: 'No file uploaded' });
       const filename = attachmentFilenameSchema.parse(file.originalname);
+      const author = resolveRequestAuthor(req.userId, users);
 
       const meta = await p.mutationQueue.enqueue(async () => {
-        return p.knowledgeManager.addAttachment(noteId, filename, file.buffer);
+        return p.knowledgeManager.addAttachment(noteId, filename, file.buffer, author);
       });
       if (!meta) return res.status(404).json({ error: 'Note not found' });
       res.status(201).json(meta);
@@ -198,8 +205,9 @@ export function createKnowledgeRouter(): Router {
       const p = getProject(req);
       const noteId = req.params.noteId as string;
       const filename = attachmentFilenameSchema.parse(req.params.filename);
+      const author = resolveRequestAuthor(req.userId, users);
       const ok = await p.mutationQueue.enqueue(async () => {
-        return p.knowledgeManager.removeAttachment(noteId, filename);
+        return p.knowledgeManager.removeAttachment(noteId, filename, author);
       });
       if (!ok) return res.status(404).json({ error: 'Attachment not found' });
       res.status(204).end();