#106 · stacks/ts-analytics

One user owns many projects; every project endpoint is authorized. Closes the current open-data security hole.

Tracks (9):

#54 — AuthZ: enforce project ownership on every /api/sites/{siteId}/* route
#55 — Data model: User → Projects (memberships) in DynamoDB
#56 — Projects: list projects for the logged-in user (scoped)
#57 — Projects: create project tied to the user (owner membership)
#58 — Projects: delete project (+ purge all data) with confirmation
#59 — Projects: members & roles (owner/admin/editor/viewer) enforced
#60 — Projects: invitations (invite by email, accept flow)
#61 — Projects: user-scoped project switcher (SiteSelector rework)
#62 — Accounts: plan/quota scaffolding per account (events/mo, projects, retention) [stretch]

Part of the Fathom + Sentry product backlog. See #44 for the original roadmap.

All nine tracks shipped — closing the epic.

#54 global membership guard on every per-project route (viewer/editor/admin by method+path)
#55 User → Projects membership model (mirrored USER#/SITE# items, O(1) lookups)
#56 project list scoped to the user (owned ∪ shared, with role)
#57 create ties owner membership; #58 owner-only delete with full partition purge
#59 roles enforced (team management needs admin, writes need editor)
#60 email invitations with accept-on-signup
#61 SiteSelector is a real project hub: search, recents, per-user last-selected persistence that survives reloads
#62 plan/quota scaffolding: plans on the account record, enforced at project create, ingest (per-account monthly counter), and retention clamp

One user owns many projects, every project endpoint is authorized, and the open-data hole from the audit is closed — the epic's done-when.