统一推荐页游客运行态与切换队列

统一推荐页各玩法正式 runtime 的游客鉴权透传。收口推荐页首页展示队列和嵌入运行态切换队列。补齐未登录读档、签名资产和个人数据读取的游客态处理。新增运行态 HUD 小尺寸 logo 资源并更新拼图与抓鹅展示。补充推荐切换、runtime guest 启动和客户端请求回归测试。更新玩法链路、后端契约和团队记忆文档。
2026-06-10 22:00:19 +08:00
parent e29992cf01
commit 7dd53e95d8
41 changed files with 1372 additions and 376 deletions
--- a/server-rs/crates/api-server/src/bark_battle.rs
+++ b/server-rs/crates/api-server/src/bark_battle.rs
@@ -37,7 +37,7 @@ use time::{Duration as TimeDuration, OffsetDateTime};
 use crate::{
    api_response::json_success_body,
    asset_billing::execute_billable_asset_operation_with_cost,
-    auth::AuthenticatedAccessToken,
+    auth::{AuthenticatedAccessToken, RuntimePrincipal},
    generated_image_assets::{
        GeneratedImageAssetAdapter, GeneratedImageAssetDataUrl,
        adapter::{GeneratedImageAssetAdapterMetadata, GeneratedImageAssetPersistInput},
@@ -506,13 +506,13 @@ pub async fn get_bark_battle_runtime_config(
    State(state): State<AppState>,
    Path(work_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(&request_context, &work_id, "workId")?;

    let config = state
        .spacetime_client()
-        .get_bark_battle_runtime_config(work_id, Some(authenticated.claims().user_id().to_string()))
+        .get_bark_battle_runtime_config(work_id, Some(principal.subject().to_string()))
        .await
        .map_err(|error| {
            bark_battle_error_response(&request_context, map_bark_battle_client_error(error))
@@ -526,7 +526,7 @@ pub async fn start_bark_battle_run(
    State(state): State<AppState>,
    Path(work_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<BarkBattleRunStartRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let maybe_payload = payload.ok().map(|Json(payload)| payload);
@@ -543,7 +543,7 @@ pub async fn start_bark_battle_run(
    };
    ensure_non_empty(&request_context, &work_id, "workId")?;

-    let owner_user_id = authenticated.claims().user_id().to_string();
+    let owner_user_id = principal.subject().to_string();
    let runtime_config = state
        .spacetime_client()
        .get_bark_battle_runtime_config(work_id.clone(), Some(owner_user_id.clone()))
@@ -593,12 +593,13 @@ pub async fn start_bark_battle_run(
    record_work_play_start_after_success(
        &state,
        &request_context,
-        WorkPlayTrackingDraft::new(
+        WorkPlayTrackingDraft::runtime_principal(
            BARK_BATTLE_PLAY_TYPE_ID,
            work_id.clone(),
-            &authenticated,
+            &principal,
            "/api/runtime/bark-battle/...",
        )
+        .owner_user_id(owner_user_id.clone())
        .extra(json!({
            "runId": run_snapshot.run_id,
            "workId": work_id,
@@ -607,6 +608,7 @@ pub async fn start_bark_battle_run(
            "difficultyPreset": runtime_config.difficulty_preset,
            "sourceRoute": request.source_route,
            "clientRuntimeVersion": request.client_runtime_version,
+            "principalKind": principal.kind().as_str(),
        })),
    )
    .await;
@@ -638,12 +640,12 @@ pub async fn get_bark_battle_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(&request_context, &run_id, "runId")?;
    let run = state
        .spacetime_client()
-        .get_bark_battle_run(run_id, authenticated.claims().user_id().to_string())
+        .get_bark_battle_run(run_id, principal.subject().to_string())
        .await
        .map_err(|error| {
            bark_battle_error_response(&request_context, map_bark_battle_client_error(error))
@@ -657,7 +659,7 @@ pub async fn finish_bark_battle_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<BarkBattleRunFinishRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let Json(payload) = bark_battle_json(payload, &request_context)?;
@@ -698,7 +700,7 @@ pub async fn finish_bark_battle_run(
        .finish_bark_battle_run(BarkBattleRunFinishRecordInput {
            run_id,
            run_token: payload.run_token,
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            work_id: payload.work_id.clone(),
            config_version: u64::from(payload.config_version),
            ruleset_version: payload.ruleset_version.clone(),
--- a/server-rs/crates/api-server/src/big_fish.rs
+++ b/server-rs/crates/api-server/src/big_fish.rs
@@ -63,7 +63,7 @@ use crate::{
    },
    api_response::json_success_body,
    asset_billing::execute_billable_asset_operation,
-    auth::AuthenticatedAccessToken,
+    auth::{AuthenticatedAccessToken, RuntimePrincipal},
    character_visual_assets::try_apply_background_alpha_to_png,
    http_error::AppError,
    platform_errors::map_oss_error,
@@ -224,7 +224,7 @@ pub async fn record_big_fish_play(
    State(state): State<AppState>,
    Path(session_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<RecordBigFishPlayRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let Json(payload) = payload.map_err(|error| {
@@ -242,7 +242,7 @@ pub async fn record_big_fish_play(
        .spacetime_client()
        .record_big_fish_play(BigFishPlayReportRecordInput {
            session_id: session_id.clone(),
-            user_id: authenticated.claims().user_id().to_string(),
+            user_id: principal.subject().to_string(),
            elapsed_ms: payload.elapsed_ms.unwrap_or(0),
            reported_at_micros: current_utc_micros(),
        })
@@ -254,13 +254,14 @@ pub async fn record_big_fish_play(
    record_work_play_start_after_success(
        &state,
        &request_context,
-        WorkPlayTrackingDraft::new(
+        WorkPlayTrackingDraft::runtime_principal(
            "big-fish",
            session_id.clone(),
-            &authenticated,
+            &principal,
            "/api/runtime/big-fish/sessions/{session_id}/play",
        )
-        .run_id(session_id.clone()),
+        .run_id(session_id.clone())
+        .owner_user_id(principal.subject().to_string()),
    )
    .await;

@@ -279,7 +280,7 @@ pub async fn start_big_fish_run(
    State(state): State<AppState>,
    Path(session_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(&request_context, &session_id, "sessionId")?;

@@ -288,7 +289,7 @@ pub async fn start_big_fish_run(
        .start_big_fish_run(BigFishRunStartRecordInput {
            run_id: build_prefixed_uuid_id("big-fish-run-"),
            session_id,
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            started_at_micros: current_utc_micros(),
        })
        .await
@@ -339,13 +340,13 @@ pub async fn get_big_fish_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(&request_context, &run_id, "runId")?;

    let run = state
        .spacetime_client()
-        .get_big_fish_run(run_id, authenticated.claims().user_id().to_string())
+        .get_big_fish_run(run_id, principal.subject().to_string())
        .await
        .map_err(|error| {
            big_fish_error_response(&request_context, map_big_fish_client_error(error))
@@ -363,7 +364,7 @@ pub async fn submit_big_fish_input(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<SubmitBigFishInputRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let Json(payload) = payload.map_err(|error| {
@@ -384,7 +385,7 @@ pub async fn submit_big_fish_input(
        .spacetime_client()
        .submit_big_fish_input(BigFishInputSubmitRecordInput {
            run_id,
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            x: payload.x,
            y: payload.y,
            submitted_at_micros: current_utc_micros(),
--- a/server-rs/crates/api-server/src/match3d.rs
+++ b/server-rs/crates/api-server/src/match3d.rs
@@ -69,7 +69,7 @@ use crate::{
        execute_billable_asset_operation_with_cost, map_asset_operation_wallet_error,
        should_skip_asset_operation_billing_for_connectivity,
    },
-    auth::AuthenticatedAccessToken,
+    auth::{AuthenticatedAccessToken, RuntimePrincipal},
    config::AppConfig,
    generated_asset_sheets::apply_generated_asset_sheet_green_screen_alpha,
    http_error::AppError,
--- a/server-rs/crates/api-server/src/match3d/handlers.rs
+++ b/server-rs/crates/api-server/src/match3d/handlers.rs
@@ -1171,7 +1171,7 @@ pub async fn start_match3d_run(
    State(state): State<AppState>,
    Path(profile_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<StartMatch3DRunRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let maybe_payload = payload.ok().map(|Json(payload)| payload);
@@ -1191,7 +1191,7 @@ pub async fn start_match3d_run(
        .spacetime_client()
        .start_match3d_run(Match3DRunStartRecordInput {
            run_id: build_prefixed_uuid_id(MATCH3D_RUN_ID_PREFIX),
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            profile_id: profile_id.clone(),
            started_at_ms: current_utc_ms(),
            item_type_count_override: maybe_payload
@@ -1211,15 +1211,17 @@ pub async fn start_match3d_run(
    record_work_play_start_after_success(
        &state,
        &request_context,
-        WorkPlayTrackingDraft::new(
+        WorkPlayTrackingDraft::runtime_principal(
            "match3d",
            profile_id.clone(),
-            &authenticated,
+            &principal,
            "/api/runtime/match3d/...",
        )
        .profile_id(profile_id.clone())
+        .owner_user_id(principal.subject().to_string())
        .extra(json!({
            "runId": run.run_id,
+            "principalKind": principal.kind().as_str(),
        })),
    )
    .await;
@@ -1236,13 +1238,13 @@ pub async fn get_match3d_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(&request_context, MATCH3D_RUNTIME_PROVIDER, &run_id, "runId")?;

    let run = state
        .spacetime_client()
-        .get_match3d_run(run_id, authenticated.claims().user_id().to_string())
+        .get_match3d_run(run_id, principal.subject().to_string())
        .await
        .map_err(|error| {
            match3d_error_response(
@@ -1264,7 +1266,7 @@ pub async fn click_match3d_item(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<ClickMatch3DItemRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let Json(payload) = match3d_json(payload, &request_context, MATCH3D_RUNTIME_PROVIDER)?;
@@ -1286,7 +1288,7 @@ pub async fn click_match3d_item(
        .spacetime_client()
        .click_match3d_item(Match3DRunClickRecordInput {
            run_id: payload.run_id.unwrap_or(run_id),
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            item_instance_id: payload.item_instance_id,
            client_snapshot_version: payload.client_snapshot_version.min(u32::MAX as u64) as u32,
            client_event_id: payload.client_event_id,
@@ -1313,7 +1315,7 @@ pub async fn stop_match3d_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<StopMatch3DRunRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let _ = payload.ok();
@@ -1323,7 +1325,7 @@ pub async fn stop_match3d_run(
        .spacetime_client()
        .stop_match3d_run(Match3DRunStopRecordInput {
            run_id,
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            stopped_at_ms: current_utc_ms(),
        })
        .await
@@ -1347,7 +1349,7 @@ pub async fn restart_match3d_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(&request_context, MATCH3D_RUNTIME_PROVIDER, &run_id, "runId")?;

@@ -1356,7 +1358,7 @@ pub async fn restart_match3d_run(
        .restart_match3d_run(Match3DRunRestartRecordInput {
            source_run_id: run_id,
            next_run_id: build_prefixed_uuid_id(MATCH3D_RUN_ID_PREFIX),
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            restarted_at_ms: current_utc_ms(),
        })
        .await
@@ -1380,7 +1382,7 @@ pub async fn finish_match3d_time_up(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(&request_context, MATCH3D_RUNTIME_PROVIDER, &run_id, "runId")?;

@@ -1388,7 +1390,7 @@ pub async fn finish_match3d_time_up(
        .spacetime_client()
        .finish_match3d_time_up(Match3DRunTimeUpRecordInput {
            run_id,
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            finished_at_ms: current_utc_ms(),
        })
        .await
--- a/server-rs/crates/api-server/src/modules/bark_battle.rs
+++ b/server-rs/crates/api-server/src/modules/bark_battle.rs
@@ -4,7 +4,7 @@ use axum::{
 };

 use crate::{
-    auth::require_bearer_auth,
+    auth::{require_bearer_auth, require_runtime_principal_auth},
    bark_battle::{
        create_bark_battle_draft, delete_bark_battle_work, finish_bark_battle_run,
        generate_bark_battle_image_asset, get_bark_battle_run, get_bark_battle_runtime_config,
@@ -66,26 +66,28 @@ pub fn router(state: AppState) -> Router<AppState> {
            "/api/runtime/bark-battle/works/{work_id}/config",
            get(get_bark_battle_runtime_config).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/bark-battle/works/{work_id}/runs",
            post(start_bark_battle_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/bark-battle/runs/{run_id}",
            get(get_bark_battle_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/bark-battle/runs/{run_id}/finish",
-            post(finish_bark_battle_run)
-                .route_layer(middleware::from_fn_with_state(state, require_bearer_auth)),
+            post(finish_bark_battle_run).route_layer(middleware::from_fn_with_state(
+                state,
+                require_runtime_principal_auth,
+            )),
        )
 }
--- a/server-rs/crates/api-server/src/modules/big_fish.rs
+++ b/server-rs/crates/api-server/src/modules/big_fish.rs
@@ -4,7 +4,7 @@ use axum::{
 };

 use crate::{
-    auth::require_bearer_auth,
+    auth::{require_bearer_auth, require_runtime_principal_auth},
    big_fish::{
        create_big_fish_session, delete_big_fish_work, execute_big_fish_action, get_big_fish_run,
        get_big_fish_session, get_big_fish_works, list_big_fish_gallery,
@@ -85,35 +85,35 @@ pub fn router(state: AppState) -> Router<AppState> {
            "/api/runtime/big-fish/sessions/{session_id}/play",
            post(record_big_fish_play).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/big-fish/works/{session_id}/play",
            post(record_big_fish_play).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/big-fish/sessions/{session_id}/runs",
            post(start_big_fish_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/big-fish/runs/{run_id}",
            get(get_big_fish_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/big-fish/runs/{run_id}/input",
            post(submit_big_fish_input).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
 }
--- a/server-rs/crates/api-server/src/modules/match3d.rs
+++ b/server-rs/crates/api-server/src/modules/match3d.rs
@@ -4,7 +4,7 @@ use axum::{
 };

 use crate::{
-    auth::require_bearer_auth,
+    auth::{require_bearer_auth, require_runtime_principal_auth},
    match3d::{
        click_match3d_item, compile_match3d_agent_draft, create_match3d_agent_session,
        delete_match3d_work, execute_match3d_agent_action, finish_match3d_time_up,
@@ -139,42 +139,42 @@ pub fn router(state: AppState) -> Router<AppState> {
            "/api/runtime/match3d/works/{profile_id}/runs",
            post(start_match3d_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/match3d/runs/{run_id}",
            get(get_match3d_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/match3d/runs/{run_id}/click",
            post(click_match3d_item).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/match3d/runs/{run_id}/stop",
            post(stop_match3d_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/match3d/runs/{run_id}/restart",
            post(restart_match3d_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/match3d/runs/{run_id}/time-up",
            post(finish_match3d_time_up).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
 }
--- a/server-rs/crates/api-server/src/modules/square_hole.rs
+++ b/server-rs/crates/api-server/src/modules/square_hole.rs
@@ -4,7 +4,7 @@ use axum::{
 };

 use crate::{
-    auth::require_bearer_auth,
+    auth::{require_bearer_auth, require_runtime_principal_auth},
    square_hole::{
        compile_square_hole_agent_draft, create_square_hole_agent_session, delete_square_hole_work,
        drop_square_hole_shape, execute_square_hole_agent_action, finish_square_hole_time_up,
@@ -101,42 +101,42 @@ pub fn router(state: AppState) -> Router<AppState> {
            "/api/runtime/square-hole/works/{profile_id}/runs",
            post(start_square_hole_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/square-hole/runs/{run_id}",
            get(get_square_hole_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/square-hole/runs/{run_id}/drop",
            post(drop_square_hole_shape).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/square-hole/runs/{run_id}/stop",
            post(stop_square_hole_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/square-hole/runs/{run_id}/restart",
            post(restart_square_hole_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/square-hole/runs/{run_id}/time-up",
            post(finish_square_hole_time_up).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
 }
--- a/server-rs/crates/api-server/src/modules/visual_novel.rs
+++ b/server-rs/crates/api-server/src/modules/visual_novel.rs
@@ -4,7 +4,7 @@ use axum::{
 };

 use crate::{
-    auth::require_bearer_auth,
+    auth::{require_bearer_auth, require_runtime_principal_auth},
    state::AppState,
    vector_engine_audio_generation::{
        create_background_music_task, create_sound_effect_task,
@@ -151,33 +151,35 @@ pub fn router(state: AppState) -> Router<AppState> {
            "/api/runtime/visual-novel/works/{profile_id}/runs",
            post(start_visual_novel_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/visual-novel/runs/{run_id}",
            get(get_visual_novel_run).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/visual-novel/runs/{run_id}/actions/stream",
            post(stream_visual_novel_action).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/visual-novel/runs/{run_id}/history",
            get(list_visual_novel_history).route_layer(middleware::from_fn_with_state(
                state.clone(),
-                require_bearer_auth,
+                require_runtime_principal_auth,
            )),
        )
        .route(
            "/api/runtime/visual-novel/runs/{run_id}/regenerate",
-            post(regenerate_visual_novel_run)
-                .route_layer(middleware::from_fn_with_state(state, require_bearer_auth)),
+            post(regenerate_visual_novel_run).route_layer(middleware::from_fn_with_state(
+                state,
+                require_runtime_principal_auth,
+            )),
        )
 }
--- a/server-rs/crates/api-server/src/square_hole.rs
+++ b/server-rs/crates/api-server/src/square_hole.rs
@@ -69,7 +69,7 @@ use crate::generated_image_assets::{
 use crate::{
    ai_generation_drafts::{AiGenerationDraftContext, AiGenerationDraftWriter},
    api_response::json_success_body,
-    auth::AuthenticatedAccessToken,
+    auth::{AuthenticatedAccessToken, RuntimePrincipal},
    http_error::AppError,
    openai_image_generation::{
        DownloadedOpenAiImage, build_openai_image_http_client, create_openai_image_generation,
@@ -739,7 +739,7 @@ pub async fn start_square_hole_run(
    State(state): State<AppState>,
    Path(profile_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<StartSquareHoleRunRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let maybe_payload = payload.ok().map(|Json(payload)| payload);
@@ -758,7 +758,7 @@ pub async fn start_square_hole_run(
        .spacetime_client()
        .start_square_hole_run(SquareHoleRunStartRecordInput {
            run_id: build_prefixed_uuid_id(SQUARE_HOLE_RUN_ID_PREFIX),
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            profile_id: profile_id.clone(),
            started_at_ms: current_utc_ms(),
        })
@@ -774,15 +774,17 @@ pub async fn start_square_hole_run(
    record_work_play_start_after_success(
        &state,
        &request_context,
-        WorkPlayTrackingDraft::new(
+        WorkPlayTrackingDraft::runtime_principal(
            "square-hole",
            profile_id.clone(),
-            &authenticated,
+            &principal,
            "/api/runtime/square-hole/...",
        )
        .profile_id(profile_id.clone())
+        .owner_user_id(principal.subject().to_string())
        .extra(json!({
            "runId": run.run_id,
+            "principalKind": principal.kind().as_str(),
        })),
    )
    .await;
@@ -799,7 +801,7 @@ pub async fn get_square_hole_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(
        &request_context,
@@ -810,7 +812,7 @@ pub async fn get_square_hole_run(

    let run = state
        .spacetime_client()
-        .get_square_hole_run(run_id, authenticated.claims().user_id().to_string())
+        .get_square_hole_run(run_id, principal.subject().to_string())
        .await
        .map_err(|error| {
            square_hole_error_response(
@@ -832,7 +834,7 @@ pub async fn drop_square_hole_shape(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<DropSquareHoleShapeRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let Json(payload) = square_hole_json(payload, &request_context, SQUARE_HOLE_RUNTIME_PROVIDER)?;
@@ -859,7 +861,7 @@ pub async fn drop_square_hole_shape(
        .spacetime_client()
        .drop_square_hole_shape(SquareHoleRunDropRecordInput {
            run_id: payload.run_id.unwrap_or(run_id),
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            hole_id: payload.hole_id,
            client_snapshot_version: payload.client_snapshot_version,
            client_event_id: payload.client_event_id,
@@ -887,7 +889,7 @@ pub async fn stop_square_hole_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<StopSquareHoleRunRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let _ = payload.ok();
@@ -902,7 +904,7 @@ pub async fn stop_square_hole_run(
        .spacetime_client()
        .stop_square_hole_run(SquareHoleRunStopRecordInput {
            run_id,
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            stopped_at_ms: current_utc_ms(),
        })
        .await
@@ -926,7 +928,7 @@ pub async fn restart_square_hole_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(
        &request_context,
@@ -940,7 +942,7 @@ pub async fn restart_square_hole_run(
        .restart_square_hole_run(SquareHoleRunRestartRecordInput {
            source_run_id: run_id,
            next_run_id: build_prefixed_uuid_id(SQUARE_HOLE_RUN_ID_PREFIX),
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            restarted_at_ms: current_utc_ms(),
        })
        .await
@@ -964,7 +966,7 @@ pub async fn finish_square_hole_time_up(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(
        &request_context,
@@ -977,7 +979,7 @@ pub async fn finish_square_hole_time_up(
        .spacetime_client()
        .finish_square_hole_time_up(SquareHoleRunTimeUpRecordInput {
            run_id,
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            finished_at_ms: current_utc_ms(),
        })
        .await
--- a/server-rs/crates/api-server/src/visual_novel.rs
+++ b/server-rs/crates/api-server/src/visual_novel.rs
@@ -30,7 +30,7 @@ use time::OffsetDateTime;

 use crate::{
    api_response::json_success_body,
-    auth::AuthenticatedAccessToken,
+    auth::{AuthenticatedAccessToken, RuntimePrincipal},
    http_error::AppError,
    prompt::visual_novel as vn_prompt,
    request_context::RequestContext,
@@ -434,7 +434,7 @@ pub async fn start_visual_novel_run(
    State(state): State<AppState>,
    Path(profile_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<contract::VisualNovelStartRunRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let Json(payload) = parse_json_payload(&request_context, payload)?;
@@ -453,7 +453,7 @@ pub async fn start_visual_novel_run(
        .spacetime_client()
        .start_visual_novel_run(VisualNovelRunStartRecordInput {
            run_id: build_prefixed_uuid_id(domain::VISUAL_NOVEL_RUN_ID_PREFIX),
-            owner_user_id: authenticated.claims().user_id().to_string(),
+            owner_user_id: principal.subject().to_string(),
            profile_id: profile_id.clone(),
            mode: run_mode_to_wire(&payload.mode).to_string(),
            snapshot_json: None,
@@ -467,16 +467,18 @@ pub async fn start_visual_novel_run(
    record_work_play_start_after_success(
        &state,
        &request_context,
-        WorkPlayTrackingDraft::new(
+        WorkPlayTrackingDraft::runtime_principal(
            "visual-novel",
            profile_id.clone(),
-            &authenticated,
+            &principal,
            "/api/runtime/visual-novel/...",
        )
        .profile_id(profile_id.clone())
+        .owner_user_id(principal.subject().to_string())
        .extra(json!({
            "mode": run_mode_to_wire(&payload.mode),
            "runId": run.run_id,
+            "principalKind": principal.kind().as_str(),
        })),
    )
    .await;
@@ -493,12 +495,12 @@ pub async fn get_visual_novel_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(&run_id, "runId")?;
    let run = state
        .spacetime_client()
-        .get_visual_novel_run(run_id, authenticated.claims().user_id().to_string())
+        .get_visual_novel_run(run_id, principal.subject().to_string())
        .await
        .map_err(|error| {
            visual_novel_error_response(&request_context, map_spacetime_error(error))
@@ -516,13 +518,13 @@ pub async fn stream_visual_novel_action(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<contract::VisualNovelRuntimeActionRequest>, JsonRejection>,
 ) -> Result<Response, Response> {
    let Json(payload) = parse_json_payload(&request_context, payload)?;
    ensure_non_empty(&run_id, "runId")?;
    ensure_non_empty(&payload.client_event_id, "clientEventId")?;
-    let owner_user_id = authenticated.claims().user_id().to_string();
+    let owner_user_id = principal.subject().to_string();
    let run = state
        .spacetime_client()
        .get_visual_novel_run(run_id.clone(), owner_user_id.clone())
@@ -569,12 +571,12 @@ pub async fn list_visual_novel_history(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
 ) -> Result<Json<Value>, Response> {
    ensure_non_empty(&run_id, "runId")?;
    let history = state
        .spacetime_client()
-        .list_visual_novel_runtime_history(run_id, authenticated.claims().user_id().to_string())
+        .list_visual_novel_runtime_history(run_id, principal.subject().to_string())
        .await
        .map_err(|error| {
            visual_novel_error_response(&request_context, map_spacetime_error(error))
@@ -595,13 +597,13 @@ pub async fn regenerate_visual_novel_run(
    State(state): State<AppState>,
    Path(run_id): Path<String>,
    Extension(request_context): Extension<RequestContext>,
-    Extension(authenticated): Extension<AuthenticatedAccessToken>,
+    Extension(principal): Extension<RuntimePrincipal>,
    payload: Result<Json<contract::VisualNovelRegenerateRequest>, JsonRejection>,
 ) -> Result<Json<Value>, Response> {
    let Json(payload) = parse_json_payload(&request_context, payload)?;
    ensure_non_empty(&run_id, "runId")?;
    ensure_non_empty(&payload.history_entry_id, "historyEntryId")?;
-    let owner_user_id = authenticated.claims().user_id().to_string();
+    let owner_user_id = principal.subject().to_string();
    let run = state
        .spacetime_client()
        .get_visual_novel_run(run_id.clone(), owner_user_id.clone())