feat(ui): add Own/All collection owner-scope filter with lazy identity (#1537)

Adds an optional QAM Own/All toggle so a user on a shared RomM server syncs only their own collections instead of all (which includes other users' public ones). Default "All" is byte-for-byte today's behaviour. "Own" filters foreign user/smart collections out of the work queue (a sync scope over the enabled-state, never mutating it); franchise/virtual collections have no owner and always sync. The plugin now reads and stores its own RomM user id from /api/users/me, bound to the token: stamped at sign-in, lazily backfilled for existing installs (no re-login), re-derived on every sign-in (catches same-origin user switches), and when unknown "Own" safely behaves like "All". Also renames the internal collection kind-scope "my" to "user" (behaviour-preserving, not persisted) so it doesn't collide with the new owner-scope "own".

Closes #1532

Author: danielcopper

docs/architecture/backend-architecture.md

@@ -510,9 +510,25 @@ identity — the same identity the #742 completion stamp uses — with the displ
 reporter (`_resolve_collection_memberships`) then groups the accumulator's entries by name and **unions** their resolved
 appId sets (order-preserving, de-duplicated across collections; each collection's own resolution already dedups within),
 emitting the unchanged by-name `romm_collection_app_ids: {name → [appId]}` contract — a single-collection name unions a
-set of one and is byte-for-byte the pre-#1503 output. The plugin **unions rather than owner-filters** here: RomM
-deliberately exposes public collections across accounts, so syncing them unfiltered is the established behaviour (an
-own/all QAM toggle is a separate concern).
+set of one and is byte-for-byte the pre-#1503 output. The union runs **after** the owner-scope filter (below): once a
+foreign collection is dropped from the work queue it never reaches the accumulator, so "Own" narrows what is unioned
+rather than changing how the union works.
+
+**Collection owner-scope filter — "Own" is a sync scope, not just a display filter (#1532).** RomM's collection list
+endpoints return the signed-in user's own collections plus every other user's _public_ collection. The QAM
+`Show
+collections` control writes `collection_owner_scope` (`"own"` / `"all"`, default `"all"`); `get_collections` also
+tags each row with `is_own` so the frontend can hide foreign ones under "Own". Ownership is a pure predicate
+(`domain/collection_owner.is_own_collection`): a collection is own when it is a **franchise/virtual** collection (RomM's
+`VirtualCollection` model carries no `user_id` column — these are global/derived and belong to no one, so they always
+survive), when the plugin's own identity is unknown (the **degrade-to-"All" fallback**), or when the collection's
+`user_id` equals the stored `romm_user_id`; only user and smart collections carry a `user_id` to compare.
+`build_work_queue` applies the same predicate: under `"own"` **with a known identity** it drops foreign user/smart units
+from the queue — so a foreign collection enabled earlier is never synced — while franchise units and every unit under
+`"all"` pass through unchanged. The scope filters **over** the per-kind enable state without mutating it, so switching
+back to `"all"` restores the prior enables. Because an **unknown identity never filters**, the feature is non-breaking:
+it silently no-ops until `romm_user_id` is stamped (see the ConnectionService lazy-identity note), then activates — no
+re-login required.
 
 **Incremental skip — the per-platform completion stamp is the sole authority.** A platform unit skips only when its
 `PlatformSyncState` stamp exists
@@ -992,6 +1008,21 @@ restored) keeps the still-current server's id. `ensure_device_registered` never
 permission-degraded (403/timeout) session leaves the identity intact. This is Phase 0a of the RomM Device Sync negotiate
 adoption ([ADR-0016](../adr/0016-save-sync-hands-detection-to-romm-negotiate.md)).
 
+**The signed-in user's own id (`romm_user_id`) is bound to the token — stamped at sign-in, backfilled lazily, cleared on
+sign-out.** It drives the collection owner-scope filter (`build_work_queue` + `get_collections`, described in the
+LibraryService section above). Every sign-in path re-derives it from the freshly authenticated token so it can never
+linger for a different user or a different server: the mint path (`establish_token`) probes `GET /api/users/me` after
+host-binding the minted token (the mint response carries only the token id, not the user id); the pasted/paired paths
+reuse the id from the `/api/users/me` validation probe they already run (no second call). In every case the id is set
+**in memory before** the token-persist save, so it rides the same single atomic `save_settings()` — the sign-in write
+shape is unchanged. It is part of the snapshot/restore auth-state set, so a failed sign-in restores the previous id, and
+it is cleared in each path's in-memory auth clear so a probe failure or a malformed payload leaves it `None` rather than
+stale — degrading the "Own" filter to "All" until the next backfill. Existing installs (a valid token minted before this
+setting existed) carry no id; `test_connection` **lazily backfills** it — when a token is present and the id is missing,
+the successful connection check probes `/api/users/me` and persists the id (its own save), so the filter activates
+without a re-login. A known id needs no network on later checks. Every identity read is best-effort: a failure never
+fails the sign-in or the connection check.
+
 The no-sign-in URL change path (`SettingsService.save_server_url`) deliberately does not touch the token, so pointing
 the URL at a different origin leaves the stored token's origin mismatched and the auth-header guard makes subsequent
 data flows fail fast with `config_error` until the user signs in again. Because every data flow (including device

docs/user-guide/syncing-your-library.md

@@ -229,6 +229,22 @@ collections, or use the paired **Enable All** / **Disable All** buttons to bulk-
 **Show collection games in platform groups** toggle controls whether games pulled in via a collection also get added to
 their platform's Steam group.
 
+#### Own / All
+
+On a **shared RomM server** the collection list includes every other user's _public_ collections alongside your own. The
+**Show collections** control at the top of the Collections page lets you narrow that down:
+
+- **All** (default) — every collection the server lists, including other users' public ones. This is the original
+  behaviour.
+- **Own** — only the collections you own. Foreign collections are hidden from the sub-tabs and are excluded from the
+  sync, even if one was enabled earlier — switching back to **All** brings your earlier choices back, since the scope
+  filters over your enable state rather than changing it.
+
+**Franchise collections always sync** under either setting: they are auto-generated groupings that belong to no one, so
+"Own" never hides them. The filter only becomes active once the plugin knows your account identity, which it learns the
+first time you sign in (existing sign-ins pick it up on the next connection check). Until then, **Own** behaves exactly
+like **All** — it never hides a collection it can't yet attribute.
+
 If two enabled collections share the same name — for example a personal collection and a smart or franchise collection
 called the same thing, or (on a shared server) another account's public collection — they **merge into a single Steam
 collection** carrying the combined set of games. RomM allows collections to share a name, but Steam identifies a

main.py

@@ -339,6 +339,9 @@ async def set_all_collections_sync(self, enabled, scope=None):
     async def save_collection_platform_groups(self, enabled):
         return self._settings_service.save_collection_platform_groups(enabled)
 
+    async def set_collection_owner_scope(self, scope):
+        return self._settings_service.set_collection_owner_scope(scope)
+
     @migration_blocked
     async def start_sync(self):
         return self._sync_service.start_sync()

py_modules/adapters/persistence.py

@@ -41,9 +41,19 @@ def time(self) -> float:
     "romm_api_token_id": None,
     "romm_api_token_origin": None,
     "romm_api_token_source": None,
+    # The signed-in RomM user's own id (``/api/users/me`` ``id``), or ``None``
+    # when identity is not yet known. Bound to the token like the device id —
+    # stamped at sign-in, backfilled lazily on a connection check, cleared on
+    # sign-out. Drives the collection owner-scope filter; ``None`` makes "Own"
+    # behave like "All" (the non-breaking fallback).
+    "romm_user_id": None,
     "enabled_platforms": {},
     "enabled_collections": {"user": {}, "smart": {}, "franchise": {}},
     "collection_create_platform_groups": False,
+    # QAM collection owner-scope: ``"all"`` (default — every collection the
+    # server lists) or ``"own"`` (only the signed-in user's own collections;
+    # franchise/virtual collections have no owner and always survive).
+    "collection_owner_scope": "all",
     "preferred_region": "auto",
     "steam_input_mode": "default",
     "steamgriddb_api_key": "",

py_modules/domain/collection_owner.py

@@ -0,0 +1,49 @@
+"""Owner-scope classification for RomM collections.
+
+The pure predicate behind the QAM "Own / All" collection filter. RomM's
+collection listings return the signed-in user's own collections plus every
+other user's PUBLIC collection; "Own" hides the foreign ones. This module owns
+the single rule that decides whether a collection counts as the user's own —
+used both to tag the frontend list (``is_own``) and to drop foreign units from
+the sync work queue. No I/O, no state: identity and the collection's owner id
+come in as arguments.
+
+Two invariants make the filter safe and non-breaking:
+
+* **Franchise/virtual collections have no owner.** They are global/derived —
+  RomM's ``VirtualCollection`` model carries no ``user_id`` column and returns
+  them identically to every user — so they are always own and always survive
+  an "Own" filter.
+* **Unknown identity degrades to "All".** When the plugin does not yet know its
+  own user id (never fetched / offline), every collection is treated as own, so
+  "Own" filters nothing rather than filtering against the wrong identity.
+"""
+
+from __future__ import annotations
+
+
+def is_own_collection(collection_user_id: object, own_user_id: int | None, *, kind: str) -> bool:
+    """Whether a collection is the signed-in user's own (survives an "Own" filter).
+
+    Parameters
+    ----------
+    collection_user_id:
+        The collection's owner id (``user_id``) from the RomM listing dict, or
+        ``None``/absent. Compared by value against *own_user_id*. Only user and
+        smart collections carry it; franchise/virtual collections never do.
+    own_user_id:
+        The signed-in user's own id (``settings["romm_user_id"]``), or ``None``
+        when identity is not yet known.
+    kind:
+        ``"user"``, ``"smart"`` or ``"franchise"``.
+
+    Returns ``True`` (own) when the collection is a franchise/virtual collection
+    (no owner), when our own identity is unknown (the non-breaking fallback), or
+    when the collection's owner id equals ours. ``False`` (foreign) only when a
+    user/smart collection is owned by a different known id.
+    """
+    if kind == "franchise":
+        return True
+    if own_user_id is None:
+        return True
+    return collection_user_id == own_user_id

py_modules/services/connection.py

@@ -173,6 +173,7 @@ async def test_connection(self) -> dict[str, Any]:
         if version_error is not None:
             return version_error
 
+        await self._backfill_user_id_best_effort()
         return self._success_result(version)
 
     async def probe_reachability(self) -> dict[str, Any]:
@@ -240,6 +241,10 @@ async def establish_token(
         self._settings["romm_api_token"] = None
         self._settings["romm_api_token_id"] = None
         self._settings["romm_api_token_origin"] = None
+        # A new sign-in invalidates the stored identity — re-derived below from
+        # the freshly minted token, so it can never linger for a different user
+        # or a different server.
+        self._settings["romm_user_id"] = None
 
         try:
             version = await self._loop.run_in_executor(None, self._probe_version)
@@ -289,6 +294,14 @@ async def establish_token(
                 "message": "RomM did not return a usable token",
             }
 
+        # Host-bind the minted token in memory so the identity probe
+        # authenticates, then stamp the user id — both ride the single atomic
+        # token-persist save below (the mint response carries only the token id,
+        # not the user id, so /api/users/me is the only source here).
+        self._settings["romm_api_token"] = raw_token
+        self._settings["romm_api_token_origin"] = normalize_origin(trimmed)
+        await self._resolve_user_id_in_memory()
+
         try:
             self._persist_token(raw_token, token_id, origin=normalize_origin(trimmed), source="minted")
         except Exception as e:
@@ -344,6 +357,9 @@ async def establish_user_token(
         self._settings["romm_api_token_id"] = None
         self._settings["romm_api_token_origin"] = normalize_origin(trimmed)
         self._settings["romm_api_token_source"] = "user"
+        # A new sign-in invalidates the stored identity — re-derived from the
+        # pasted token's /api/users/me validation probe below.
+        self._settings["romm_user_id"] = None
 
         try:
             version = await self._loop.run_in_executor(None, self._probe_version)
@@ -403,6 +419,9 @@ async def establish_paired_token(
         self._settings["romm_api_token"] = None
         self._settings["romm_api_token_id"] = None
         self._settings["romm_api_token_origin"] = None
+        # A new sign-in invalidates the stored identity — re-derived from the
+        # exchanged token's /api/users/me validation probe below.
+        self._settings["romm_user_id"] = None
 
         try:
             version = await self._loop.run_in_executor(None, self._probe_version)
@@ -475,7 +494,7 @@ async def _validate_and_persist_user_token(
         token value is never logged.
         """
         try:
-            await self._loop.run_in_executor(None, self._romm_api.get_current_user)
+            user_data = await self._loop.run_in_executor(None, self._romm_api.get_current_user)
         except RommAuthError:
             self._restore_auth_state(snapshot)
             return {"success": False, "reason": ErrorCode.AUTH_FAILED.value, "message": _USER_TOKEN_INVALID_MESSAGE}
@@ -486,6 +505,11 @@ async def _validate_and_persist_user_token(
             self._restore_auth_state(snapshot)
             return error_response(e)
 
+        # Stamp the user identity in memory so it rides the single atomic
+        # token-persist save (the validation probe already returned it — no
+        # second /api/users/me call).
+        self._set_user_id_in_memory(user_data)
+
         try:
             self._persist_token(raw_token, None, origin=normalize_origin(trimmed), source="user")
         except Exception as e:
@@ -536,6 +560,72 @@ async def _forget_device_on_origin_change(self, old_token_origin: str | None, ne
         except Exception as e:
             self._logger.warning(f"Could not clear device id after origin change: {e}")
 
+    @staticmethod
+    def _extract_user_id(user_data: object) -> int | None:
+        """Read the RomM user id off a ``/api/users/me`` dict, or ``None``.
+
+        Tolerant of an untrusted server shape: a non-dict payload, a missing
+        ``id``, a non-int, or a bool (``isinstance(True, int)`` is ``True`` in
+        Python) all yield ``None`` so a malformed identity never becomes a wrong
+        owner-scope filter.
+        """
+        user_id = user_data.get("id") if isinstance(user_data, dict) else None
+        if isinstance(user_id, bool) or not isinstance(user_id, int):
+            return None
+        return user_id
+
+    def _set_user_id_in_memory(self, user_data: object) -> None:
+        """Stamp ``settings['romm_user_id']`` from a ``/api/users/me`` dict, no save.
+
+        The value rides the sign-in's single atomic token-persist save, so
+        identity lands on disk together with the token (never a second write). A
+        malformed payload yields ``None`` — "Own" then degrades to "All" until
+        the lazy backfill re-derives it.
+        """
+        self._settings["romm_user_id"] = self._extract_user_id(user_data)
+
+    async def _resolve_user_id_in_memory(self) -> None:
+        """Fetch the minted token's user identity into memory (best-effort, no save).
+
+        The mint response carries only the token id, not the user id, so the
+        freshly host-bound token is probed against ``/api/users/me``.
+        Best-effort: a failure leaves ``romm_user_id`` cleared (``None``) so the
+        single token-persist save records ``None`` and the lazy backfill
+        re-derives it on the next connection check. Never fails the sign-in.
+        """
+        try:
+            user_data = await self._loop.run_in_executor(None, self._romm_api.get_current_user)
+        except Exception as e:
+            self._logger.warning(f"Could not read RomM user identity at sign-in: {e}")
+            return
+        self._set_user_id_in_memory(user_data)
+
+    async def _backfill_user_id_best_effort(self) -> None:
+        """Lazily stamp ``romm_user_id`` from the current token when it is unknown.
+
+        Existing installs carry a valid token but no stored identity (the setting
+        postdates them). This backfills it on the next connection check so the
+        collection owner-scope filter can activate without a re-login. Fires only
+        when the id is missing (a known id needs no network) and a token exists;
+        persists in its own save (no token write is in flight here). Best-effort
+        — a failure or malformed payload leaves the id unknown, so "Own" keeps
+        behaving like "All".
+        """
+        if self._settings.get("romm_user_id") is not None:
+            return
+        if not self._settings.get("romm_api_token"):
+            return
+        try:
+            user_data = await self._loop.run_in_executor(None, self._romm_api.get_current_user)
+        except Exception as e:
+            self._logger.warning(f"Could not backfill RomM user identity: {e}")
+            return
+        user_id = self._extract_user_id(user_data)
+        if user_id is None:
+            return
+        self._settings["romm_user_id"] = user_id
+        self._settings_persister.save_settings()
+
     async def migrate_legacy_credentials(self) -> None:
         """Upgrade a stored-password install to a Client API Token on startup.
 
@@ -601,6 +691,9 @@ def sign_out(self) -> dict[str, Any]:
         self._settings["romm_api_token_id"] = None
         self._settings["romm_api_token_origin"] = None
         self._settings["romm_api_token_source"] = None
+        # Identity is forgotten alongside the token — "Own" collection scope has
+        # no basis without a signed-in user, and the next sign-in re-derives it.
+        self._settings["romm_user_id"] = None
         try:
             self._settings_persister.save_settings()
         except Exception as e:
@@ -618,6 +711,9 @@ def sign_out(self) -> dict[str, Any]:
         "romm_api_token_id",
         "romm_api_token_origin",
         "romm_api_token_source",
+        # Identity is bound to the token: a failed sign-in restores the previous
+        # user id, never leaving a half-changed identity behind.
+        "romm_user_id",
     )
 
     def _snapshot_auth_state(self) -> dict[str, Any]: