Authorize DID re-mint with the JWT, not key continuity

[brianorwhatever]

Follow-up to #216. Signing in on prod produced the error that invalidates its design:

Key did:key:z6MktvNdMfyjcW6eFDgALRK2cYbdEU9uxqRxLxBy65mRuXah
is not authorized to update.

Why #216 could never work

didwebvh-ts raises that when a log's proof key isn't in its updateKeys. The browser's current localStorage key is not the key that minted the existing DID — localStorage is per-origin, and the original controller key went with the origin the DID was minted on.

#216 required the new log's update keys to intersect the old log's. That's unsatisfiable for exactly the identities this is meant to repair. The hook failed client-side before ever reaching Convex, which is why prod logs showed no invocation at all.

There is no key continuity left to preserve. So the re-mint stops pretending to be a continuation and issues a genuinely new identity.

The new authorization

POST /api/user/remintDid calls requireAuth(), takes the account from the verified token, and rewrites only that account's rows. The request body cannot name a victim — it supplies the new DID, never the identity.

This is stricter than the status quo, not a relaxation: /api/user/updateDID already lets an authenticated user set their DID to anything, and today that silently strands every row on the old value. Pairing the swap with applyRemint closes that gap.

applyRemint — the 17-table/24-field rewrite with 8 tests — is unchanged. It never cared where the new DID came from.

Also

• Extracts getConvexHttpUrl into lib/convexUrls so the hook can reach HTTP actions without importing the auth provider, which imports the hook.
• The client reloads after a successful re-mint. The app is keyed by DID throughout, so live subscriptions would otherwise keep reading rows under the old identity.

What this costs

The new DID has no cryptographic link to the old one — it's a fresh identity that inherits the account's data. Given the old key is unrecoverable, the alternative isn't "preserve continuity", it's "stay broken". Old trypoo.app URLs stay dead either way, and did:cel envelopes still record the original creator DID in signed content.

Suite 114 pass / 0 fail; both typechecks clean; lint unchanged from baseline.

After merge

Sign in on web. Expect a [remint] line in the console, a reload, then:

npx convex run --prod migrations/remintUserDidDb:listUsersOnDomain '{"domain":"trypoo.app"}'

should drop by one per account signed in, draining to [].

🤖 Generated with Claude Code

Note

Authorize DID re-mint via JWT instead of key continuity in remintUserDID

• Adds a new authenticated POST /api/user/remintDid HTTP endpoint (convex/userHttp.ts) that reassigns all rows from a user's current DID to a newly minted did:webvh, authorizing via JWT rather than trusting any user ID in the request body.
• The endpoint resolves the caller's account by turnkeySubOrgId from the JWT using a new internal query findUserBySubOrg (convex/migrations/remintUserDidDb.ts), optionally persisting a DID log when didLog and path are provided.
• Refactors src/hooks/useDidDomainRemint.ts to accept a JWT token and call the new HTTP endpoint directly via fetch with Authorization: Bearer, replacing the previous Convex action invocation; forces a full page reload on success.
• Extracts getConvexHttpUrl into a shared src/lib/convexUrls.ts utility to avoid cyclic imports.
• Behavioral Change: the repair pass now requires a valid JWT token to run; remint attempts will short-circuit until the token is available.

^{Macroscope summarized b43dc87.}