fix(hub): the admin allow-list grants an account, not a username

Each name in admin_usernames is pinned to the first active account seen
holding it (admin_pins), so a name freed by a deletion grants nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 21 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py
index a0437d6..293b940 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/models.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py
@@ -437,6 +437,27 @@ class LoginThrottle(Base):
     last_failure_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
 
 
+class AdminPin(Base):
+    """
+    Which account an allow-listed admin name (`hub.toml` `admin_usernames`)
+    belongs to, recorded the first time an active account holds it.
+
+    The allow-list names people by username, and a username is not an identity:
+    deleting an account releases its name, and whoever registered it next
+    inherited the admin role. The allow-list now grants the pinned
+    account, so a name that changes hands grants nothing. No foreign key, on
+    purpose: the pin has to outlive the account it points at, or the name would
+    be free to pin again. A name removed from the allow-list loses its pin at
+    the next start, which is how an operator hands a listed name to a new
+    account.
+    """
+    __tablename__ = "admin_pins"
+
+    username:  Mapped[str] = mapped_column(String(64), primary_key=True)
+    user_id:   Mapped[str] = mapped_column(String(36), nullable=False)
+    pinned_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
+
+
 class HubSetting(Base):
     """
     Instance-wide settings an admin changes at runtime from the panel.