samagotchi 0.103.0 → 0.104.0

data/lib/samagotchi/web/grants.rb

@@ -0,0 +1,302 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "json"
+require "securerandom"
+require "time"
+require "rack/utils"
+require_relative "../atomic_file"
+require_relative "../session"
+require_relative "../redacted_inspect"
+
+module Samagotchi
+  module Web
+    # Participants' access to one session each (the shared-sessions plan,
+    # security model §1): a grant binds one random token to one session, one
+    # participant and one role, until it expires or is revoked. Only the
+    # token's SHA-256 digest is kept, in
+    # $XDG_STATE_HOME/samagotchi/web-grants/grants.json (0600, in its own 0700
+    # folder): the token is shown once, when it is issued, and a leaked file
+    # grants nothing. The owner's Web::Token is a different credential and
+    # never touches this file. See docs/internals/participants.md.
+    #
+    # One object per process (chi web, a chi share run): writes take a lock
+    # file next to the store, so the two never lose each other's grants; the
+    # reads follow the file's mtime, as Token::Source does.
+    class Grants
+      include RedactedInspect
+
+      DIR = "web-grants"
+      FILE = "grants.json"
+      LOCK = "grants.lock"
+      # What a participant token starts with: the gate looks up only these,
+      # and a leaked one is recognisable (an owner token never has it).
+      PREFIX = "chp_"
+      # 32 random bytes, as Web::Token's.
+      BYTES = 32
+      DAY = 86_400
+      # D8: a grant lasts a week unless chi share --expires says otherwise,
+      # and never more than MAX_TTL.
+      DEFAULT_TTL = 7 * DAY
+      MAX_TTL = 30 * DAY
+      # Ended grants (revoked, expired) are kept this long, so their token
+      # answers token_revoked / token_expired rather than a bare 401.
+      KEEP_ENDED = 30 * DAY
+      # last_used_at is written at most this often per grant.
+      TOUCH_INTERVAL = 60
+      KINDS = %w[human agent].freeze
+      # The only role in v1: a reviewer reads and (P3) comments.
+      ROLES = %w[reviewer].freeze
+      NAME_MAX = 64
+      ID_RE = /\Ap_[0-9a-f]{8}\z/
+
+      # The store's folder or file can be read by others (chi web refuses to
+      # start), or a grant can't be made from what was given.
+      class Insecure < StandardError; end
+      # Not ArgumentError: the session commands read that as "no such
+      # session".
+      class Invalid < StandardError; end
+
+      # One participant's access to one session. +id+ (p_<8 hex>) names the
+      # participant too: a turn they send is authored "p:<id>" (P3).
+      # +revoked_by+ why it was revoked: "owner", "archive", "delete",
+      # "gone" (the session was pruned).
+      Grant = Data.define(:id, :session_id, :digest, :kind, :name, :role, :created_at, :expires_at, :revoked_at,
+                          :revoked_by, :last_used_at) do
+        def self.from_h(hash)
+          new(**members.to_h { |key| [key, hash[key.to_s]] })
+        end
+
+        # The author a participant's turn carries (Principal#author).
+        def author = "p:#{id}"
+
+        # :active, :revoked or :expired at +now+ (a Time).
+        def state(now)
+          return :revoked if revoked_at
+          return :expired if Time.iso8601(expires_at) <= now
+
+          :active
+        end
+
+        def active?(now) = state(now) == :active
+
+        # When it stopped working (revoked or expired), nil while active.
+        def ended_at(now)
+          return Time.iso8601(revoked_at) if revoked_at
+
+          expiry = Time.iso8601(expires_at)
+          expiry <= now ? expiry : nil
+        end
+
+        # Never the digest: what chi share ls and the owner's routes show.
+        def public_h(now)
+          { id: id, session_id: session_id, kind: kind, name: name, role: role, created_at: created_at,
+            expires_at: expires_at, revoked_at: revoked_at, revoked_by: revoked_by, last_used_at: last_used_at,
+            state: state(now).to_s }
+        end
+
+        def to_store = to_h.transform_keys(&:to_s)
+
+        def inspect = "#<Grant #{id} #{session_id[0, 8]} #{name.inspect}>"
+        alias_method :to_s, :inspect
+      end
+
+      # A new grant and its token: the only time the token exists outside
+      # the participant's hands.
+      Issued = Data.define(:grant, :token) do
+        def inspect = "#<Issued #{grant.id}>"
+        alias_method :to_s, :inspect
+      end
+
+      # $XDG_STATE_HOME/samagotchi/web-grants/grants.json, next to web-token;
+      # +state_dir+ is the sessions dir (Session.default_state_dir).
+      def self.path(state_dir: nil, env: ENV)
+        File.join(File.dirname(state_dir || Session.default_state_dir(env: env)), DIR, FILE)
+      end
+
+      def self.digest(token) = Digest::SHA256.hexdigest(token.to_s)
+
+      def self.token?(value) = value.is_a?(String) && value.start_with?(PREFIX)
+
+      # One line, at most NAME_MAX characters, no brackets (a name can't
+      # forge P3's "[Review contribution from …]" header).
+      # @raise [Invalid] nothing left
+      def self.clean_name(name)
+        clean = name.to_s.gsub(/[[:cntrl:]\[\]]/, " ").squeeze(" ").strip[0, NAME_MAX].to_s.strip
+        raise Invalid, "a participant needs a name" if clean.empty?
+
+        clean
+      end
+
+      # Refuses a store others could read: the grants folder must be 0700
+      # and the file 0600, both this user's. Only these two: the state dir
+      # above them is often 0755, and that is fine. A folder not made yet
+      # passes (it is made 0700).
+      # @raise [Insecure]
+      def self.check_permissions!(path)
+        [File.dirname(path), path].each do |target|
+          stat = File.stat(target)
+          next if stat.mode.nobits?(0o077) && stat.uid == Process.uid
+
+          raise Insecure, "#{target} can be read by other users: chmod 700 #{File.dirname(path)} and 600 #{path} " \
+                          "(it holds the participants' grants)"
+        rescue Errno::ENOENT
+          next
+        end
+      end
+
+      attr_reader :path
+
+      # @param clock [#call] the Time now (specs inject one)
+      def initialize(path = Grants.path, clock: -> { Time.now })
+        @path = path
+        @clock = clock
+        @mutex = Mutex.new
+        @stamp = nil
+        @grants = []
+        @touched = {}
+      end
+
+      def now = @clock.call
+
+      # A new grant for +session_id+, written before the token is handed out.
+      # @param ttl [Integer] seconds (DEFAULT_TTL; at most MAX_TTL)
+      # @return [Issued]
+      # @raise [Invalid]
+      def issue(session_id:, name:, kind: "human", role: "reviewer", ttl: DEFAULT_TTL)
+        Session.check_id!(session_id)
+        raise Invalid, "kind is human or agent, not #{kind}" unless KINDS.include?(kind)
+        raise Invalid, "role is reviewer, not #{role}" unless ROLES.include?(role)
+        raise Invalid, "a grant lasts 1 hour to 30 days" unless ttl.is_a?(Integer) && ttl.between?(3600, MAX_TTL)
+
+        clean = Grants.clean_name(name)
+        token = "#{PREFIX}#{SecureRandom.urlsafe_base64(BYTES)}"
+        issued = now
+        update do |grants|
+          id = fresh_id(grants)
+          grant = Grant.new(id: id, session_id: session_id, digest: Grants.digest(token), kind: kind, name: clean,
+                            role: role, created_at: stamp(issued), expires_at: stamp(issued + ttl), revoked_at: nil,
+                            revoked_by: nil, last_used_at: nil)
+          [grants + [grant], Issued.new(grant: grant, token: token)]
+        end
+      end
+
+      # The grant +token+ was issued for, in any state (an ended one too, so
+      # the gate can say why it's refused); nil for anything else.
+      # @return [Grant, nil]
+      def lookup(token)
+        return nil unless Grants.token?(token)
+
+        digest = Grants.digest(token)
+        # Every grant is compared, whatever matches first.
+        current.select { |grant| Rack::Utils.secure_compare(grant.digest, digest) }.first
+      end
+
+      # @return [Grant, nil] the grant with this id
+      def find(id) = current.find { |grant| grant.id == id }
+
+      # Whether grant +id+ still works (a participant stream's running check).
+      def active?(id) = !!find(id)&.active?(now)
+
+      # @param session_id [String, nil] one session's, or every grant
+      # @return [Array<Grant>]
+      def list(session_id: nil)
+        current.select { |grant| session_id.nil? || grant.session_id == session_id }
+      end
+
+      # Revokes the active grants of +session_id+ (just +id+ when given), or
+      # every session's when +session_id+ is nil.
+      # @param by [String] why: "owner", "archive", "delete", "gone"
+      # @return [Array<Grant>] the grants it revoked (already ended ones are
+      #   left as they were)
+      def revoke(session_id: nil, id: nil, by: "owner")
+        at = now
+        matches = lambda do |grant|
+          grant.active?(at) && (session_id.nil? || grant.session_id == session_id) && (id.nil? || grant.id == id)
+        end
+        # Nothing to revoke (an archive of a session nobody was invited to):
+        # no write, no store made.
+        return [] unless current.any?(&matches)
+
+        update do |grants|
+          revoked = []
+          grants = grants.map do |grant|
+            next grant unless matches.call(grant)
+
+            grant.with(revoked_at: stamp(at), revoked_by: by).tap { |ended| revoked << ended }
+          end
+          [grants, revoked]
+        end
+      end
+
+      # Records a use of grant +id+, at most once per TOUCH_INTERVAL.
+      def touch(id)
+        at = now
+        @mutex.synchronize do
+          last = @touched[id]
+          return if last && at - last < TOUCH_INTERVAL
+
+          @touched[id] = at
+        end
+        update do |grants|
+          [grants.map { |grant| grant.id == id ? grant.with(last_used_at: stamp(at)) : grant }, nil]
+        end
+      end
+
+      private
+
+      # The grants on disk, re-read when the file changed (one stat a call).
+      def current
+        stamp = begin
+          stat = File.stat(@path)
+          [stat.mtime, stat.size, stat.ino]
+        rescue Errno::ENOENT
+          nil
+        end
+        @mutex.synchronize do
+          unless stamp == @stamp
+            @grants = stamp ? read : []
+            @stamp = stamp
+          end
+          @grants
+        end
+      end
+
+      def read
+        data = JSON.parse(File.read(@path))
+        Array(data.is_a?(Hash) ? data["grants"] : nil).filter_map { |hash| Grant.from_h(hash) if hash.is_a?(Hash) }
+      rescue Errno::ENOENT, JSON::ParserError, ArgumentError
+        []
+      end
+
+      # Read, change and write the store under its lock (another process
+      # may write it too). The block takes the grants and returns
+      # [new grants, result]. Ended grants older than KEEP_ENDED go.
+      def update
+        dir = File.dirname(@path)
+        FileUtils.mkdir_p(dir, mode: 0o700)
+        File.chmod(0o700, dir)
+        File.open(File.join(dir, LOCK), File::RDWR | File::CREAT, 0o600) do |lock|
+          lock.flock(File::LOCK_EX)
+          grants, result = yield(read)
+          at = now
+          kept = grants.reject { |grant| (ended = grant.ended_at(at)) && at - ended > KEEP_ENDED }
+          body = JSON.pretty_generate({ "version" => 1, "grants" => kept.map(&:to_store) })
+          AtomicFile.write(@path, "#{body}\n", perm: 0o600)
+          @mutex.synchronize { @stamp = nil }
+          result
+        end
+      end
+
+      def fresh_id(grants)
+        loop do
+          id = "p_#{SecureRandom.hex(4)}"
+          return id unless grants.any? { |grant| grant.id == id }
+        end
+      end
+
+      def stamp(time) = time.utc.iso8601
+    end
+  end
+end

data/lib/samagotchi/web/participant_access.rb

@@ -0,0 +1,286 @@
+# frozen_string_literal: true
+
+require "cgi/escape"
+require_relative "grants"
+require_relative "principal"
+require_relative "../archive_store"
+require_relative "../participants"
+require_relative "../session"
+require_relative "../log"
+
+module Samagotchi
+  module Web
+    # What a participant (a Web::Grants token) may do in chi web, mixed into
+    # App: the gate's lookup of their grant, the refusals that are theirs
+    # (token_revoked, token_expired, another session's 404, not_permitted
+    # by role), the trimmed and filtered answers of the :participant routes,
+    # the minimal participant page, and the running check that ends their
+    # streams when the grant does. See docs/internals/participants.md.
+    module ParticipantAccess
+      # A participant's refused routes are audited at most this often per
+      # route (a page retrying would fill the log).
+      REFUSED_AUDIT_INTERVAL = 60.0
+
+      ENDED = {
+        revoked: ["token_revoked", "this review link was revoked by the session's owner"],
+        expired: ["token_expired", "this review link expired: ask the session's owner for a new one"]
+      }.freeze
+      NOT_PERMITTED = "a participant can't do that: only the session's owner can"
+
+      private
+
+      def init_participant_access(grants, state_dir)
+        @grants = grants || Grants.new(Grants.path(state_dir: state_dir))
+        @participant_mutex = Mutex.new
+        @participant_peers = Hash.new { |hash, key| hash[key] = Set.new }
+        @participant_refused = {}
+        @participant_expired = Set.new
+      end
+
+      # The participant principal for the first of +tokens+ that is a live
+      # grant's, or nil. An ended grant met on the way is kept in the
+      # request's env for #token_gate's answer (#grant_ended_response). A
+      # grant whose session was archived or is gone is revoked here (archive
+      # and delete revoke too; this catches retention's prune and a delete
+      # from another process).
+      # @return [Principal, nil]
+      def participant_principal(req, tokens)
+        tokens.each do |token|
+          grant = @grants.lookup(token) or next
+          grant = settle_grant(grant)
+          state = grant.state(@grants.now)
+          if state == :active
+            req.env[GRANT_TOKEN_ENV] = token
+            return Principal.new(kind: :participant, grant: grant)
+          end
+          req.env[ENDED_GRANT_ENV] ||= [grant, state]
+        end
+        nil
+      end
+
+      GRANT_TOKEN_ENV = "samagotchi.grant_token"
+      ENDED_GRANT_ENV = "samagotchi.ended_grant"
+
+      def settle_grant(grant)
+        return grant unless grant.active?(@grants.now)
+
+        by = if !File.exist?(Session.session_file(grant.session_id, state_dir: default_state_dir)) then "gone"
+             elsif ArchiveStore.archived?(Session.session_dir(grant.session_id, state_dir: default_state_dir)) then "archive"
+             end
+        return grant unless by
+
+        Participants.revoke(@grants, session_id: grant.session_id, id: grant.id, by: by, state_dir: default_state_dir)
+        @grants.find(grant.id) || grant
+      end
+
+      # 401 token_revoked / token_expired for an ended grant's token (the
+      # page's HTML says the same), nil when none was presented.
+      def grant_ended_response(req)
+        grant, state = req.env[ENDED_GRANT_ENV]
+        return nil unless grant
+
+        audit_expired(grant) if state == :expired
+        code, detail = ENDED.fetch(state)
+        return error_response(401, code, detail) if req.path_info.start_with?("/api/")
+
+        html_response(401, ENDED_PAGE)
+      end
+
+      def audit_expired(grant)
+        fresh = @participant_mutex.synchronize { @participant_expired.add?(grant.id) }
+        Participants.log(grant.session_id, :expired, state_dir: default_state_dir, participant: grant.id) if fresh
+      end
+
+      # A participant's request, past the gate: its use is recorded (the
+      # grant's last_used_at, at most once a minute) and a peer not seen
+      # since chi web started goes into the audit trail.
+      def participant_seen(req, principal)
+        grant = principal.grant
+        @grants.touch(grant.id)
+        peer = req.get_header("REMOTE_ADDR").to_s
+        fresh = @participant_mutex.synchronize { @participant_peers[grant.id].add?(peer) }
+        return unless fresh
+
+        Participants.log(grant.session_id, :peer, state_dir: default_state_dir, participant: grant.id, ip: peer,
+                                                  user_agent: req.get_header("HTTP_USER_AGENT").to_s[0, 200])
+      end
+
+      # A participant asking for a session that isn't their grant's: 404 as
+      # for one that doesn't exist, so they can't learn which do.
+      def other_session?(principal, path, captures)
+        return false if principal.owner? || !path.start_with?("/api/sessions/") || captures.empty?
+
+        captures.first != principal.grant.session_id
+      end
+
+      def unknown_session(id)
+        error_response(404, "not_found", "Session not found: #{id.to_s[0, 80]}")
+      end
+
+      # 403 not_permitted, worded for the principal's role; a participant's
+      # refusal is audited.
+      def not_permitted_for(req, principal)
+        return not_permitted if principal.owner?
+
+        audit_refused(req, principal.grant)
+        error_response(403, "not_permitted", NOT_PERMITTED)
+      end
+
+      def audit_refused(req, grant)
+        key = [grant.id, req.request_method, req.path_info]
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        due = @participant_mutex.synchronize do
+          @participant_refused.delete_if { |_, at| now - at >= REFUSED_AUDIT_INTERVAL } if @participant_refused.size > 256
+          last = @participant_refused[key]
+          (last.nil? || now - last >= REFUSED_AUDIT_INTERVAL).tap { |fresh| @participant_refused[key] = now if fresh }
+        end
+        return unless due
+
+        Participants.log(grant.session_id, :refused, state_dir: default_state_dir, participant: grant.id,
+                                                     method: req.request_method, path: req.path_info[0, 200],
+                                                     reason: "not_permitted")
+      end
+
+      # GET /api/info for a participant: what SessionAccess::Remote's
+      # check needs (app, version, features), not this machine's pid, cwd
+      # or LAN address.
+      def participant_info
+        json_response(200, { app: "chi-web", version: Samagotchi::VERSION, features: App::INFO_FEATURES })
+      end
+
+      # GET /api/sessions/:id for a participant (their grant's session):
+      # its title, status and participants, nothing of the conversation.
+      def participant_show(id)
+        session = @session_class.load(id, state_dir: default_state_dir)
+        json_response(200, { session: { id: session.id, title: participant_title(session), status: session.status,
+                                        participants: participant_names(id) } })
+      end
+
+      # The session's own title, never Session#display_title's fallback (the
+      # first prompt's opening words: the conversation).
+      def participant_title(session)
+        title = session.title.to_s.strip
+        title.empty? ? UNTITLED : title
+      end
+
+      UNTITLED = "an untitled session"
+
+      def participant_names(id)
+        now = @grants.now
+        Participants.read(id, state_dir: default_state_dir).select { |entry| entry.active?(now) }
+                    .map { |entry| { id: entry.id, name: entry.name, kind: entry.kind, role: entry.role } }
+      end
+
+      # The page a participant's link opens (P2: before comments exist).
+      # Never the owner's page, whose every route would refuse them.
+      def participant_page(principal)
+        grant = principal.grant
+        session = @session_class.load(grant.session_id, state_dir: default_state_dir)
+        name = CGI.escapeHTML(grant.name)
+        others = participant_names(grant.session_id).map { |entry| CGI.escapeHTML(entry[:name]) }
+        html_response(200, format(PARTICIPANT_PAGE, name: name, title: CGI.escapeHTML(participant_title(session)),
+                                                    status: CGI.escapeHTML(session.status.to_s),
+                                                    participants: others.join(", ")))
+      end
+
+      # Whether a principal's stream may go on (the proxy's running check,
+      # asked every BridgeClient::STREAM_POLL): while the server runs, and
+      # for a participant while their grant works, so a revoke or the expiry
+      # ends it within a poll (a chi share revoke in another process too:
+      # the grants file is re-read when it changes).
+      def stream_running(principal)
+        return @server_running if principal.owner?
+
+        id = principal.grant.id
+        -> { @server_running.call && @grants.active?(id) }
+      end
+
+      # ── The owner's routes ─────────────────────────────────────────────
+
+      # GET /api/sessions/:id/participants, GET /api/participants: the
+      # grants (one session's, or every one), in every state, never a token
+      # or digest.
+      def handle_participants_list(_req, id = nil)
+        now = @grants.now
+        json_response(200, { participants: @grants.list(session_id: id).map { |grant| grant.public_h(now) } })
+      end
+
+      # POST /api/sessions/:id/participants {name, kind?, ttl? (seconds)}:
+      # a new grant. The answer carries the token and the link once; chi
+      # keeps only its digest.
+      def handle_participants_invite(req, id)
+        body = body_hash(req) or return error_response(400, "invalid_json", "invalid JSON body")
+        ttl = body["ttl"]
+        return error_response(400, "invalid_participant", "ttl is a number of seconds") unless ttl.nil? || ttl.is_a?(Integer)
+
+        issued = Participants.invite(@grants, session_id: id, name: body["name"], kind: (body["kind"] || "human").to_s,
+                                              ttl: ttl, state_dir: default_state_dir)
+        json_response(201, { participant: issued.grant.public_h(@grants.now), token: issued.token,
+                             link: participant_link(req, id, issued.token), lan: !@lan.nil? })
+      rescue Grants::Invalid => e
+        error_response(400, "invalid_participant", e.message)
+      end
+
+      # DELETE /api/sessions/:id/participants[?id=p_…], DELETE
+      # /api/participants: revokes one participant, a session's or every
+      # one's; their open streams end within a poll.
+      def handle_participants_revoke(req, id = nil)
+        grant_id = req.params["id"]
+        if grant_id && !Grants::ID_RE.match?(grant_id.to_s)
+          return error_response(400, "invalid_participant", "not a participant id: #{grant_id.to_s[0, 40]}")
+        end
+
+        revoked = Participants.revoke(@grants, session_id: id, id: grant_id, by: "owner", state_dir: default_state_dir)
+        now = @grants.now
+        json_response(200, { revoked: revoked.map { |grant| grant.public_h(now) } })
+      end
+
+      # The link a participant opens: this chi web's LAN address when it has
+      # one (the owner may be asking on loopback), else the Host asked; the
+      # token traded for the cookie, the session in the fragment.
+      def participant_link(req, id, token)
+        host = req.get_header("HTTP_HOST").to_s
+        port = host[/:(\d+)\z/, 1] || req.port.to_s
+        name = @lan ? @lan[:ip] : host.sub(/:\d*\z/, "")
+        "http://#{name}:#{port}/?token=#{token}#s=#{id}"
+      end
+
+      def html_response(status, body)
+        [status, { "Content-Type" => "text/html; charset=utf-8", "Content-Length" => body.bytesize.to_s,
+                   "Cache-Control" => "no-store" }, [body]]
+      end
+
+      PAGE_STYLE = <<~CSS
+        :root { color-scheme: light dark; }
+        body { font: 16px/1.5 -apple-system, system-ui, sans-serif; max-width: 30rem; margin: 3rem auto; padding: 0 1rem; }
+        .meta { opacity: .75; }
+      CSS
+
+      PARTICIPANT_PAGE = <<~HTML
+        <!doctype html>
+        <html lang="en"><head><meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>chi · %<name>s's review</title>
+        <style>#{PAGE_STYLE}</style></head>
+        <body>
+        <h1>%<name>s's review</h1>
+        <p class="meta">%<title>s · %<status>s</p>
+        <p>Comments open soon: the owner will see what you write here.</p>
+        <p class="meta">Participants: %<participants>s</p>
+        </body></html>
+      HTML
+
+      ENDED_PAGE = <<~HTML
+        <!doctype html>
+        <html lang="en"><head><meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>chi: review link ended</title>
+        <style>#{PAGE_STYLE}</style></head>
+        <body>
+        <h1>chi</h1>
+        <p>This review link has expired or was revoked. Ask the session's owner for a new one.</p>
+        </body></html>
+      HTML
+    end
+  end
+end

data/lib/samagotchi/web/principal.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  module Web
+    # Who a chi web request is (App#principal_for). Today there is one
+    # kind: the owner, a peer on this machine or a request with the
+    # Web::Token access token. The routes' permission column
+    # (App::ROUTES, :owner or :participant) is checked against it, and a
+    # turn's author comes from it, never from the request body. See
+    # docs/internals/remote-sessions.md (Trust model).
+    #
+    # +kind+ :owner; +grant+ what a non-owner principal was admitted by
+    # (nil for the owner).
+    Principal = Data.define(:kind, :grant) do
+      def owner? = kind == :owner
+
+      # Whether this principal may use a route with +permission+ (a ROUTES
+      # row's): the owner every route, anyone else only a :participant one.
+      def permits?(permission) = owner? || permission == :participant
+
+      # The author a turn this principal sends carries: nil for the owner,
+      # so an owner's turn, its input file and its session stay as they
+      # were; any other principal's names it through its grant.
+      def author = owner? ? nil : grant.author
+    end
+
+    Principal::OWNER = Principal.new(kind: :owner, grant: nil)
+  end
+end

data/lib/samagotchi/web/server.rb

@@ -95,6 +95,8 @@ module Samagotchi
             puts lan_off_line(setting)
             return 0
           end
+          # The participants' grants: never served from a store others can read.
+          Grants.check_permissions!(Grants.path)
           if start(port: port, host: host, url: url, open_browser: open_browser, markdown: markdown, view: view,
                    annotate_presets: annotate_presets, editor: editor, lan: lan, working_set: working_set)
             0
@@ -102,7 +104,7 @@ module Samagotchi
             1
           end
         end
-      rescue Lan::Error => e
+      rescue Lan::Error, Grants::Insecure => e
         warn "Error: #{e.message}"
         1
       rescue Interrupt