samagotchi 0.108.0 → 0.110.0

data/lib/samagotchi/web/app.rb

@@ -38,6 +38,7 @@ require_relative "../version"
 require_relative "../config"
 require_relative "../output_formatter"
 require_relative "../image_store"
+require_relative "../message_time"
 require_relative "../context_note"
 require_relative "../context_sources"
 require_relative "../context_providers"
@@ -59,6 +60,7 @@ require_relative "principal"
 require_relative "participant_access"
 require_relative "participants_admin"
 require_relative "participant_review"
+require_relative "proxy_gate"
 require_relative "../log"
 require_relative "../paths"
 require_relative "../redacted_inspect"
@@ -79,6 +81,7 @@ module Samagotchi
       include ParticipantAccess
       include ParticipantsAdmin
       include ParticipantReview
+      include ProxyGate
 
       DEFAULT_HOST = BridgeClient::HOST
       BRIDGE_WAIT_TIMEOUT = 10.0
@@ -141,6 +144,10 @@ module Samagotchi
       #   loopback only, no token
       # @param grants [Grants, nil] the participants' grants (default: the
       #   store next to +state_dir+, Grants.path)
+      # @param public_url [PublicUrl, nil] behind an auth proxy
+      #   (web.public_url, ProxyGate): every request needs a token
+      # @param public_token [String, Token::Source, nil] the access token
+      #   with +public_url+ (the LAN one when both are set)
       def initialize(manager: nil, session_class: nil, state_dir: nil, public_dir: nil,
                      bridge_wait_timeout: BRIDGE_WAIT_TIMEOUT, markdown: false, view: Config::BY_KEY["web.view"].default, hub: nil,
                      annotate_presets: Config::BY_KEY["web.annotate_presets"].default,
@@ -148,7 +155,7 @@ module Samagotchi
                      events_heartbeat: EVENTS_HEARTBEAT, events_queue: EVENTS_QUEUE,
                      registry: nil, models_wait_timeout: MODELS_WAIT_TIMEOUT, lan: nil,
                      working_set: Config::BY_KEY["web.working_set"].default, wait_poll_interval: ReplyWait::POLL_INTERVAL,
-                     grants: nil)
+                     grants: nil, public_url: nil, public_token: nil)
         @manager = manager || SessionManager
         @registry = registry
         @registry_given = !registry.nil?
@@ -173,17 +180,36 @@ module Samagotchi
         @refused_logged = {}
         @wait_poll_interval = wait_poll_interval
         init_participant_access(grants, state_dir)
+        init_proxy_gate(public_url, public_token)
       end
 
       def call(env)
         started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        response = route(env)
+        response = unframed(route(env))
         log_request(env, response, started)
         response
       end
 
       private
 
+      # No page of chi web's may be framed by another (clickjacking): every
+      # HTML answer says so. The page's full CSP is a later change.
+      FRAME_HEADERS = { "X-Frame-Options" => "DENY", "Content-Security-Policy" => "frame-ancestors 'none'" }.freeze
+      FRAME_DESTS = %w[iframe frame embed object].freeze
+
+      def unframed(response)
+        status, headers, body = response
+        return response unless headers["Content-Type"].to_s.start_with?("text/html")
+
+        [status, headers.merge(FRAME_HEADERS), body]
+      end
+
+      # A frame/embed/object load from anything but the page's own origin.
+      def framed?(env)
+        FRAME_DESTS.include?(env["HTTP_SEC_FETCH_DEST"].to_s.downcase) &&
+          env["HTTP_SEC_FETCH_SITE"].to_s.downcase != "same-origin"
+      end
+
       # The routes, first match wins: a handler takes the request and the
       # path's captures (the session id, an image's name). The fourth column
       # is who may use the route (ROUTE_PERMISSIONS, checked against the
@@ -200,6 +226,7 @@ module Samagotchi
         ["GET", %r{\A/api/sessions/resolve\z}, :handle_resolve, :participant],
         ["GET", %r{\A/api/sessions/summaries\z}, :handle_summaries, :owner],
         ["GET", %r{\A/api/info\z}, :handle_info, :participant],
+        ["POST", %r{\A/api/token\z}, :handle_token, :participant],
         ["GET", %r{\A/api/models\z}, :handle_models, :owner],
         ["GET", %r{\A/api/history\z}, :handle_history, :owner],
         ["GET", %r{\A/api/events\z}, :handle_events, :owner],
@@ -251,6 +278,10 @@ module Samagotchi
         req = Rack::Request.new(env)
         return forbidden unless local_host_header?(env)
         return cross_origin if cross_site?(env)
+        return error_response(403, "framed", "chi web's pages can't be framed by another page") if framed?(env)
+        # The fragment trade's script, which the 401 page loads: no secret in it.
+        return serve_static(req) if req.get? && GATE_FREE_PATHS.include?(req.path_info)
+        return probe_info if probe_info?(req)
 
         principal, denied = token_gate(req)
         return denied if denied
@@ -328,8 +359,11 @@ module Samagotchi
       # A viewer on this machine, whose editor can open the session's
       # paths: a loopback peer, or this Mac on its own LAN address (the LAN
       # URL or its QR code opened here). The phone isn't. An SSH tunnel or
-      # a local reverse proxy looks like loopback too (a known gap).
+      # a local reverse proxy looks like loopback too (a known gap), unless
+      # it leaves a trace and web.public_url is set (#proxied?).
       def local_viewer?(req)
+        return false if proxied?(req)
+
         peer = req.get_header("REMOTE_ADDR").to_s
         LOOPBACK_PEERS.include?(peer) || (!@lan.nil? && peer == @lan[:ip])
       end
@@ -342,10 +376,12 @@ module Samagotchi
       # check stops DNS-rebinding pages. It reads the raw Host header:
       # Rack's req.host trusts X-Forwarded-Host, which such a page could
       # set. A request with no Host (HTTP/1.0) is answered only for a
-      # loopback peer.
+      # loopback peer. With web.public_url its host (with its port, exactly)
+      # is answered too.
       def local_host_header?(env)
         host = env["HTTP_HOST"].to_s
         return LOOPBACK_PEERS.include?(env["REMOTE_ADDR"].to_s) if host.empty?
+        return true if @public_url&.host?(host)
 
         name = host.downcase.sub(/:\d*\z/, "")
         LOOPBACK_NAMES.include?(name) || (!@lan.nil? && name == @lan[:ip])
@@ -359,10 +395,17 @@ module Samagotchi
       # the cross-site check already refuses what Strict would add.
       TOKEN_COOKIE_ATTRIBUTES = "HttpOnly; SameSite=Lax; Path=/; Max-Age=34560000"
       REFUSED_LOG_INTERVAL = 60.0
+      REFUSED_LOG_KEYS = 256
 
       # Where #route keeps the request's Principal for its handlers.
       PRINCIPAL_ENV = "samagotchi.principal"
       PAGE_PATHS = ["/", "/index.html"].freeze
+      # POST {code} or {token}: the page trades a link's one-time code (its
+      # #code= fragment, token_fragment.js) or a pasted token (the 401 page's
+      # form) for the cookie.
+      TOKEN_TRADE_PATH = "/api/token"
+      TRADE_BODY_LIMIT = 4096
+      GATE_FREE_PATHS = ["/token_fragment.js"].freeze
 
       # The request's Principal, as #route resolved it.
       def principal(req) = req.env.fetch(PRINCIPAL_ENV)
@@ -378,9 +421,16 @@ module Samagotchi
       def token_gate(req)
         principal = principal_for(req)
         return [nil, refused_token(req)] if principal.nil?
+
         # The cookie gets the token that was presented: the owner's, or the
         # participant's grant's.
-        return [nil, token_redirect(req, req.env[GRANT_TOKEN_ENV] || current_token)] if token_trade?(req)
+        if token_trade?(req)
+          token = req.env[GRANT_TOKEN_ENV] || current_token
+          return [nil, token_redirect(req, token)] unless fragment_trade?(req)
+          return [nil, form_trade_redirect(req, token)] if form_post?(req)
+
+          return [nil, token_cookie_response(req, token)]
+        end
 
         [principal, nil]
       end
@@ -394,9 +444,12 @@ module Samagotchi
       # machine's loopback), else nil. An ended or unknown grant's token is
       # nil anywhere: it never falls back to the owner.
       # @return [Principal, nil]
+      # With web.public_url (ProxyGate) every request needs a token, and a
+      # proxied one is #proxied_principal's.
       def principal_for(req)
         given = presented_tokens(req)
-        return Principal::OWNER if @lan && given.any? { |value| token_match?(value, current_token) }
+        return proxied_principal(req, given) if proxied?(req)
+        return Principal::OWNER if (@lan || @public_url) && owner_token?(given)
 
         grant_tokens = given.select { |value| Grants.token?(value) }
         return Principal::OWNER if grant_tokens.empty? && !token_required?(req)
@@ -404,19 +457,93 @@ module Samagotchi
         participant_principal(req, grant_tokens)
       end
 
+      # With web.public_url a request from this machine that didn't come
+      # through the proxy (curl, chi's own callers) presents the Bearer
+      # header only: no cookie, and no trade that would set one. A cookie for
+      # 127.0.0.1 goes to every server on any of its ports. A LAN peer
+      # (web.host lan) keeps the LAN's token link and cookie.
       def presented_tokens(req)
-        token_trade?(req) ? [req.params["token"]] : [bearer_token(req), req.cookies[TOKEN_COOKIE]]
+        return [traded_token(req)] if token_trade?(req)
+        return [bearer_token(req)] if direct_public?(req)
+
+        [bearer_token(req), req.cookies[token_cookie_name(req)]]
+      end
+
+      def direct_public?(req)
+        !@public_url.nil? && LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s) && !proxied?(req)
+      end
+
+      # The token a trade presents: the page's ?token=, or POST /api/token's
+      # body's (read once): its token, or the token a one-time link code
+      # stands for (LinkCodes#redeem: used up here, whatever the gate says).
+      def traded_token(req)
+        return req.params["token"] unless fragment_trade?(req)
+
+        req.env.fetch(TRADED_TOKEN_ENV) do
+          raw = request_body(req, TRADE_BODY_LIMIT).to_s
+          value = if raw.bytesize >= TRADE_BODY_LIMIT then nil
+                  elsif form_post?(req) then Rack::Utils.parse_query(raw)
+                  else parse_json(raw)
+                  end
+          value = {} unless value.is_a?(Hash)
+          req.env[TRADED_TOKEN_ENV] = value.key?("code") ? code_token(value["code"]) : string_or_nil(value["token"])
+        end
+      end
+
+      def string_or_nil(value) = value.is_a?(String) ? value : nil
+
+      def code_token(code)
+        kind, token = @link_codes.redeem(code)
+        kind == :owner ? current_token : token
+      end
+
+      TRADED_TOKEN_ENV = "samagotchi.traded_token"
+
+      def fragment_trade?(req) = req.post? && req.path_info == TOKEN_TRADE_PATH
+
+      # The 401 page's paste box, posted as a form (no script needed).
+      def form_post?(req) = req.media_type == "application/x-www-form-urlencoded"
+
+      def owner_token?(given) = given.any? { |value| token_match?(value, current_token) }
+
+      # The cookie a request's token rides in, its name and attributes per
+      # request: a proxied request's is ProxyGate::SECURE_COOKIE, Secure (the
+      # public URL is https). A browser may hold both.
+      def token_cookie_name(req) = proxied?(req) ? SECURE_COOKIE : TOKEN_COOKIE
+
+      def token_cookie_attributes(req)
+        proxied?(req) ? "Secure; #{TOKEN_COOKIE_ATTRIBUTES}" : TOKEN_COOKIE_ATTRIBUTES
+      end
+
+      def token_cookie(req, value)
+        "#{token_cookie_name(req)}=#{value}; #{token_cookie_attributes(req)}"
       end
 
-      def token_required?(req) = @lan && !LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
+      def cleared_token_cookie(req)
+        "#{token_cookie_name(req)}=; #{token_cookie_attributes(req).sub(/Max-Age=\d+/, "Max-Age=0")}"
+      end
+
+      def token_required?(req)
+        return true if @public_url
+
+        @lan && !LOOPBACK_PEERS.include?(req.get_header("REMOTE_ADDR").to_s)
+      end
 
       # The page opened with ?token= (a gated request, or a grant's token
       # anywhere): its token is traded for the cookie, whatever else the
       # request carries.
+      # POST /api/token is the same trade for a token the page found in its
+      # URL's fragment.
       def token_trade?(req)
-        return false unless req.get? && PAGE_PATHS.include?(req.path_info) && req.params.key?("token")
+        return false if direct_public?(req)
 
-        token_required?(req) || Grants.token?(req.params["token"])
+        # Through the proxy no GET trade (a ?token= rides the sign-in
+        # redirect, and a crafted link would swap the owner's cookie): a
+        # link's #code= and the 401 page's POST do it.
+        page = req.get? && PAGE_PATHS.include?(req.path_info) && req.params.key?("token") && !(@public_url && proxied?(req))
+        return false unless page || fragment_trade?(req)
+
+        token_required?(req) || Grants.token?(traded_token(req))
       end
 
       # The 401 for a request #principal_for refused: an ended grant's, else
@@ -425,17 +552,16 @@ module Samagotchi
       # owner's, who opened a participant link) is the owner's again.
       def refused_token(req)
         response = grant_ended_response(req) || unauthorized(req)
-        return response if token_required?(req) || !Grants.token?(req.cookies[TOKEN_COOKIE])
+        return response if token_required?(req) || !Grants.token?(req.cookies[token_cookie_name(req)])
 
         status, headers, body = response
-        [status, headers.merge("Set-Cookie" => "#{TOKEN_COOKIE}=; #{TOKEN_COOKIE_ATTRIBUTES.sub(/Max-Age=\d+/, "Max-Age=0")}"),
-         body]
+        [status, headers.merge("Set-Cookie" => cleared_token_cookie(req)), body]
       end
 
       def bearer_token(req) = req.get_header("HTTP_AUTHORIZATION").to_s[/\ABearer +(\S+)\z/, 1]
 
       def current_token
-        token = @lan[:token]
+        token = @lan ? @lan[:token] : @public_token
         token.respond_to?(:current) ? token.current : token
       end
 
@@ -446,32 +572,87 @@ module Samagotchi
       end
 
       # The same page (and its other parameters, as they were written), the
-      # token traded for the cookie.
+      # token traded for the cookie. Proxied, the Location is absolute from
+      # web.public_url: WEBrick would make a relative one absolute from the
+      # first X-Forwarded-Host/-Proto, which a client sets through
+      # oauth2-proxy (an open redirect).
       def token_redirect(req, token)
         query = req.query_string.split("&").reject { |pair| pair.split("=", 2).first == "token" }.join("&")
         location = query.empty? ? req.path_info : "#{req.path_info}?#{query}"
-        [303, { "Location" => location, "Set-Cookie" => "#{TOKEN_COOKIE}=#{token}; #{TOKEN_COOKIE_ATTRIBUTES}",
+        location = "#{@public_url.origin}#{location}" if proxied?(req)
+        [303, { "Location" => location, "Set-Cookie" => token_cookie(req, token),
                 "Cache-Control" => "no-store", "Content-Length" => "0" }, []]
       end
 
+      # The paste box's trade: the cookie and a 303 to the page (absolute
+      # from web.public_url when proxied, as #token_redirect).
+      def form_trade_redirect(req, token)
+        location = proxied?(req) ? "#{@public_url.origin}/" : "/"
+        [303, { "Location" => location, "Set-Cookie" => token_cookie(req, token), "Cache-Control" => "no-store",
+                "Content-Length" => "0" }, []]
+      end
+
+      # The fragment trade's answer: the cookie, no body.
+      def token_cookie_response(req, token)
+        [204, { "Set-Cookie" => token_cookie(req, token), "Cache-Control" => "no-store" }, []]
+      end
+
+      # POST /api/token past the gate without a trade (nothing to trade here:
+      # no token is asked of this request): nothing to do.
+      def handle_token(_req) = [204, { "Cache-Control" => "no-store" }, []]
+
       def unauthorized(req)
-        log_refused(req.get_header("REMOTE_ADDR").to_s, req.path_info)
-        return error_response(401, "unauthorized", "chi web on the LAN needs its access token") if req.path_info.start_with?("/api/")
+        reason = req.env[REFUSED_ENV]
+        log_refused(refused_peer(req), req.path_info, reason)
+        return error_response(401, "unauthorized", unauthorized_detail(req, reason)) if req.path_info.start_with?("/api/")
 
-        body = UNAUTHORIZED_PAGE
+        body = @public_url ? PUBLIC_UNAUTHORIZED_PAGE : UNAUTHORIZED_PAGE
         [401, { "Content-Type" => "text/html; charset=utf-8", "Content-Length" => body.bytesize.to_s, "Cache-Control" => "no-store" },
          [body]]
       end
 
+      def unauthorized_detail(req, reason)
+        return "chi web behind the proxy: #{reason || "needs its access token"}" if proxied?(req)
+        return "chi web with web.public_url needs its access token, on this machine too" if @public_url
+
+        "chi web on the LAN needs its access token"
+      end
+
+      # Who a refusal is logged as: the peer, or behind a proxy (every peer
+      # 127.0.0.1) the client: its identity, else the X-Forwarded-For hop the
+      # proxy appended (the last one).
+      def refused_peer(req)
+        return req.get_header("REMOTE_ADDR").to_s unless proxied?(req)
+
+        identity = @public_url.identity_env && req.env[@public_url.identity_env]
+        hop = req.get_header("HTTP_X_FORWARDED_FOR").to_s.split(",").last.to_s.strip
+        "proxy:#{[identity.to_s.strip, hop].find { |v| !v.empty? } || "?"}"[0, 200]
+      end
+
       # At most once a minute per peer: a phone with an old link retries.
-      def log_refused(peer, path)
+      # At most REFUSED_LOG_KEYS peers a minute (rotating headers can't
+      # fill the log).
+      def log_refused(peer, path, reason = nil)
         now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         due = @refused_mutex.synchronize do
           @refused_logged.delete_if { |_, at| now - at >= REFUSED_LOG_INTERVAL } if @refused_logged.size > 64
+          next false if @refused_logged.size >= REFUSED_LOG_KEYS && !@refused_logged.key?(peer)
+
           last = @refused_logged[peer]
           (last.nil? || now - last >= REFUSED_LOG_INTERVAL).tap { |fresh| @refused_logged[peer] = now if fresh }
         end
-        Log.warn(:web, "unauthorized", peer: peer, path: path) if due
+        Log.warn(:web, "unauthorized", peer: peer, path: path, **(reason ? { reason: reason } : {})) if due
+      end
+
+      # Behind a proxy (web.public_url) the paste box posts the token in the
+      # body (POST /api/token): a GET would put it in the URL, the proxy's
+      # access log and the history. On this machine the page opens through
+      # the proxy too.
+      def self.public_unauthorized_page(page)
+        page.sub('<form method="get" action="/">', '<form method="post" action="/api/token">')
+            .sub("Open the link chi web printed in its terminal (LAN, or Proxied behind an\nauth proxy), or scan its QR code.",
+                 "Open the Proxied link chi web printed in its terminal (it works once; chi web again prints a new " \
+                 "one), or paste the token from its web-token file.")
       end
 
       # What a phone sees without the token. The field is for a home-screen
@@ -489,14 +670,26 @@ module Samagotchi
         </style></head>
         <body>
         <h1>chi web</h1>
-        <p>This page needs chi web's access token. Open the LAN link chi web printed in its terminal, or scan its QR code.</p>
+        <p>This page needs chi web's access token. Open the link chi web printed in its terminal (LAN, or Proxied behind an
+        auth proxy), or scan its QR code.</p>
+        <p id="trade" hidden></p>
         <form method="get" action="/">
           <label for="token">Or paste the token:</label>
           <input id="token" name="token" autocomplete="off" autocapitalize="off" spellcheck="false">
           <button type="submit">Open</button>
         </form>
+        <script type="module">
+          import { tradeFragmentCode } from "/token_fragment.js";
+          tradeFragmentCode({ onRefused: (words) => {
+            const line = document.getElementById("trade");
+            line.textContent = words;
+            line.hidden = false;
+          } });
+        </script>
         </body></html>
       HTML
+      PUBLIC_UNAUTHORIZED_PAGE = public_unauthorized_page(UNAUTHORIZED_PAGE).freeze
+      private_class_method :public_unauthorized_page
 
       # Another website's page in the desktop browser can send "simple"
       # requests here (a text/plain POST needs no preflight) and would start
@@ -510,18 +703,30 @@ module Samagotchi
       def cross_site?(env)
         foreign = %w[cross-site same-site].include?(env["HTTP_SEC_FETCH_SITE"].to_s.downcase)
         origin = env["HTTP_ORIGIN"]
-        foreign ||= !origin.nil? && origin.downcase != "http://#{env["HTTP_HOST"].to_s.downcase}"
+        foreign ||= !origin.nil? && !same_origin?(env, origin.downcase)
         return false unless foreign
 
         !%w[GET HEAD].include?(env["REQUEST_METHOD"]) || env["PATH_INFO"].to_s.start_with?("/api/")
       end
 
+      # The page's own origin: through the proxy only web.public_url's
+      # (https), else http://<Host> (or the public origin).
+      def same_origin?(env, origin)
+        return origin == @public_url.origin if @public_url && proxied?(Rack::Request.new(env))
+
+        origin == "http://#{env["HTTP_HOST"].to_s.downcase}" || public_origin?(origin)
+      end
+
+      # The page served through web.public_url (Origin https://<public host>).
+      def public_origin?(origin) = !@public_url.nil? && origin.downcase == @public_url.origin
+
       def cross_origin
         error_response(403, "cross_origin", "requests from other websites are refused")
       end
 
       def forbidden
-        names = @lan ? "127.0.0.1, [::1], localhost and #{@lan[:ip]}" : "127.0.0.1, [::1] and localhost"
+        names = ["127.0.0.1", "[::1]", "localhost", @lan && @lan[:ip], @public_url&.host].compact
+        names = "#{names[0..-2].join(", ")} and #{names.last}"
         error_response(403, "forbidden", "only the host names #{names} are answered")
       end
 
@@ -576,8 +781,9 @@ module Samagotchi
       # session_commands: the routes chi --remote needs
       # (SessionAccessRoutes::FEATURE); remote_attach: the ones a remote
       # attached TUI needs (ATTACH_FEATURE). lan: its LAN address, nil when it
-      # listens on loopback only. A participant gets app, version and
-      # features only (#participant_info).
+      # listens on loopback only; public_url: web.public_url's origin, nil
+      # without one. A participant gets app, version and features only
+      # (#participant_info).
       def handle_info(req)
         return participant_info unless principal(req).owner?
 
@@ -2478,11 +2684,12 @@ module Samagotchi
       # a live worker's (it counts against its Engine's messages), else
       # recap.json against the session file. A stopped session gets its
       # recap without a worker being woken.
-      # @return [Hash, nil] {text:, turns_since:}
+      # @return [Hash, nil] {text:, turns_since:, created_at:} (created_at:
+      #   when it was written, UTC ISO; absent from an older recap)
       def saved_recap_for(id, session, turn_snapshot)
         if turn_snapshot
           saved = turn_snapshot["saved_recap"]
-          return saved && { text: saved["text"], turns_since: saved["turns_since"].to_i }
+          return saved && { text: saved["text"], turns_since: saved["turns_since"].to_i, created_at: saved["created_at"] }.compact
         end
 
         saved = RecapStore.read(@session_class.session_dir(id, state_dir: default_state_dir))
@@ -2490,7 +2697,7 @@ module Samagotchi
 
         messages = Array(session.messages)
         since = messages.drop(saved[:covered].to_i).count { |m| Samagotchi::Steer.turn_prompt?(m) }
-        { text: saved[:text], turns_since: since }
+        { text: saved[:text], turns_since: since, created_at: saved[:created_at] }.compact
       rescue StandardError
         nil
       end
@@ -2527,7 +2734,7 @@ module Samagotchi
           role = (m[:role] || m["role"]).to_s
           content = (m[:content] || m["content"]).to_s
           if Samagotchi::ContextNote.note?(m)
-            note = { role: "note", content: Samagotchi::ContextNote.text_of(m), label: Samagotchi::ContextNote.label_of(m) }
+            note = { role: "note", content: Samagotchi::ContextNote.text_of(m), label: Samagotchi::ContextNote.label_of(m), **time_of(m) }
             # A context wake turn's note starts that turn (Steer.turn_prompt?):
             # the page opens the turn with it and pairs it with its record.
             if Samagotchi::Steer.turn_prompt?(m)
@@ -2540,7 +2747,7 @@ module Samagotchi
           # A plugin's steer: a row of the step that answered it, which the
           # page finds by `step`.
           if Samagotchi::Steer.steer?(m)
-            filtered << { role: "steer", content: content, source: (m[:source] || m["source"]).to_s, step: steer_step(list, index) }
+            filtered << { role: "steer", content: content, source: (m[:source] || m["source"]).to_s, step: steer_step(list, index), **time_of(m) }
             next
           end
           # A turn that ended with no answer (TurnNote.empty's marker): its
@@ -2563,7 +2770,7 @@ module Samagotchi
           norm_role = "user" if norm_role == "user"
           next unless %w[user assistant].include?(norm_role)
 
-          message = { role: norm_role, content: stripped }
+          message = { role: norm_role, content: stripped, **time_of(m) }
           # Merged into the running turn (Steer::INPUT_KIND): part of it,
           # read by step +step+; a wake turn's report starts its turn
           # (Steer.turn_prompt?). Its sender (a delegate report, chi send):
@@ -2603,6 +2810,13 @@ module Samagotchi
         []
       end
 
+      # The entry's wall time (MessageTime: the page's hover and gap
+      # dividers) as {at:}, or nothing for an entry saved without one.
+      def time_of(message)
+        at = Samagotchi::MessageTime.of(message)
+        at.is_a?(String) && !at.empty? ? { at: at } : {}
+      end
+
       # A no-answer turn's marker as display items: each empty step that
       # has something to show (its thinking) as a text-less assistant step
       # (only with +parts+, as other text-less steps), then

data/lib/samagotchi/web/grants.rb

@@ -91,8 +91,10 @@ module Samagotchi
       # grant from before them, which takes the config's (#spend_cap,
       # #queue_limit).
       Grant = Data.define(:id, :session_id, :digest, :kind, :name, :role, :created_at, :expires_at, :revoked_at,
-                          :revoked_by, :last_used_at, :cap, :queue) do
-        def initialize(cap: nil, queue: nil, **) = super
+                          :revoked_by, :last_used_at, :cap, :queue, :identity) do
+        # identity: the proxy identity (an email, lower case) the grant is
+        # bound to, nil for any (ProxyGate; issued from shared-sessions P6).
+        def initialize(cap: nil, queue: nil, identity: nil, **) = super
 
         def self.from_h(hash)
           new(**members.to_h { |key| [key, hash[key.to_s]] })
@@ -132,7 +134,8 @@ module Samagotchi
             state: state(now).to_s, cap: spend_cap, queue: queue_limit }
         end
 
-        def to_store = to_h.transform_keys(&:to_s)
+        # A grant bound to no identity is stored as before identity existed.
+        def to_store = to_h.transform_keys(&:to_s).tap { |hash| hash.delete("identity") if identity.nil? }
 
         def inspect = "#<Grant #{id} #{session_id[0, 8]} #{name.inspect}>"
         alias_method :to_s, :inspect

data/lib/samagotchi/web/info_probe.rb

@@ -6,7 +6,11 @@ require "net/http"
 module Samagotchi
   module Web
     # What answers GET /api/info on host:port: the one probe for a running
-    # chi web (chi web's own port check, chi update, chi self).
+    # chi web (chi web's own port check, chi share's port, chi update, chi
+    # self). It never sends a token: whatever listens on the port may not be
+    # chi web (another user's process on a shared host). A chi web behind a
+    # proxy answers it without one (ProxyGate#probe_info). Nothing it
+    # answers is trusted for a link.
     module InfoProbe
       module_function