pi-roundtable-web 0.25.0 → 0.26.1

package/src/auth/sessions.ts

@@ -0,0 +1,193 @@
+import { createHash, randomBytes } from "node:crypto";
+import type { SQL } from "bun";
+import type { ActorFacts, Migration } from "pi-roundtable";
+
+/** A session's idle limit slides at most this often, so a busy page costs no write per request. */
+const SLIDE_AFTER_MS = 3_600_000;
+/** Bytes of the random id the cookie holds. */
+const TOKEN_BYTES = 32;
+
+/** The actor a session was signed in as, and the id_token claims the host asked to keep. */
+export interface SessionActor extends ActorFacts {
+	/** Only the claims `oidc.storeClaims` names; replaced at each sign-in and re-verify, never logged. */
+	claims?: Readonly<Record<string, unknown>>;
+}
+
+/** A live session. */
+export interface Session {
+	/** The SHA-256 of the cookie's id, in hex: what the rest of the app calls the session. */
+	id: string;
+	principalId: string;
+	actor: SessionActor;
+	createdAt: Date;
+	lastSeenAt: Date;
+	/** When the IdP last vouched for the person: the sign-in, or the latest silent re-verify. */
+	verifiedAt: Date;
+	/** When the idle limit ends it. */
+	expiresAt: Date;
+}
+
+interface Row {
+	id_hash: Buffer;
+	principal_id: string;
+	actor: SessionActor | string;
+	created_at: Date;
+	last_seen_at: Date;
+	verified_at: Date;
+	expires_at: Date;
+}
+
+/** A jsonb column as the driver hands it back: parsed, or as text. */
+function actorOf(value: SessionActor | string): SessionActor {
+	if (typeof value !== "string") return value;
+	try {
+		return JSON.parse(value) as SessionActor;
+	} catch (error) {
+		throw new Error("the session store holds JSON that cannot be read", {
+			cause: error,
+		});
+	}
+}
+
+const hashOf = (token: string): Buffer =>
+	createHash("sha256").update(token).digest();
+
+const sessionOf = (row: Row): Session => ({
+	id: Buffer.from(row.id_hash).toString("hex"),
+	principalId: row.principal_id,
+	actor: actorOf(row.actor),
+	createdAt: row.created_at,
+	lastSeenAt: row.last_seen_at,
+	verifiedAt: row.verified_at,
+	expiresAt: row.expires_at,
+});
+
+export interface WebSessionsOptions {
+	/** The idle limit: a session ends after this many days without a visit. */
+	days: number;
+	/** The clock, in milliseconds; default `Date.now`. Tests set it. */
+	now?: () => number;
+}
+
+/**
+ * The app's own sessions, in `web_sessions`: a 256-bit random id in the cookie, of which only the
+ * SHA-256 is stored, with the actor facts the sign-in produced. The session slides: it ends after
+ * `days` without a visit, and a visit moves the limit at most once an hour. Nothing here decides
+ * what tier the person holds; that is read from `IDENTITY` for every request.
+ */
+export class WebSessions {
+	readonly #sql: SQL;
+	readonly #options: WebSessionsOptions;
+
+	constructor(sql: SQL, options: WebSessionsOptions) {
+		this.#sql = sql;
+		this.#options = options;
+	}
+
+	static readonly migration: Migration = {
+		name: "web-sessions",
+		up: async (sql) => {
+			await sql`
+				CREATE TABLE IF NOT EXISTS web_sessions (
+					id_hash bytea PRIMARY KEY,
+					principal_id text NOT NULL,
+					actor jsonb NOT NULL,
+					created_at timestamptz NOT NULL,
+					last_seen_at timestamptz NOT NULL,
+					verified_at timestamptz NOT NULL,
+					expires_at timestamptz NOT NULL
+				)`;
+			await sql`CREATE INDEX IF NOT EXISTS web_sessions_principal ON web_sessions (principal_id)`;
+			await sql`CREATE INDEX IF NOT EXISTS web_sessions_expires ON web_sessions (expires_at)`;
+		},
+	};
+
+	#now(): Date {
+		return new Date((this.#options.now ?? Date.now)());
+	}
+
+	#limit(from: Date): Date {
+		return new Date(from.getTime() + this.#options.days * 86_400_000);
+	}
+
+	/** Starts a session for a person signed in as `actor`; returns the cookie's id. */
+	async create(
+		actor: SessionActor,
+		principalId: string,
+	): Promise<{ token: string; session: Session }> {
+		const token = randomBytes(TOKEN_BYTES).toString("base64url");
+		const now = this.#now();
+		const expires = this.#limit(now);
+		await this.#sql`
+			INSERT INTO web_sessions (id_hash, principal_id, actor, created_at, last_seen_at, verified_at, expires_at)
+			VALUES (${hashOf(token)}, ${principalId}, ${JSON.stringify(actor)}::jsonb, ${now}, ${now}, ${now}, ${expires})`;
+		return {
+			token,
+			session: {
+				id: hashOf(token).toString("hex"),
+				principalId,
+				actor,
+				createdAt: now,
+				lastSeenAt: now,
+				verifiedAt: now,
+				expiresAt: expires,
+			},
+		};
+	}
+
+	/**
+	 * The live session the cookie's id names, with its limit moved on if it was last seen more than
+	 * an hour ago; undefined when there is none or it ended.
+	 */
+	async touch(token: string): Promise<Session | undefined> {
+		const now = this.#now();
+		const [row]: Row[] = await this.#sql`
+			SELECT * FROM web_sessions WHERE id_hash = ${hashOf(token)} AND expires_at > ${now}`;
+		if (!row) return undefined;
+		const found = sessionOf(row);
+		if (now.getTime() - found.lastSeenAt.getTime() < SLIDE_AFTER_MS)
+			return found;
+		const expires = this.#limit(now);
+		await this.#sql`
+			UPDATE web_sessions SET last_seen_at = ${now}, expires_at = ${expires}
+			WHERE id_hash = ${hashOf(token)}`;
+		return { ...found, lastSeenAt: now, expiresAt: expires };
+	}
+
+	/** Whether the session still stands, without moving its limit; for the recheck of an open socket. */
+	async alive(id: string): Promise<boolean> {
+		const [row]: { n: number }[] = await this.#sql`
+			SELECT count(*)::int AS n FROM web_sessions
+			WHERE id_hash = ${Buffer.from(id, "hex")} AND expires_at > ${this.#now()}`;
+		return (row?.n ?? 0) > 0;
+	}
+
+	/** Ends the session the cookie's id names; returns its id, undefined for none. */
+	async end(token: string): Promise<string | undefined> {
+		const [row]: { id_hash: Buffer }[] = await this.#sql`
+			DELETE FROM web_sessions WHERE id_hash = ${hashOf(token)} RETURNING id_hash`;
+		return row ? Buffer.from(row.id_hash).toString("hex") : undefined;
+	}
+
+	/** Deletes the sessions past their limit; returns how many. */
+	async sweep(): Promise<number> {
+		const rows: unknown[] = await this.#sql`
+			DELETE FROM web_sessions WHERE expires_at <= ${this.#now()} RETURNING id_hash`;
+		return rows.length;
+	}
+
+	/**
+	 * The id_token claims kept for a person from their newest live session; undefined when they
+	 * have none or kept no claims. For a sender that needs, say, a mailbox address.
+	 */
+	async claimsOf(
+		principalId: string,
+	): Promise<Readonly<Record<string, unknown>> | undefined> {
+		const [row]: Pick<Row, "actor">[] = await this.#sql`
+			SELECT actor FROM web_sessions
+			WHERE principal_id = ${principalId} AND expires_at > ${this.#now()}
+			ORDER BY verified_at DESC LIMIT 1`;
+		if (!row) return undefined;
+		return actorOf(row.actor).claims;
+	}
+}

package/src/authz.ts

@@ -0,0 +1,173 @@
+import type { Tier } from "pi-roundtable";
+
+/**
+ * Who a route answers, as the authorization table of the design names them:
+ * - `O`: a person whose tier is owner, read again for the request;
+ * - `V`: any admitted viewer (owner, admin, member) who is past the gate;
+ * - `G`: any admitted viewer, gated or not.
+ * A route answers more narrowly inside its handler (a member's own notes, a room the kind
+ * grants); this table is the first check, and it runs before any handler does.
+ */
+export type Who = "G" | "V" | "O";
+
+export interface Rule {
+	/** The methods the row covers; `*` is every method. */
+	methods: readonly string[] | "*";
+	/**
+	 * The path below the mount: segments joined by `/`. `:name` is one segment; a last `**` is any
+	 * number of further segments, none included.
+	 */
+	path: string;
+	who: Who;
+	/** A refusal says 404, not 403: the route's existence is not for this person to learn. */
+	hide?: true;
+}
+
+const row = (
+	methods: Rule["methods"],
+	path: string,
+	who: Who,
+	hide?: true,
+): Rule => ({ methods, path, who, ...(hide ? { hide } : {}) });
+
+/** The app's REST routes by who they answer. A route that is not listed answers 404 to everyone. */
+export const ROUTES: readonly Rule[] = [
+	// The page and its data.
+	row(["GET"], "api/config", "G"),
+	row(["GET"], "api/session", "G"),
+	row(["GET"], "api/events", "O"),
+	row("*", "api/overview", "O"),
+	row("*", "api/dashboard", "O"),
+	row("*", "api/channels/:id/:action", "O"),
+	row("*", "api/skills", "O"),
+	row("*", "api/skills/:name", "O"),
+	row("*", "api/connectors", "O"),
+	row("*", "api/models", "O"),
+	// The owner's conversations; a member's own are filtered inside the handler.
+	row("*", "api/conversations", "V"),
+	row("*", "api/conversations/:id", "V"),
+	// Notes: the visitor's own (inside the handler); the owner's reads of others stay as they were.
+	row("*", "api/notes", "V"),
+	row("*", "api/notes/:id", "V"),
+	row("*", "api/principals", "V"),
+	// The agent rooms are the owners'. The route says 404, not 403, to anyone else. Their threads are under
+	// it too: a thread's view and `…/dismiss`, and `…/dismiss-threads` of its parent.
+	row("*", "api/rooms", "O", true),
+	row("*", "api/rooms/**", "O", true),
+	row("*", "api/folders/**", "O"),
+	row("*", "api/agents/**", "O"),
+	row("*", "api/groups/**", "O"),
+	row("*", "api/archive/**", "O"),
+	row("*", "api/prompts/**", "O"),
+	row("*", "api/skill-docs/**", "O"),
+	row("*", "api/workspace/**", "O"),
+	row(["GET", "HEAD"], "avatars/:file", "V"),
+	// Uploads and files: the upload is the sender's own; a file answers by the room it is bound to.
+	row("*", "api/uploads", "V"),
+	row("*", "api/uploads/:id", "V"),
+	row("*", "api/files/:id", "V"),
+	// Schedules: the owner's all, a member's own (inside the handler).
+	row("*", "api/schedules", "V"),
+	row("*", "api/schedules/:id", "V"),
+	// Host rooms and pages: the kind's `access` and the page's `visible` decide inside.
+	row(["GET"], "api/host/:kind", "V"),
+	row(["GET"], "api/host/:kind/:id", "V"),
+	row(["GET"], "api/host/:kind/:id/messages", "V"),
+	row(["POST"], "api/host/:kind/:id/act", "V"),
+	row(["GET"], "api/pages/:id", "V"),
+	row(["POST"], "api/pages/:id/act", "V"),
+	// Notices, push, the profile, links and onboarding are the person's own (the session's principal).
+	row(["GET"], "api/notices", "G"),
+	row(["POST"], "api/notices/:tag/ack", "G"),
+	row(["GET"], "api/push/key", "G"),
+	row("*", "api/push/subscriptions", "G"),
+	row("*", "api/push/subscriptions/:id", "G"),
+	row(["POST"], "api/push/test", "G"),
+	row(["POST"], "api/push/receipts", "G"),
+	row(["GET", "PUT"], "api/push/prefs", "G"),
+	row(["GET"], "api/profile", "G"),
+	row(["PUT"], "api/profile/source", "G"),
+	row(["GET"], "api/people/:id/picture", "G"),
+	row(["GET"], "api/links", "G"),
+	row(["POST"], "api/links/:provider/:step", "G"),
+	row(["DELETE"], "api/links/:provider", "G"),
+	row(["GET"], "api/onboarding", "G"),
+	row(["POST"], "api/onboarding/:step/waive", "G"),
+];
+
+function matches(pattern: string, parts: readonly string[]): boolean {
+	const want = pattern.split("/");
+	const open = want[want.length - 1] === "**";
+	const fixed = open ? want.slice(0, -1) : want;
+	if (open ? parts.length < fixed.length : parts.length !== fixed.length)
+		return false;
+	return fixed.every(
+		(segment, at) => segment.startsWith(":") || segment === parts[at],
+	);
+}
+
+/** The parts of a path below the mount, decoded; undefined for one that does not decode. */
+function partsOf(rest: string): string[] | undefined {
+	try {
+		return rest.split("/").filter(Boolean).map(decodeURIComponent);
+	} catch {
+		return undefined;
+	}
+}
+
+/** The path areas the table governs: everything below `api/` and the avatars. */
+const governed = (parts: readonly string[]): boolean =>
+	parts[0] === "api" || parts[0] === "avatars";
+
+export interface Subject {
+	tier: Tier;
+	/** A required onboarding step stands undone. */
+	gated: boolean;
+}
+
+export type Decision =
+	| { allow: true; rule?: Rule }
+	| { allow: false; status: 403 | 404; gate?: true; reason: string };
+
+/**
+ * Decides a request before any handler sees it. A page, an asset or the install files (anything
+ * outside `api/` and `avatars/`) needs only an admitted visitor. A route under them that the table
+ * does not list answers 404. A listed route whose method the row does not list is judged by the
+ * strictest row of its path and then left to the handler to refuse as the method it is.
+ */
+export function decide(
+	method: string,
+	rest: string,
+	subject: Subject,
+): Decision {
+	const parts = partsOf(rest);
+	if (!parts) return { allow: false, status: 404, reason: "undecodable path" };
+	if (!governed(parts)) return { allow: true };
+	const found = ROUTES.filter((rule) => matches(rule.path, parts));
+	if (found.length === 0)
+		return { allow: false, status: 404, reason: "not in the table" };
+	const exact = found.find(
+		(rule) => rule.methods === "*" || rule.methods.includes(method),
+	);
+	const rule = exact ?? strictest(found);
+	if (subject.gated && rule.who !== "G")
+		return {
+			allow: false,
+			status: 403,
+			gate: true,
+			reason: "an onboarding step stands undone",
+		};
+	if (rule.who === "O" && subject.tier !== "owner")
+		return {
+			allow: false,
+			status: rule.hide ? 404 : 403,
+			reason: "owners only",
+		};
+	return { allow: true, rule };
+}
+
+const ORDER: Record<Who, number> = { G: 0, V: 1, O: 2 };
+
+function strictest(rules: readonly Rule[]): Rule {
+	return rules.reduce((a, b) => (ORDER[b.who] > ORDER[a.who] ? b : a));
+}

package/src/console-api.ts

@@ -9,6 +9,7 @@ import type {
 	MemoryKind,
 	QueuePort,
 	SpeakerMemory,
+	Tier,
 } from "pi-roundtable";
 import { MemoryError, parseChannelKey, SYSTEM_PRINCIPAL } from "pi-roundtable";
 import { thinkingLabel } from "pi-roundtable/kit";
@@ -20,9 +21,12 @@ import type {
 	ConversationsView,
 	ConversationView,
 	DashboardView,
+	GateStepView,
+	KindLinkView,
 	NoteInput,
 	NoteView,
 	OverviewView,
+	PageLinkView,
 	PaneName,
 	PrincipalName,
 	PrincipalsView,
@@ -51,10 +55,32 @@ const NOTE_SEARCH_LIMIT = 500;
 /** The largest note body the console reads. */
 const MAX_BODY_BYTES = 64 * 1024;
 
+/** What the app adds to the page's config for one visitor, where it admits more than the owners. */
+export interface AccessView {
+	/** Who may use push, and the key browsers subscribe against when an external sender holds it. */
+	push: { tiers: readonly Tier[]; key?: string; subscribe?: string };
+	/** The required steps the visitor still owes. */
+	gate(visitor: Visitor): Promise<GateStepView[]>;
+}
+
 export interface ConsolePorts {
 	title: string;
 	timeZone: string;
+	/** The owners' panes, which every host serves. */
 	panes: readonly PaneName[];
+	/** The panes of the other tiers, when the host admits more than its owners; absent = none. */
+	tierPanes?: Readonly<Record<Tier, readonly PaneName[]>>;
+	/** Present when the host admits more than its owners (`admission: "access"`). */
+	access?: AccessView;
+	/**
+	 * The pages and kinds of room the host registered, as far as this visitor may see them. The
+	 * config carries them whatever the admission, but only when there are any, so a host that
+	 * registers none sends the page exactly what it did before.
+	 */
+	hosted?: (visitor: Visitor) => Promise<{
+		pages: PageLinkView[];
+		kinds: KindLinkView[];
+	}>;
 	/** The host's `sessions/` directory. */
 	sessionsDir: string;
 	/** Present when the overview pane is served, or the agent server is there to classify channels. */
@@ -68,8 +94,8 @@ export interface ConsolePorts {
 	) => Pick<SpeakerMemory, "list" | "search" | "add" | "update" | "removeById">;
 	/** The host's principals, read only: whose notes the pane may show, and the names of conversations' principals. */
 	people?: Pick<IdentityService, "principal" | "list">;
-	/** Conversations the console must not list or read. */
-	exclude?: (key: ChannelKey) => boolean;
+	/** Conversations the console must not list or read; `record` is what the registry holds of it, if anything. */
+	exclude?: (key: ChannelKey, record?: ConversationRecord) => boolean;
 	/** The host's conversation registry; without it only the conversations found by name are listed. */
 	registry?: Pick<ConversationRegistry, "list" | "get">;
 	/** Text a relayed message begins with, which is not the owner's words. */
@@ -84,7 +110,7 @@ export interface ConsolePorts {
 	/** The host's six skin tones, which the page draws every character with. */
 	characterSkins?: readonly string[];
 	/** Present when the owner app is served: its rooms' key prefix, for the page. */
-	app?: { surface: string; protocol: string };
+	app?: { surface: string; protocol: string; modes?: false };
 }
 
 import { cleanupConversation } from "./cleanup-api.ts";
@@ -154,8 +180,15 @@ export class ConsoleApi {
 		}
 	}
 
-	#pane(name: PaneName): void {
-		if (!this.#ports.panes.includes(name))
+	/** The panes this visitor is served: the owners' list, or their own tier's. */
+	#panesOf(visitor: Visitor): readonly PaneName[] {
+		return visitor.tier === "owner"
+			? this.#ports.panes
+			: (this.#ports.tierPanes?.[visitor.tier] ?? []);
+	}
+
+	#pane(name: PaneName, visitor: Visitor): void {
+		if (!this.#panesOf(visitor).includes(name))
 			throw new HttpError(404, "This pane is not served.");
 	}
 
@@ -173,13 +206,13 @@ export class ConsoleApi {
 		}
 		const [head, id] = parts;
 		if (method === "GET" && head === "config" && !id)
-			return json(this.config());
+			return json(await this.configFor(visitor));
 		if (
 			method === "GET" &&
 			(head === "overview" || head === "dashboard") &&
 			!id
 		) {
-			this.#pane("overview");
+			this.#pane("overview", visitor);
 			const view = await this.overview();
 			if (head === "overview") return json(view);
 			return json({
@@ -201,39 +234,73 @@ export class ConsoleApi {
 			} satisfies DashboardView);
 		}
 		if (method === "GET" && head === "conversations" && parts.length <= 2) {
-			this.#pane("conversations");
-			if (!id) return json(await this.conversations());
+			this.#pane("conversations", visitor);
+			if (!id) return json(await this.conversations(visitor));
 			const archive = new URL(request.url).searchParams.get("archive");
-			return json(await this.transcript(id, archive ?? undefined));
+			return json(await this.transcript(id, archive ?? undefined, visitor));
 		}
 		if (method === "POST" && head === "channels" && id && parts.length === 3) {
-			this.#pane("overview");
+			this.#pane("overview", visitor);
 			if (parts[2] === "start-over" || parts[2] === "delete")
 				return cleanupConversation(this.#ports, id, parts[2]);
 		}
 		if (method === "GET" && head === "skills" && parts.length <= 2) {
-			this.#pane("skills");
+			this.#pane("skills", visitor);
 			const skills = this.#ports.features?.skills;
 			if (!skills) throw new HttpError(404, "This pane is not served.");
 			return json(id ? await skillDetail(skills, id) : skillCatalog(skills));
 		}
 		if (method === "GET" && head === "connectors" && parts.length === 1) {
-			this.#pane("connectors");
+			this.#pane("connectors", visitor);
 			const connectors = this.#ports.features?.connectors;
 			if (!connectors) throw new HttpError(404, "This pane is not served.");
 			return json(await connectorsView(connectors));
 		}
 		if (head === "notes" && parts.length <= 2) {
-			this.#pane("notes");
+			this.#pane("notes", visitor);
 			return this.#notes(request, id, visitor);
 		}
 		if (method === "GET" && head === "principals" && !id) {
-			this.#pane("notes");
+			this.#pane("notes", visitor);
 			return json(await this.principals(visitor));
 		}
 		throw new HttpError(404, "There is no such API.");
 	}
 
+	/**
+	 * The page's config for a visitor: the owners' view as it was, and for another tier the panes
+	 * of that tier. Where the app admits more than its owners it also says the visitor's tier, the
+	 * steps they owe, the pages and kinds of room they may see, and who gets push.
+	 */
+	async configFor(visitor: Visitor): Promise<ConfigView> {
+		const view = this.config();
+		const { access } = this.#ports;
+		const hosted = (await this.#ports.hosted?.(visitor)) ?? {
+			pages: [],
+			kinds: [],
+		};
+		if (!access)
+			return {
+				...view,
+				...(hosted.pages.length > 0 ? { pages: hosted.pages } : {}),
+				...(hosted.kinds.length > 0 ? { kinds: hosted.kinds } : {}),
+			};
+		const owed = await access.gate(visitor);
+		return {
+			...view,
+			panes: [...this.#panesOf(visitor)],
+			tier: visitor.tier,
+			...(owed.length > 0 ? { gate: owed } : {}),
+			pages: hosted.pages,
+			kinds: hosted.kinds,
+			push: {
+				tiers: [...access.push.tiers],
+				...(access.push.key ? { key: access.push.key } : {}),
+				...(access.push.subscribe ? { subscribe: access.push.subscribe } : {}),
+			},
+		};
+	}
+
 	config(): ConfigView {
 		const { title, panes, timeZone } = this.#ports;
 		const { presentation, features } = this.#ports;
@@ -306,20 +373,33 @@ export class ConsoleApi {
 
 	// ── Conversations ──────────────────────────────────────────────────────
 
-	async conversations(): Promise<ConversationsView> {
+	async conversations(visitor?: Visitor): Promise<ConversationsView> {
 		const { sessionsDir, relayNotes, registry } = this.#ports;
+		const owner = visitor === undefined || visitor.tier === "owner";
+		// A visitor who is not an owner reads their own private conversations, found by the registry alone.
+		const records = registry
+			? await registry.list(
+					owner ? undefined : { principal: visitor.principal.id },
+				)
+			: [];
+		const byKey = new Map(records.map((record) => [record.key, record]));
 		const filter = {
-			excluded: (key: ChannelKey) => this.#hidden(key),
+			excluded: (key: ChannelKey) => this.#hidden(key, byKey.get(key)),
 			relayNotes,
 		};
-		const records = registry ? await registry.list() : [];
+		const mine = owner
+			? records
+			: records.filter(
+					(record) =>
+						record.visibility === "private" &&
+						record.principalId === visitor.principal.id,
+				);
 		// The registry first; the directory scan reads the conversations from before it, by name.
-		const recorded = registeredConversations(sessionsDir, records, filter);
+		const recorded = registeredConversations(sessionsDir, mine, filter);
 		const stored = [
 			...recorded,
-			...storedConversations(sessionsDir, filter),
+			...(owner ? storedConversations(sessionsDir, filter) : []),
 		].sort((a, b) => (b.lastActive ?? "").localeCompare(a.lastActive ?? ""));
-		const byKey = new Map(records.map((record) => [record.key, record]));
 		const names = new Map<string, Promise<PrincipalName>>();
 		return {
 			conversations: await Promise.all(
@@ -328,9 +408,9 @@ export class ConsoleApi {
 		};
 	}
 
-	#hidden(key: ChannelKey): boolean {
+	#hidden(key: ChannelKey, record?: ConversationRecord): boolean {
 		return (
-			(this.#ports.exclude?.(key) ?? false) ||
+			(this.#ports.exclude?.(key, record) ?? false) ||
 			(this.#ports.features?.party?.contains(key) ?? false)
 		);
 	}
@@ -356,10 +436,18 @@ export class ConsoleApi {
 	async transcript(
 		key: string,
 		archive: string | undefined,
+		visitor?: Visitor,
 	): Promise<TranscriptView> {
 		const { sessionsDir, relayNotes } = this.#ports;
+		const record = await this.#ports.registry?.get(key as ChannelKey);
 		const parsed = await this.#located(key);
-		if (!parsed || this.#hidden(key as ChannelKey))
+		// Anyone but an owner reads only a private conversation of their own, which the registry records.
+		const mayRead =
+			visitor === undefined ||
+			visitor.tier === "owner" ||
+			(record?.visibility === "private" &&
+				record.principalId === visitor.principal.id);
+		if (!parsed || !mayRead || this.#hidden(key as ChannelKey, record))
 			throw new HttpError(404, "There is no such conversation.");
 		const dir = join(sessionsDir, parsed.dir);
 		const files = conversationFiles(dir);
@@ -378,7 +466,7 @@ export class ConsoleApi {
 					...(parsed.member ? { member: parsed.member } : {}),
 					...files,
 				},
-				await this.#ports.registry?.get(key as ChannelKey),
+				record,
 			),
 			archives,
 			...(archive !== undefined ? { archive } : {}),
@@ -455,6 +543,12 @@ export class ConsoleApi {
 	/** The people whose notes the pane can show: every principal but the host's own, the visitor first. */
 	async principals(visitor: Visitor): Promise<PrincipalsView> {
 		const self = visitor.principal.id;
+		// Anyone but an owner has their own notes and no one else's to choose from.
+		if (visitor.tier !== "owner")
+			return {
+				self,
+				principals: [{ id: self, name: visitor.principal.displayName }],
+			};
 		const everyone = (await this.#ports.people?.list()) ?? [visitor.principal];
 		const listed = [
 			...everyone.filter((p) => p.id === self),
@@ -477,6 +571,9 @@ export class ConsoleApi {
 		const named = new URL(request.url).searchParams.get("principal");
 		if (named === null || named === visitor.principal.id)
 			return memoryOf(visitor.principal.id);
+		// Another person's notes are the owners' to read.
+		if (visitor.tier !== "owner")
+			throw new HttpError(403, "Only an owner may do this.");
 		// The host's own principal keeps no notes; anyone else must be a principal the host knows.
 		if (named === SYSTEM_PRINCIPAL || !(await people?.principal(named)))
 			throw new HttpError(404, "There is no such person.");