pi-roundtable-web 0.8.0 → 0.9.0

package/src/visitors.ts

@@ -0,0 +1,89 @@
+import type {
+	ActorFacts,
+	IdentityService,
+	Logger,
+	Principal,
+} from "pi-roundtable";
+
+/** Who a request the console admitted comes from: an owner's principal. */
+export interface Visitor {
+	principal: Principal;
+}
+
+/** The visitor of a request, or why it is refused, for the operator's log. */
+export type Identified = { visitor: Visitor } | { refusal: string };
+
+/** The reads of `IDENTITY` the console uses; none of them makes or changes a principal. */
+export type ConsoleIdentity = Pick<
+	IdentityService,
+	"principalOf" | "principal" | "tierOf" | "owners"
+>;
+
+export interface VisitorOptions {
+	/** Whom a request from a verifier that reports no actor stands for; default the primary owner. */
+	ownerId?: string;
+	logger: Logger;
+}
+
+/** The provider of the aliases 0.9 keeps for 0.8 ids; `IDENTITY.resolve` refuses it as no surface's. */
+const LEGACY_PROVIDER = "legacy";
+
+/** How many unlinked identities are remembered, so each is warned about once. */
+const WARNED_MAX = 100;
+
+/**
+ * Identifies the person behind each request the verifier admitted, by reading `IDENTITY` only, so
+ * a visitor never makes a principal: the principal their identity is linked to, who must hold the
+ * owner role. An identity linked to no one is refused on every host, however many owners it has:
+ * the verifier may vouch for members too, so only a link says whose an identity is. A verifier
+ * that reports no actor speaks for `ownerId`, default the primary owner, as in 0.8.
+ */
+export function consoleVisitors(
+	identity: ConsoleIdentity,
+	options: VisitorOptions,
+): (actor: ActorFacts | undefined) => Promise<Identified> {
+	const { logger } = options;
+	const warned = new Set<string>();
+	const warnOnce = (key: string, message: string) => {
+		if (warned.has(key) || warned.size >= WARNED_MAX) return;
+		warned.add(key);
+		logger.warn(`web-console: ${message}`);
+	};
+
+	const owner = async (id: string): Promise<Identified> => {
+		const principal = await identity.principal(id);
+		if (!principal) return { refusal: `there is no principal ${id}` };
+		if (principal.disabled) return { refusal: `principal ${id} is disabled` };
+		if ((await identity.tierOf(id)) !== "owner")
+			return { refusal: `principal ${id} holds no owner role` };
+		return { visitor: { principal } };
+	};
+
+	return async (actor) => {
+		if (!actor) {
+			warnOnce(
+				"",
+				"the verifier reports no actor, so the console takes every request it admits as the primary owner's. Have it report who signed in (cloudflareAccess does)",
+			);
+			const id = options.ownerId ?? (await identity.owners())[0]?.id;
+			return id === undefined
+				? { refusal: "the host has no owner" }
+				: owner(id);
+		}
+		const named = `${actor.provider}:${actor.subject}`;
+		if (actor.provider === LEGACY_PROVIDER)
+			return { refusal: `${named} is a 0.8 id, not an identity` };
+		let id: string | undefined;
+		try {
+			id = await identity.principalOf(named);
+		} catch {
+			return { refusal: "the verifier's actor is no identity" };
+		}
+		if (id !== undefined) return owner(id);
+		warnOnce(
+			named,
+			`${named} is linked to no principal, so the console refuses it. If it is an owner's, add "${named}" to that owner's access.owners[].identities, or run: roundtable principal link <owner's principal id> ${named}`,
+		);
+		return { refusal: `${named} is linked to no principal` };
+	};
+}

package/src/web-plugin.ts

@@ -2,6 +2,7 @@ import {
 	AGENTS,
 	CONVERSATIONS,
 	definePlugin,
+	IDENTITY,
 	MEMORY,
 	type RoundtablePlugin,
 } from "pi-roundtable";
@@ -14,17 +15,20 @@ import {
 	resolveOptions,
 	type WebConsoleOptions,
 } from "./options.ts";
+import { consoleVisitors } from "./visitors.ts";
 
 /**
- * The owner-only web console: conversations, transcripts, memory notes, and the agent team,
- * served on a route of the host's listener and updated live. The options are checked here, so
- * a missing verifier or a bad setting throws when the config is loaded.
+ * The owners' web console: conversations, transcripts, memory notes, and the agent team, served
+ * on a route of the host's listener and updated live. Every request needs the verifier to vouch
+ * for the person and `IDENTITY` to name them an owner. The options are checked here, so a missing
+ * verifier or a bad setting throws when the config is loaded.
  */
 export function webConsole(options: WebConsoleOptions): RoundtablePlugin {
 	const settings = resolveOptions(options);
 	return definePlugin({
 		name: "web-console",
 		requires: [
+			IDENTITY,
 			...(settings.panes.includes("overview") ? [AGENTS] : []),
 			...(settings.panes.includes("notes") ? [MEMORY] : []),
 		],
@@ -48,6 +52,7 @@ async function build(settings: ResolvedOptions, context: Context) {
 	const connection = services.find(DISCORD)?.connection;
 	// Absent on a host without the registry: the console then lists conversations found by name only.
 	const registry = services.find(CONVERSATIONS);
+	const identity = services.get(IDENTITY);
 	const listeners: (() => void)[] = [];
 	const changed = () => {
 		for (const listener of listeners) listener();
@@ -64,9 +69,13 @@ async function build(settings: ResolvedOptions, context: Context) {
 		...(connection
 			? { channelName: (id: string) => connection.channelInfo(id) }
 			: {}),
-		...(settings.ownerId && settings.panes.includes("notes")
-			? { memory: services.get(MEMORY).forSpeaker(settings.ownerId) }
+		...(settings.panes.includes("notes")
+			? {
+					memoryOf: (principalId: string) =>
+						services.get(MEMORY).forSpeaker(principalId),
+				}
 			: {}),
+		people: identity,
 		...(settings.exclude ? { exclude: settings.exclude } : {}),
 		...(registry ? { registry } : {}),
 		relayNotes: settings.relayNotes,
@@ -80,6 +89,10 @@ async function build(settings: ResolvedOptions, context: Context) {
 		mount: settings.mount,
 		assets,
 		verifier: settings.verifier,
+		identify: consoleVisitors(identity, {
+			logger,
+			...(settings.ownerId ? { ownerId: settings.ownerId } : {}),
+		}),
 		origin: settings.origin,
 		pathRouting: settings.routing === "path",
 		...(settings.presentation ? { presentation: settings.presentation } : {}),