superlocalmemory 3.7.8 → 3.8.1

package/src/superlocalmemory/retrieval/time_window.py

@@ -0,0 +1,181 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 | https://qualixar.com | https://varunpratap.com
+
+"""Time-window parsing + membership for recall (Phase 4, T-window).
+
+Pure, dependency-free helpers so recall() can prune candidates to an
+event-time range. Two window forms are accepted:
+
+  * relative string — ``"1h" | "24h" | "7d" | "30d" | "90d" | "1y"`` etc.
+    (``<int><unit>`` where unit is h/d/w/m/y; m≈30d, y≈365d) → ``[now-Δ, now]``.
+  * explicit range — ``(start_iso, end_iso)`` two-tuple of timestamps.
+
+Timestamps are parsed tolerantly: SQLite ``datetime('now')`` form
+(``"YYYY-MM-DD HH:MM:SS"``), ISO-8601 with ``T`` and/or trailing ``Z``, and
+date-only ``"YYYY-MM-DD"`` are all accepted. Comparing the *strings* would be
+wrong (a space sorts before ``T``), so everything is parsed to tz-aware UTC
+datetimes before comparison — never lexicographic.
+
+Part of Qualixar | Author: Varun Pratap Bhardwaj
+License: AGPL-3.0-or-later
+"""
+
+from __future__ import annotations
+
+import re
+from datetime import datetime, timedelta, timezone
+
+__all__ = [
+    "parse_timestamp",
+    "parse_window",
+    "in_window",
+    "infer_window_from_query",
+]
+
+_REL = re.compile(r"^\s*(\d+)\s*([hdwmy])\s*$", re.IGNORECASE)
+
+# Hours per unit. Month and year are documented approximations.
+_UNIT_HOURS: dict[str, int] = {
+    "h": 1,
+    "d": 24,
+    "w": 24 * 7,
+    "m": 24 * 30,
+    "y": 24 * 365,
+}
+
+
+def parse_timestamp(value: str | None) -> datetime | None:
+    """Parse a stored timestamp into a tz-aware UTC datetime, or None.
+
+    Accepts SQLite ``datetime('now')`` (space-separated), ISO-8601 (``T`` and
+    optional ``Z``), and date-only strings. Naive values are assumed UTC.
+    """
+    if not value or not isinstance(value, str):
+        return None
+    text = value.strip()
+    if not text:
+        return None
+    if text.endswith(("Z", "z")):
+        text = text[:-1] + "+00:00"
+    dt: datetime | None = None
+    try:
+        dt = datetime.fromisoformat(text)
+    except ValueError:
+        # Fall back to a date-only prefix (e.g. "2026-03-15 ...").
+        try:
+            dt = datetime.fromisoformat(text[:10])
+        except ValueError:
+            return None
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(timezone.utc)
+
+
+def parse_window(
+    window: str | tuple[str, str] | list | None,
+    now: datetime | None = None,
+) -> tuple[datetime, datetime] | None:
+    """Resolve a window spec to a ``(start, end)`` UTC datetime pair, or None.
+
+    Returns None when the spec is None or unparseable (caller then applies no
+    time filter — additive, fail-open).
+    """
+    if window is None:
+        return None
+    _now = now or datetime.now(timezone.utc)
+    if _now.tzinfo is None:
+        _now = _now.replace(tzinfo=timezone.utc)
+
+    # Explicit (start, end) range.
+    if isinstance(window, (tuple, list)):
+        if len(window) != 2:
+            return None
+        start = parse_timestamp(window[0])
+        end = parse_timestamp(window[1])
+        if start is None or end is None:
+            return None
+        return (start, end) if start <= end else (end, start)
+
+    # String forms: relative "<int><unit>" or an explicit range written as
+    # "start..end" / "start,end" (so it survives URL params, JSON, and CLI args
+    # as a single value — no tuple serialization needed on the wire).
+    if isinstance(window, str):
+        m = _REL.match(window)
+        if m:
+            n = int(m.group(1))
+            unit = m.group(2).lower()
+            hours = n * _UNIT_HOURS[unit]
+            return (_now - timedelta(hours=hours), _now)
+        for sep in ("..", ","):
+            if sep in window:
+                left, _, right = window.partition(sep)
+                start = parse_timestamp(left)
+                end = parse_timestamp(right)
+                if start is None or end is None:
+                    return None
+                return (start, end) if start <= end else (end, start)
+
+    return None
+
+
+# Natural-language temporal-scope patterns → relative window spec. Ordered:
+# more specific ("last 3 weeks") is matched before generic ("last week").
+_UNIT_TO_SPEC = {"day": "d", "week": "w", "month": "m", "year": "y"}
+_QUERY_N_UNIT = re.compile(
+    r"\b(?:last|past|previous|prior)\s+(\d{1,3})\s+(day|week|month|year)s?\b",
+    re.IGNORECASE,
+)
+_QUERY_PHRASES: tuple[tuple[re.Pattern[str], str], ...] = (
+    (re.compile(r"\btoday\b", re.IGNORECASE), "1d"),
+    (re.compile(r"\byesterday\b", re.IGNORECASE), "2d"),
+    (re.compile(r"\b(?:this|last|past|previous)\s+week\b", re.IGNORECASE), "7d"),
+    (re.compile(r"\b(?:this|last|past|previous)\s+month\b", re.IGNORECASE), "30d"),
+    (re.compile(r"\b(?:this|last|past|previous)\s+year\b", re.IGNORECASE), "1y"),
+    (re.compile(r"\b(?:recent|recently|lately)\b", re.IGNORECASE), "30d"),
+)
+
+
+def infer_window_from_query(query: str | None) -> str | None:
+    """Infer a relative time window from natural-language scope in a query.
+
+    Recognises a small, unambiguous set of temporal-scope phrases ("yesterday",
+    "last week", "past 3 months", "recently") and maps them to a relative
+    window spec ("2d", "7d", "3m", …) that ``parse_window`` understands. Returns
+    None when no clear temporal scope is present, so recall applies no window.
+
+    Deliberately conservative — only fires on explicit scope words, never on
+    bare content — so it augments, never surprises. Callers use it only when the
+    user did not pass an explicit window.
+    """
+    if not query or not isinstance(query, str):
+        return None
+    m = _QUERY_N_UNIT.search(query)
+    if m:
+        n = int(m.group(1))
+        unit = _UNIT_TO_SPEC.get(m.group(2).lower())
+        if unit and n > 0:
+            return f"{n}{unit}"
+    for pattern, spec in _QUERY_PHRASES:
+        if pattern.search(query):
+            return spec
+    return None
+
+
+def in_window(
+    event_time: str | None,
+    bounds: tuple[datetime, datetime] | None,
+) -> bool:
+    """True if ``event_time`` falls within ``bounds`` (inclusive).
+
+    No bounds → always True (no filtering). An unparseable/missing event time
+    is excluded (conservative: a windowed query returns only datable facts in
+    range).
+    """
+    if bounds is None:
+        return True
+    dt = parse_timestamp(event_time)
+    if dt is None:
+        return False
+    start, end = bounds
+    return start <= dt <= end

package/src/superlocalmemory/server/api.py

@@ -48,10 +48,10 @@ logger = logging.getLogger("superlocalmemory.api_server")
 # V3 paths
 MEMORY_DIR = DynamicStatePath()
 DB_PATH = DynamicStatePath("memory.db")
-# V3.3.21: UI shipped inside the package for pip/npm installs.
-_PKG_UI = Path(__file__).resolve().parent.parent / "ui"
-_REPO_UI = Path(__file__).resolve().parent.parent.parent.parent / "ui"
-UI_DIR = _PKG_UI if (_PKG_UI / "index.html").exists() else _REPO_UI
+# V3.3.21+: the dashboard ships inside the package (superlocalmemory/ui) for
+# every install path. The legacy repo-root ui/ dev fallback was retired in
+# v3.8.0 when that copy was deleted; the packaged directory is authoritative.
+UI_DIR = Path(__file__).resolve().parent.parent / "ui"
 
 
 # ============================================================================

package/src/superlocalmemory/server/config_file.py

@@ -0,0 +1,90 @@
+"""Process-safe, durable read/modify/write access to ``config.json``."""
+
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+import threading
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Callable, Iterator
+
+_PROCESS_LOCK = threading.RLock()
+
+
+@contextmanager
+def _file_lock(path: Path) -> Iterator[None]:
+    """Serialize config access across daemon, CLI, and worker processes."""
+    lock_path = path.with_name(f".{path.name}.lock")
+    lock_path.parent.mkdir(parents=True, exist_ok=True)
+    with _PROCESS_LOCK, lock_path.open("a+b") as handle:
+        if os.name == "nt":
+            import msvcrt
+
+            handle.seek(0)
+            handle.write(b"\0")
+            handle.flush()
+            handle.seek(0)
+            msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
+        else:
+            import fcntl
+
+            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+        try:
+            yield
+        finally:
+            if os.name == "nt":
+                handle.seek(0)
+                msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+            else:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+
+
+def _read_unlocked(path: Path) -> dict:
+    if not path.exists():
+        return {}
+    value = json.loads(path.read_text(encoding="utf-8"))
+    if not isinstance(value, dict):
+        raise ValueError("config root must be a JSON object")
+    return value
+
+
+def read_config(path: Path) -> dict:
+    """Return one coherent config snapshot under the interprocess lock."""
+    with _file_lock(path):
+        return _read_unlocked(path)
+
+
+def update_config(path: Path, update: Callable[[dict], None]) -> dict:
+    """Atomically update and durably replace a config JSON object."""
+    with _file_lock(path):
+        data = _read_unlocked(path)
+        update(data)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        descriptor, temp_name = tempfile.mkstemp(
+            prefix=f".{path.name}.",
+            suffix=".tmp",
+            dir=path.parent,
+        )
+        temp_path = Path(temp_name)
+        try:
+            with os.fdopen(descriptor, "w", encoding="utf-8") as stream:
+                json.dump(data, stream, indent=2)
+                stream.write("\n")
+                stream.flush()
+                os.fsync(stream.fileno())
+            os.chmod(temp_path, 0o600)
+            os.replace(temp_path, path)
+            if hasattr(os, "O_DIRECTORY"):
+                directory_fd = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
+                try:
+                    os.fsync(directory_fd)
+                finally:
+                    os.close(directory_fd)
+        finally:
+            temp_path.unlink(missing_ok=True)
+        return data
+
+
+__all__ = ("read_config", "update_config")

package/src/superlocalmemory/server/origin.py

@@ -0,0 +1,50 @@
+"""Exact browser-origin validation for the local dashboard."""
+
+from __future__ import annotations
+
+from urllib.parse import urlsplit
+
+
+_LOOPBACK_HOSTS = frozenset({"127.0.0.1", "::1", "localhost"})
+
+
+def origin_is_loopback(origin: str) -> bool:
+    """Return whether an Origin is absent or an exact HTTP(S) loopback URL."""
+    if not origin:
+        return True
+    try:
+        parsed = urlsplit(origin)
+        # Accessing port validates malformed/non-numeric port values.
+        _ = parsed.port
+    except (TypeError, ValueError):
+        return False
+    return (
+        parsed.scheme in {"http", "https"}
+        and parsed.hostname is not None
+        and parsed.hostname.lower() in _LOOPBACK_HOSTS
+        and parsed.username is None
+        and parsed.password is None
+        and parsed.path in {"", "/"}
+        and not parsed.query
+        and not parsed.fragment
+    )
+
+
+def origin_is_daemon(origin: str, *, port: int) -> bool:
+    """Return whether ``origin`` is one of this daemon's loopback aliases.
+
+    A loopback host alone is not a browser trust boundary: another local web
+    server can run on a different port.  Credentialless dashboard writes are
+    therefore limited to the port owned by this daemon.  Authenticated local
+    integrations are handled separately by the write-identity boundary.
+    """
+    if not origin_is_loopback(origin):
+        return False
+    try:
+        parsed = urlsplit(origin)
+        return parsed.port == port
+    except (TypeError, ValueError):
+        return False
+
+
+__all__ = ("origin_is_daemon", "origin_is_loopback")

package/src/superlocalmemory/server/profile_runtime.py

@@ -6,6 +6,7 @@ import json
 import os
 import tempfile
 import threading
+import time as _time
 from contextlib import contextmanager
 from contextvars import ContextVar
 from dataclasses import dataclass
@@ -20,6 +21,20 @@ _REQUEST_PROFILE: ContextVar[str | None] = ContextVar(
     "slm_request_profile", default=None,
 )
 
+# Maximum seconds to wait for in-flight operations to drain before a
+# profile switch or engine reconfigure is aborted with HTTP 503.
+# Tests can monkeypatch this module-level value to keep runs fast.
+_DRAIN_TIMEOUT_SECS: float = 5.0
+
+
+class TransitionDrainTimeout(Exception):
+    """Raised when in-flight operations do not drain within _DRAIN_TIMEOUT_SECS.
+
+    The caller (HTTP switch route) maps this to HTTP 503 so the client
+    receives a clear error instead of a silent hang.  After the timeout,
+    `_transitioning` is always reset to False so the daemon stays responsive.
+    """
+
 
 def current_request_profile() -> str | None:
     """Return the immutable profile snapshot admitted for this request."""
@@ -61,6 +76,18 @@ class ProfileRuntime:
             self._active_operations += 1
             return self._snapshot
 
+    def _try_acquire_operation_nowait(self) -> ProfileSnapshot | None:
+        """Non-blocking acquire: returns None immediately when a transition is pending.
+
+        Used by cooperative background maintenance tasks so they never block the
+        drain window of a pending profile switch.
+        """
+        with self._condition:
+            if self._transitioning:
+                return None
+            self._active_operations += 1
+            return self._snapshot
+
     def release_operation(self) -> None:
         with self._condition:
             if self._active_operations <= 0:
@@ -77,20 +104,64 @@ class ProfileRuntime:
         finally:
             self.release_operation()
 
+    @contextmanager
+    def operation_nowait(self) -> Iterator[ProfileSnapshot | None]:
+        """Cooperatively skip when a profile transition is pending.
+
+        Background maintenance tasks that do NOT mutate profile-scoped engine
+        state (cache warmup, health probes) MUST use this instead of
+        ``operation()`` so they never hold the drain window hostage.
+
+        Yields ``None`` (preempted — skip this work cycle) when a switch is
+        already in progress.  Yields a :class:`ProfileSnapshot` and holds the
+        lease normally when no transition is pending.
+
+        The caller is responsible for checking ``if snap is None: return``.
+
+        Unlike ``operation()``, this context manager never blocks — it either
+        admits immediately or preempts immediately.
+        """
+        snapshot = self._try_acquire_operation_nowait()
+        acquired = snapshot is not None
+        try:
+            yield snapshot
+        finally:
+            if acquired:
+                self.release_operation()
+
     def transition(
         self,
         target_profile: str,
         commit: Callable[[ProfileSnapshot, str], None],
     ) -> ProfileSnapshot:
-        """Drain admitted operations, commit, then publish a new generation."""
+        """Drain admitted operations, commit, then publish a new generation.
+
+        Raises TransitionDrainTimeout if in-flight operations do not drain
+        within _DRAIN_TIMEOUT_SECS.  The flag is always reset on timeout so
+        the daemon remains responsive (no permanent _transitioning=True wedge).
+        """
+        deadline = _time.monotonic() + _DRAIN_TIMEOUT_SECS
         with self._condition:
             while self._transitioning:
                 self._condition.wait()
             if target_profile == self._snapshot.profile_id:
                 return self._snapshot
             self._transitioning = True
-            while self._active_operations:
-                self._condition.wait()
+            while self._active_operations > 0:
+                remaining = deadline - _time.monotonic()
+                if remaining <= 0:
+                    # Reset before raising — never leave the daemon wedged.
+                    self._transitioning = False
+                    self._condition.notify_all()
+                    raise TransitionDrainTimeout(
+                        f"Profile switch to '{target_profile}' timed out after "
+                        f"{_DRAIN_TIMEOUT_SECS:.0f}s: {self._active_operations} "
+                        "in-flight operation(s) did not drain. "
+                        "Try again when no active requests are in progress."
+                    )
+                # Use short sleep slices so we react quickly to notifications
+                # and to timeout expiry without busy-spinning.
+                self._condition.wait(timeout=min(remaining, 0.25))
             previous = self._snapshot
 
         try:
@@ -111,13 +182,26 @@ class ProfileRuntime:
             return self._snapshot
 
     def reconfigure(self, commit: Callable[[ProfileSnapshot], None]) -> ProfileSnapshot:
-        """Run a same-profile engine transition behind the operation barrier."""
+        """Run a same-profile engine transition behind the operation barrier.
+
+        Raises TransitionDrainTimeout if in-flight operations do not drain
+        within _DRAIN_TIMEOUT_SECS (same semantics as transition()).
+        """
+        deadline = _time.monotonic() + _DRAIN_TIMEOUT_SECS
         with self._condition:
             while self._transitioning:
                 self._condition.wait()
             self._transitioning = True
-            while self._active_operations:
-                self._condition.wait()
+            while self._active_operations > 0:
+                remaining = deadline - _time.monotonic()
+                if remaining <= 0:
+                    self._transitioning = False
+                    self._condition.notify_all()
+                    raise TransitionDrainTimeout(
+                        f"Engine reconfigure timed out after {_DRAIN_TIMEOUT_SECS:.0f}s: "
+                        f"{self._active_operations} in-flight operation(s) did not drain."
+                    )
+                self._condition.wait(timeout=min(remaining, 0.25))
             snapshot = self._snapshot
 
         try:
@@ -362,12 +446,44 @@ class ProfileRuntimeMiddleware:
             raise
         scope.setdefault("state", {})["profile_snapshot"] = snapshot
         token = _REQUEST_PROFILE.set(snapshot.profile_id)
+
+        # The operation lease guards the SYNCHRONOUS route work that produces
+        # the response — not the streaming of its body. A long-lived SSE body
+        # would otherwise hold the lease for its whole lifetime and make every
+        # profile switch time out during drain (HTTP 503):
+        #   * /events/stream runs `while True: await sleep(1)` FOREVER while a
+        #     dashboard tab is open;
+        #   * /api/v3/chat/stream streams LLM tokens for up to 120s.
+        # Release the lease the instant the response starts. By then the route
+        # handler has finished its engine work and returned its Response
+        # (FastAPI buffers normal responses before sending response.start).
+        # Streaming generators that still need the engine (chat recall) already
+        # re-acquire their own short-lived lease internally, and /events/stream
+        # only reads the EventBus DB — neither depends on this outer lease.
+        released = False
+
+        def _release_lease_once() -> None:
+            # Single-task coroutine chain — a plain flag is sufficient; the
+            # underlying release_operation() is lock-guarded and idempotent-safe
+            # only via this guard, so never call it twice.
+            nonlocal released
+            if not released:
+                released = True
+                runtime.release_operation()
+
+        async def _send(message) -> None:
+            if message.get("type") == "http.response.start":
+                _release_lease_once()
+            await send(message)
+
         try:
-            await self._app(scope, receive, send)
+            await self._app(scope, receive, _send)
         finally:
             _REQUEST_PROFILE.reset(token)
+            # Safety net: a request that errors before emitting response.start
+            # (or an ASGI app that never sends one) must still release its lease.
             # Release is lock-only and must not itself be cancellation-prone.
-            runtime.release_operation()
+            _release_lease_once()
 
 
 __all__ = [
@@ -375,6 +491,7 @@ __all__ = [
     "ProfileRuntime",
     "ProfileRuntimeMiddleware",
     "ProfileSnapshot",
+    "TransitionDrainTimeout",
     "bind_profile_runtime",
     "commit_daemon_profile_switch",
     "current_request_profile",

package/src/superlocalmemory/server/rbac_enforce.py

@@ -0,0 +1,142 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 — RBAC / teams (C3)
+
+"""RBAC enforcement boundary for HTTP routes.
+
+This is the single place that turns "who is calling" + "what are they trying to
+do" into an allow/deny decision, on top of the existing machine-auth layer
+(write_identity). It is deliberately small so every mutation route calls the
+same code path — the research warning was explicit: an RBAC layer that is
+defined but not consistently called is worse than none.
+
+Principal model
+---------------
+* **user**  — a logged-in dashboard user (valid session token). Always enforced
+  against their role on the active profile.
+* **owner** — the machine operator (already proved machine auth via
+  write_identity; no user session). In personal mode the owner bypasses RBAC
+  (all permissions). When the org turns on *require_login* (company mode) the
+  owner bypass is disabled and a user session is mandatory.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import HTTPException, Request
+
+from superlocalmemory.access.rbac import Permission, Role, permissions_for_role
+
+_SESSION_HEADER = "X-SLM-User-Session"
+_SESSION_COOKIE = "slm_session"
+
+OWNER_PRINCIPAL = {
+    "kind": "owner",
+    "user_id": "owner",
+    "username": "owner",
+    "display_name": "Machine Owner",
+}
+
+
+def get_rbac_engine(app_state: Any) -> Any | None:
+    return getattr(app_state, "rbac", None)
+
+
+def _session_token(request: Request) -> str:
+    tok = request.headers.get(_SESSION_HEADER, "")
+    if tok:
+        return tok
+    try:
+        return request.cookies.get(_SESSION_COOKIE, "") or ""
+    except Exception:
+        return ""
+
+
+def resolve_principal(request: Request) -> dict:
+    """Resolve the caller to a user (valid session) or the machine owner."""
+    rbac = get_rbac_engine(request.app.state)
+    token = _session_token(request)
+    if rbac is not None and token:
+        user = rbac.resolve_session(token)
+        if user:
+            return {"kind": "user", **user}
+    return dict(OWNER_PRINCIPAL)
+
+
+def _active_profile() -> str:
+    from superlocalmemory.server.routes.helpers import get_active_profile
+
+    return get_active_profile()
+
+
+def require_permission(
+    request: Request,
+    permission: Permission,
+    *,
+    profile: str | None = None,
+) -> dict:
+    """Authorize ``permission`` on ``profile`` (default: active profile).
+
+    Returns the principal on success. Raises 401 when a login is required but
+    absent, or 403 when the user's role does not grant the permission.
+    """
+    rbac = get_rbac_engine(request.app.state)
+    principal = resolve_principal(request)
+    require_login = bool(rbac is not None and rbac.require_login())
+    prof = profile or _active_profile()
+
+    if principal["kind"] == "owner":
+        # The machine operator is root — they always retain MANAGE (they have
+        # shell access to the box regardless), so company mode can never lock
+        # administration out of the dashboard. require_login only gates the
+        # owner's DATA operations, forcing per-user login for read/write/etc.
+        if require_login and permission != Permission.MANAGE:
+            raise HTTPException(
+                401,
+                detail="Login required: this workspace enforces per-user access.",
+            )
+        return principal  # personal mode — operator is owner
+
+    # Logged-in user: always enforced against their role.
+    if rbac is not None and rbac.has_permission(principal["user_id"], prof, permission):
+        return principal
+    raise HTTPException(
+        403,
+        detail=(
+            f"Your role does not allow '{permission.value}' on this workspace."
+        ),
+    )
+
+
+def require_manage(request: Request, *, profile: str | None = None) -> dict:
+    """Guard for user/role administration (MANAGE permission)."""
+    return require_permission(request, Permission.MANAGE, profile=profile)
+
+
+def principal_info(request: Request) -> dict:
+    """Rich identity for /whoami: principal + role + effective permissions on
+    the active profile. Never raises — used by the dashboard to render UI."""
+    rbac = get_rbac_engine(request.app.state)
+    principal = resolve_principal(request)
+    prof = _active_profile()
+    info = {
+        "kind": principal["kind"],
+        "user_id": principal["user_id"],
+        "username": principal["username"],
+        "display_name": principal.get("display_name", principal["username"]),
+        "profile": prof,
+        "rbac_active": bool(rbac is not None and rbac.user_count() > 0),
+        "require_login": bool(rbac is not None and rbac.require_login()),
+    }
+    if principal["kind"] == "owner":
+        # Owner has every permission (personal mode) unless login is required.
+        info["role"] = "owner"
+        info["permissions"] = [p.value for p in Permission]
+        return info
+    role = rbac.get_role(principal["user_id"], prof) if rbac is not None else None
+    info["role"] = role.value if role else None
+    info["permissions"] = (
+        [p.value for p in permissions_for_role(role)] if role else []
+    )
+    return info