Refine chat controls and add explicit owner recovery reset

Simplify the ASCII interface, expose owner setup, and load any selected number of messages using bounded history batches. Add backend-only owner reset with a matching public fingerprint and stopped-service guards, and document the loss of old history and key continuity.

1 files changed, 95 insertions, 45 deletions

diff --git a/crates/chat-server/web/app.js b/crates/chat-server/web/app.js
index c06116b..3c97f66 100644
--- a/crates/chat-server/web/app.js
+++ b/crates/chat-server/web/app.js
@@ -86,12 +86,15 @@ function clearState() {
     pendingSend = undefined;
     setupToken = undefined;
     before = 0;
+    element('history-count').max = '0';
+    element('history-range').textContent = 'Latest messages (0-0)';
     for (const input of document.querySelectorAll('input,textarea')) {
         if (input.id === 'history-count') input.value = '0'; else input.value = '';
     }
     for (const id of ['messages', 'conversations', 'who', 'fingerprint', 'counts', 'thread-name', 'conversation-fingerprint']) element(id).replaceChildren();
-    for (const id of ['create', 'unlock', 'chat', 'thread', 'inbox', 'older', 'retry']) show(id, false);
+    for (const id of ['create', 'unlock', 'chat', 'thread', 'inbox', 'older', 'retry', 'owner-access']) show(id, false);
     show('entry', Boolean(config?.owner));
+    show('owner-entry');
     status('Locked. Select your file and enter its password to return.');
 }
 
@@ -127,7 +130,7 @@ function download(file) {
 async function createIdentity() {
     const password = element('new-password').value;
     if (password !== element('confirm-password').value) throw new Error('Passwords do not match');
-    if (!config.owner && location.hash !== '#setup') throw new Error('Owner setup is required first');
+    if (!config.owner && element('setup-label').hidden) throw new Error('Owner setup is required first');
     setupToken = !config.owner ? element('setup-token').value : undefined;
     status('Generating your purpose-specific identity and protecting its file...');
     const result = await cryptoOperation({ op: 'create', origin: location.origin, name: element('name').value, password, owner: config.owner || '' });
@@ -160,6 +163,8 @@ async function unlockIdentity() {
     setupToken = undefined;
     config = await api({ op: 'config' });
     show('entry', false);
+    show('owner-entry', false);
+    show('owner-access', false);
     show('unlock', false);
     show('chat');
     element('who').textContent = `${identity.name} [${session.owner === true ? 'OWNER' : 'VISITOR'}]`;
@@ -176,7 +181,7 @@ async function unlockIdentity() {
         element('conversation-fingerprint').textContent = `Conversation: ${session.id}`;
         show('thread');
         element('thread-name').textContent = 'You <-> Doan';
-        await history(0);
+        await loadHistory(0);
     }
     status('Unlocked in memory only. No history loaded automatically. Lock or leave to forget this session.');
 }
@@ -217,7 +222,7 @@ async function inbox() {
                     name = profile.name;
                 }
                 element('thread-name').textContent = `Doan <-> ${name}`;
-                await history(0);
+                await loadHistory(0);
                 status('Conversation opened. Choose how many messages to load.');
             } catch (error) { status(error.message); }
             finally { if (generation === current) busy = false; }
@@ -227,42 +232,74 @@ async function inbox() {
 }
 
 function counters(conversation) {
+    if (!Number.isSafeInteger(conversation.total) || conversation.total < 0 || conversation.total > 10000) throw new Error('Invalid conversation count');
+    element('history-count').max = String(conversation.total);
+    element('history-range').textContent = `Latest messages (0-${conversation.total})`;
     const sent = session.owner ? conversation.owner_sent : conversation.visitor_sent;
     const received = session.owner ? conversation.visitor_sent : conversation.owner_sent;
     element('counts').textContent = `Total: ${conversation.total} | Sent: ${sent} | Received: ${received}`;
 }
 
-async function history(count, cursor = 0) {
+async function renderHistoryBatch(messages) {
+    const requests = messages.map(message => ({ sender: message.sender === selected.id ? selected.public : config.owner, ciphertext: message.ciphertext }));
+    const decrypted = await cryptoOperation(protectRequest('decrypt_batch', { messages: requests }));
+    for (let index = 0; index < messages.length; index += 1) {
+        const message = messages[index];
+        const item = document.createElement('li');
+        const label = document.createElement('small');
+        label.textContent = `#${message.seq} / ${message.sender === session.id ? 'YOU' : 'THEM'}`;
+        const text = document.createElement('p');
+        try {
+            const entry = decrypted.messages[index];
+            if (entry.signer !== message.sender) throw new Error('Sender fingerprint mismatch');
+            if (entry.error) throw new Error('Invalid ciphertext or signature');
+            const payload = checkedPayload(entry.payload, 'message', selected.id, message.sender);
+            if (payload.id !== message.id || typeof payload.text !== 'string' || new TextEncoder().encode(payload.text).length > 8192) throw new Error('Message binding mismatch');
+            text.textContent = payload.text;
+        } catch { text.textContent = '[Message rejected: invalid ciphertext, signature, or conversation binding.]'; }
+        item.append(label, text);
+        element('messages').prepend(item);
+    }
+}
+
+async function refreshCounts() {
+    const conversation = selected.id;
+    const result = await api({ op: 'history', conversation, count: 0, before: 0 });
+    if (selected?.id === conversation) counters(result.conversation);
+    return result.conversation;
+}
+
+async function loadHistory(count, cursor = 0) {
     if (!selected) throw new Error('Choose a conversation first');
-    if (!Number.isSafeInteger(count) || count < 0 || count > 50) throw new Error('Choose 0 to 50 messages');
-    const result = await api({ op: 'history', conversation: selected.id, count, before: cursor });
-    counters(result.conversation);
-    if (!cursor) element('messages').replaceChildren();
-    if (result.messages.length) {
-        status('Decrypting and verifying selected messages locally...');
-        const requests = result.messages.map(message => ({ sender: message.sender === selected.id ? selected.public : config.owner, ciphertext: message.ciphertext }));
-        const decrypted = await cryptoOperation(protectRequest('decrypt_batch', { messages: requests }));
-        for (let index = 0; index < result.messages.length; index += 1) {
-            const message = result.messages[index];
-            const item = document.createElement('li');
-            const label = document.createElement('small');
-            label.textContent = `#${message.seq} / ${message.sender === session.id ? 'YOU' : 'THEM'}`;
-            const text = document.createElement('p');
-            try {
-                const entry = decrypted.messages[index];
-                if (entry.signer !== message.sender) throw new Error('Sender fingerprint mismatch');
-                if (entry.error) throw new Error('Invalid ciphertext or signature');
-                const payload = checkedPayload(entry.payload, 'message', selected.id, message.sender);
-                if (payload.id !== message.id || typeof payload.text !== 'string' || new TextEncoder().encode(payload.text).length > 8192) throw new Error('Message binding mismatch');
-                text.textContent = payload.text;
-            } catch { text.textContent = '[Message rejected: invalid ciphertext, signature, or conversation binding.]'; }
-            item.append(label, text);
-            element('messages').prepend(item);
-        }
-        before = Math.min(...result.messages.map(message => message.seq));
+    const conversation = await refreshCounts();
+    if (!Number.isSafeInteger(count) || count < 0 || count > conversation.total) throw new Error(`Choose 0 to ${conversation.total} messages`);
+    if (!cursor) { element('messages').replaceChildren(); before = 0; }
+    if (count === 0) {
+        element('history-count').value = '0';
+        show('older', false);
+        status('No message history loaded.');
+        return;
+    }
+    let remaining = count;
+    let next = cursor;
+    let exhausted = false;
+    while (remaining > 0) {
+        const size = Math.min(50, remaining);
+        const result = await api({ op: 'history', conversation: selected.id, count: size, before: next });
+        counters(result.conversation);
+        if (!Array.isArray(result.messages) || result.messages.length > size) throw new Error('Invalid history response');
+        if (!result.messages.length) { exhausted = true; break; }
+        const sequence = Math.min(...result.messages.map(message => message.seq));
+        if (!Number.isSafeInteger(sequence) || sequence <= 0 || (next > 0 && sequence >= next)) throw new Error('Invalid history cursor');
+        status(`Decrypting and verifying selected messages locally (${count - remaining + result.messages.length}/${count})...`);
+        await renderHistoryBatch(result.messages);
+        remaining -= result.messages.length;
+        next = sequence;
+        before = next;
+        if (result.messages.length < size) { exhausted = true; break; }
     }
-    show('older', count > 0 && result.messages.length === count);
-    status(count === 0 ? 'No message history loaded.' : 'Selected history decrypted and verified locally.');
+    show('older', !exhausted && element('messages').children.length < Number(element('history-count').max));
+    status('Selected history decrypted and verified locally.');
 }
 
 async function submitPending() {
@@ -289,15 +326,32 @@ async function send() {
     await submitPending();
 }
 
-action('create-choice', async () => { show('entry', false); show('create'); status('Create a purpose-specific protected identity file.'); });
-action('open-choice', async () => { show('entry', false); show('unlock'); status('Select your saved identity file.'); });
+function ownerSetup() {
+    show('entry', false);
+    show('owner-entry', false);
+    show('unlock', false);
+    show('create', !config.owner);
+    show('owner-access', Boolean(config.owner));
+    show('setup-label', !config.owner);
+    element('create-title').textContent = 'Create the owner identity (owner only)';
+    status('');
+}
+
+action('create-choice', async () => { show('entry', false); show('owner-entry', false); show('setup-label', false); element('create-title').textContent = 'Create a new chat'; show('create'); status(''); });
+action('open-choice', async () => { show('entry', false); show('owner-entry', false); show('unlock'); status(''); });
+action('owner-choice', async () => { window.history.replaceState(null, '', '#setup'); ownerSetup(); });
+action('owner-open', async () => { show('owner-access', false); show('unlock'); status(''); });
 action('create-form', createIdentity);
 action('unlock-form', unlockIdentity);
-action('history-form', () => history(Number(element('history-count').value)));
+element('history-count').addEventListener('focus', () => {
+    const current = generation;
+    if (session && selected && !busy) refreshCounts().catch(error => { if (current === generation) status(error.message); });
+});
+action('history-form', () => loadHistory(Number(element('history-count').value)));
 action('send-form', send);
 action('retry', submitPending);
 action('refresh-inbox', inbox);
-action('older', () => history(Number(element('history-count').value), before));
+action('older', () => loadHistory(Number(element('history-count').value), before));
 element('lock').addEventListener('click', () => { if (session) api({ op: 'lock' }).catch(() => {}); clearState(); });
 window.addEventListener('pagehide', clearState);
 window.addEventListener('pageshow', event => { if (event.persisted) clearState(); });
@@ -310,14 +364,10 @@ async function start() {
     await wasm;
     config = await api({ op: 'config' });
     if (config.origin !== location.origin) throw new Error('Server origin mismatch');
-    if (!config.owner) {
-        if (location.hash === '#setup') {
-            show('create');
-            show('setup-label');
-            element('create-title').textContent = 'Create the dedicated owner identity';
-            status('Owner setup. Keep this identity separate from your canonical OpenPGP key.');
-        } else { status('Owner setup is not complete. Please return later.'); }
-    } else { show('entry'); status('Choose CREATE NEW CHAT or OPEN CHAT FILE.'); }
+    show('owner-entry');
+    show('entry', Boolean(config.owner));
+    status('');
+    if (location.hash === '#setup') ownerSetup();
 }
 
 start().catch(error => status(error.message));