/home/mrjunejune/zenbu: mrjunejune/conversation

comparison mrjunejune/conversation_api.c @ 264:04fee26ecce0

add authenticated JRPG conversation platform Add reusable auth/session storage, owned conversation recovery, guest quotas, admin workflows, URL-routed conversation UI, mobile frame support, and parallel browser acceptance. Co-authored-by: Copilot <[email protected]>

author	MrJuneJune <me@mrjunejune.com>
date	Fri, 07 Aug 2026 07:34:12 -0700
parents	b401627fc49e
children	056790c4fb0d

comparison

equal deleted inserted replaced

-:ee04e4e69fed
+:04fee26ecce0
 #include "mrjunejune/conversation_api.h"
+#include "mrjunejune/auth_api.h"
 #include "mrjunejune/inference_bridge.h"
 #include "mrjunejune/conversation_store.h"
+#include "auth/auth_store.h"
 #include "seobeo/seobeo.h"
 #include <pthread.h>
 #include <stdio.h>
 #include <stdarg.h>
 #define CONVERSATION_HISTORY_MAX (512 * 1024)
 #define CONVERSATION_CUSTOM_EVENT_MAX (3 * 1024)
 #define CONVERSATION_EVENT_NAME_MAX 64
 #define CONVERSATION_ACTIVE_MAX 4
 #define CONVERSATION_TURNS_PER_MINUTE 60
+/* Buffer large enough for a guest Set-Cookie directive */
+#define CONV_GUEST_COOKIE_CAPACITY (AUTH_CRYPTO_GUEST_COOKIE_SIZE + 256)
+/* Quota policy — read from env at init, validated at startup. */
+#define CONV_GUEST_DAILY_TURNS_DEFAULT          10
+#define CONV_GUEST_DAILY_OUTPUT_TOKENS_DEFAULT  20000
+#define CONV_GUEST_DAILY_TURNS_MIN              1
+#define CONV_GUEST_DAILY_TURNS_MAX              10000
+#define CONV_GUEST_DAILY_OUTPUT_TOKENS_MIN      1
+#define CONV_GUEST_DAILY_OUTPUT_TOKENS_MAX      1000000
+#define CONV_GUEST_REQUEST_OUTPUT_TOKENS_MIN    1
+/* Default per-request reservation (tokens); capped to daily at init. */
+#define CONV_GUEST_REQUEST_OUTPUT_TOKENS_DEFAULT 2048
 static Conversation_Store *g_conversation_store = NULL;
 static Inference_Bridge *g_inference_bridge = NULL;
-static boolean g_anonymous_inference_enabled = FALSE;
+static boolean g_guest_inference_enabled = FALSE;
 static pthread_mutex_t g_pending_mutex = PTHREAD_MUTEX_INITIALIZER;
 static pthread_mutex_t g_admission_mutex = PTHREAD_MUTEX_INITIALIZER;
 static time_t g_admission_window = 0;
 static uint32 g_admission_turns = 0;
 static uint32 g_active_turns = 0;
+/* Quota policy (validated at init). */
+static int64 g_guest_daily_turns          = CONV_GUEST_DAILY_TURNS_DEFAULT;
+static int64 g_guest_daily_output_tokens  = CONV_GUEST_DAILY_OUTPUT_TOKENS_DEFAULT;
+static int64 g_guest_request_output_tokens = CONV_GUEST_REQUEST_OUTPUT_TOKENS_DEFAULT;
 typedef struct Pending_Turn {
 char request_id[37];
 char conversation_id[37];
+/* owner identity copied before request arena expires (req 8) */
+Conversation_Owner owner;
 Seobeo_SSE_Stream *p_stream;
 char *content;
 size_t content_length;
 size_t content_capacity;
 int64 input_tokens;
 int64 output_tokens;
 boolean failed;
 boolean aborted;
+boolean has_usage_event;   /* TRUE once assistant.usage received           */
+boolean finalized;         /* TRUE once Finalize_Pending has run (once-only) */
 char error_message[512];
+/* Guest quota fields — copied before arena expires. */
+boolean is_guest_reserved;   /* TRUE if quota was reserved for this turn */
+int64   reserved_output_tokens;
+char    guest_id[37];        /* guest_id from principal (safe copy)      */
 struct Pending_Turn *p_next;
 } Pending_Turn;
 static Pending_Turn *g_pending_turns = NULL;
 if (g_active_turns > 0)
 g_active_turns--;
 pthread_mutex_unlock(&g_admission_mutex);
 }
-static Seobeo_Request_Entry *Conversation_API_JSON_Response(
+static const char *Conversation_API_Request_Value(
+Seobeo_Request_Entry *p_request,
+const char *key)
+{
+void *p_value = Dowa_HashMap_Get_Ptr(p_request, (char *)key);
+return p_value ? ((Seobeo_Request_Entry *)p_value)->value : NULL;
+}
+static boolean Conversation_API_Is_Inference_Ready(void)
+{
+return g_guest_inference_enabled;
+}
+/* UTC midnight for a Unix timestamp. */
+static int64 conv__utc_window_start(int64 unix_ts)
+{
+return (unix_ts / 86400LL) * 86400LL;
+}
+/* Build guest quota JSON into a fixed buffer (null-terminated). */
+static boolean conv_guest_quota_cb(
+const char *guest_id,
+int64       current_unix,
+char       *json_out,
+size_t      json_capacity)
+{
+Auth_Store *p_store = Auth_API_Get_Store();
+if (!p_store || !guest_id || !json_out || json_capacity == 0)
+{
+if (json_out && json_capacity > 0)
+strncpy(json_out, "null", json_capacity);
+return TRUE;
+}
+int64 window_start = conv__utc_window_start(current_unix);
+Auth_Store_Guest_Usage usage;
+memset(&usage, 0, sizeof(usage));
+Auth_Store_Guest_Get_Usage(p_store, guest_id, window_start, &usage);
+int64 turns_remaining =
+g_guest_daily_turns - usage.turns_used;
+if (turns_remaining < 0) turns_remaining = 0;
+int64 tokens_remaining =
+g_guest_daily_output_tokens - usage.output_tokens_used - usage.output_tokens_reserved;
+if (tokens_remaining < 0) tokens_remaining = 0;
+int64 resets_at = window_start + 86400LL;
+snprintf(
+json_out, json_capacity,
+"{\"turnsLimit\":%lld,\"turnsUsed\":%lld,\"turnsRemaining\":%lld,"
+"\"outputTokensLimit\":%lld,\"outputTokensUsed\":%lld,"
+"\"outputTokensReserved\":%lld,\"outputTokensRemaining\":%lld,"
+"\"resetsAt\":%lld}",
+(long long)g_guest_daily_turns,
+(long long)usage.turns_used,
+(long long)turns_remaining,
+(long long)g_guest_daily_output_tokens,
+(long long)usage.output_tokens_used,
+(long long)usage.output_tokens_reserved,
+(long long)tokens_remaining,
+(long long)resets_at);
+return TRUE;
+}
+static Dowa_JSON_Entry *Conversation_API_Parse_Body(
+Seobeo_Request_Entry *p_request,
+Dowa_Arena *p_arena)
+{
+const char *body = Conversation_API_Request_Value(p_request, "Body");
+if (!body)
+return NULL;
+Dowa_JSON_Value value = Dowa_JSON_Parse(
+body, (int32)strlen(body), p_arena);
+return value.type == DOWA_JSON_OBJECT
+? (Dowa_JSON_Entry *)value.object_val
+: NULL;
+}
+static const char *Conversation_API_Query_Param(
+Seobeo_Request_Entry *p_request,
+const char *param_name,
+char *output,
+size_t output_capacity)
+{
+const char *qs = Conversation_API_Request_Value(p_request, "QueryString");
+if (!qs || !param_name || !output || output_capacity == 0)
+return NULL;
+output[0] = '\0';
+size_t name_len = strlen(param_name);
+const char *p = qs;
+while (*p)
+{
+if (strncmp(p, param_name, name_len) == 0 && p[name_len] == '=')
+{
+p += name_len + 1;
+size_t i = 0;
+while (*p && *p != '&' && i < output_capacity - 1)
+{
+if (p[0] == '%' && p[1] && p[2])
+{
+char hex[3] = {p[1], p[2], '\0'};
+output[i++] = (char)(int)strtol(hex, NULL, 16);
+p += 3;
+}
+else if (*p == '+')
+{
+output[i++] = ' ';
+p++;
+}
+else
+{
+output[i++] = *p++;
+}
+}
+output[i] = '\0';
+return output[0] != '\0' ? output : NULL;
+}
+while (*p && *p != '&') p++;
+if (*p == '&') p++;
+}
+return NULL;
+}
+/*
+* Build a JSON response, optionally setting a guest cookie when one was
+* freshly issued by Auth_API_Resolve_Principal.
+*/
+static Seobeo_Request_Entry *Conversation_API_JSON_Response_With_Cookie(
 Dowa_Arena *p_arena,
 const char *status,
-const char *body)
+const char *body,
+const char *new_guest_cookie)
 {
 Seobeo_Request_Entry *p_response = NULL;
 Dowa_HashMap_Push_Arena(p_response, "status", (char *)status, p_arena);
 Dowa_HashMap_Push_Arena(
 p_response, "content-type", "application/json; charset=utf-8", p_arena);
 Dowa_HashMap_Push_Arena(p_response, "cache-control", "no-store", p_arena);
 Dowa_HashMap_Push_Arena(p_response, "body", (char *)body, p_arena);
+if (new_guest_cookie && new_guest_cookie[0] != '\0')
+Dowa_HashMap_Push_Arena(
+p_response, "Set-Cookie", (char *)new_guest_cookie, p_arena);
 return p_response;
+}
+static Seobeo_Request_Entry *Conversation_API_JSON_Response(
+Dowa_Arena *p_arena,
+const char *status,
+const char *body)
+{
+return Conversation_API_JSON_Response_With_Cookie(p_arena, status, body, NULL);
 }
 static Seobeo_Request_Entry *Conversation_API_Error(
 Dowa_Arena *p_arena,
 const char *status,
 code,
 escaped);
 return Conversation_API_JSON_Response(p_arena, status, body);
 }
-static const char *Conversation_API_Request_Value(
+static Seobeo_Request_Entry *Conversation_API_Error_With_Cookie(
+Dowa_Arena *p_arena,
+const char *status,
+const char *code,
+const char *message,
+const char *new_guest_cookie)
+{
+char *escaped = Dowa_JSON_Escape_String(message, 0, p_arena);
+size_t capacity = strlen(code) + strlen(escaped) + 64;
+char *body = Dowa_Arena_Allocate(p_arena, capacity);
+snprintf(
+body,
+capacity,
+"{\"error\":{\"code\":\"%s\",\"message\":\"%s\"}}",
+code,
+escaped);
+return Conversation_API_JSON_Response_With_Cookie(p_arena, status, body, new_guest_cookie);
+}
+/*
+* Resolve the principal for this request, optionally setting a new guest
+* cookie on the response when returned.
+* Returns FALSE only on internal error (treat as 500).
+*/
+static boolean Conversation_API_Resolve(
 Seobeo_Request_Entry *p_request,
-const char *key)
+Auth_Principal *p_principal,
-{
+char *new_guest_cookie,
-void *p_value = Dowa_HashMap_Get_Ptr(p_request, (char *)key);
+Dowa_Arena *p_arena)
-return p_value ? ((Seobeo_Request_Entry *)p_value)->value : NULL;
+{
-}
+return Auth_API_Resolve_Principal(
+p_request, p_principal, p_arena,
-static boolean Conversation_API_Is_Same_Origin(
+new_guest_cookie, CONV_GUEST_COOKIE_CAPACITY);
-Seobeo_Request_Entry *p_request)
+}
-{
-const char *host = Conversation_API_Request_Value(p_request, "Host");
+/*
-const char *origin = Conversation_API_Request_Value(p_request, "Origin");
+* Resolve an existing principal for mutation requests.
-if (!host || !origin)
+* Does NOT create a new guest identity.
-return FALSE;
+* Returns FALSE on internal error (500); sets *p_found=FALSE when no
-const char *origin_host = strstr(origin, "://");
+* existing session/guest is present (caller must return 401).
-if (!origin_host)
+*/
-return FALSE;
+static boolean Conversation_API_Resolve_Existing(
-origin_host += 3;
-const char *end = strchr(origin_host, '/');
-size_t length = end ? (size_t)(end - origin_host) : strlen(origin_host);
-return strlen(host) == length && strncmp(host, origin_host, length) == 0;
-}
-static boolean Conversation_API_Is_Enabled(void)
-{
-return g_anonymous_inference_enabled;
-}
-static Dowa_JSON_Entry *Conversation_API_Parse_Body(
 Seobeo_Request_Entry *p_request,
-Dowa_Arena *p_arena)
+Auth_Principal *p_principal,
-{
+Dowa_Arena *p_arena,
-const char *body = Conversation_API_Request_Value(p_request, "Body");
+boolean *p_found)
-if (!body)
+{
-return NULL;
+return Auth_API_Resolve_Existing_Principal(
-Dowa_JSON_Value value = Dowa_JSON_Parse(
+p_request, p_principal, p_arena, p_found);
-body, (int32)strlen(body), p_arena);
+}
-return value.type == DOWA_JSON_OBJECT
-? (Dowa_JSON_Entry *)value.object_val
+/*
-: NULL;
+* Map a resolved principal to a Conversation_Owner.
+* Always succeeds for USER and GUEST principals.
+*/
+static void Conversation_API_Owner_From_Principal(
+const Auth_Principal *p_principal,
+Conversation_Owner *p_owner)
+{
+if (p_principal->kind == AUTH_PRINCIPAL_USER)
+{
+p_owner->kind = CONVERSATION_OWNER_KIND_USER;
+strncpy(p_owner->id, p_principal->user_id, sizeof(p_owner->id) - 1);
+p_owner->id[sizeof(p_owner->id) - 1] = '\0';
+}
+else
+{
+p_owner->kind = CONVERSATION_OWNER_KIND_GUEST;
+strncpy(p_owner->id, p_principal->guest_id, sizeof(p_owner->id) - 1);
+p_owner->id[sizeof(p_owner->id) - 1] = '\0';
+}
 }
 static void Conversation_API_Send_Stream_Error(
 Seobeo_Handle *p_handle,
 int status,
 }
 }
 static void Conversation_API_Finalize_Pending(Pending_Turn *p_turn)
 {
+/* Idempotence guard — called with g_pending_mutex held. */
+if (p_turn->finalized)
+return;
+p_turn->finalized = TRUE;
+/* Reconcile or release guest quota reservation before persistence. */
+if (p_turn->is_guest_reserved)
+{
+Auth_Store *p_auth_store = Auth_API_Get_Store();
+if (p_auth_store)
+{
+if (!p_turn->failed && !p_turn->aborted)
+{
+int64 actual = p_turn->has_usage_event
+? p_turn->output_tokens
+: p_turn->reserved_output_tokens;
+Auth_Store_Guest_Reconcile(
+p_auth_store, p_turn->request_id, actual);
+}
+else
+Auth_Store_Guest_Release(p_auth_store, p_turn->request_id);
+}
+}
 Conversation_Store_Result persistence;
 if (p_turn->failed || p_turn->aborted)
 {
 persistence = Conversation_Store_Fail_Turn(
 g_conversation_store,
 }
 else if (strcmp(p_event->type, "assistant.usage") == 0)
 {
 p_turn->input_tokens = p_event->input_tokens;
 p_turn->output_tokens = p_event->output_tokens;
+p_turn->has_usage_event = TRUE;
 char usage[256];
 snprintf(
 usage,
 sizeof(usage),
 "{\"request_id\":\"%s\",\"input_tokens\":%lld,"
 if (should_abort)
 Inference_Bridge_Abort_Turn(
 g_inference_bridge, abort_request_id, abort_conversation_id);
 }
-static Seobeo_Request_Entry *Conversation_API_Create(
+/* ------------------------------------------------------------------ */
-Seobeo_Request_Entry *p_request,
+/* HTTP handler helpers                                                  */
-Dowa_Arena *p_arena)
+/* ------------------------------------------------------------------ */
-{
-if (!Conversation_API_Is_Enabled())
-return Conversation_API_Error(
-p_arena, "503", "inference_disabled", "Inference API is disabled");
-if (!Conversation_API_Is_Same_Origin(p_request))
-return Conversation_API_Error(
-p_arena, "403", "origin_rejected", "Same-origin request required");
-if (!g_conversation_store)
-return Conversation_API_Error(
-p_arena, "503", "store_unavailable", "Conversation store unavailable");
-const char *title = "";
-const char *body = Conversation_API_Request_Value(p_request, "Body");
-if (body && body[0] != '\0')
-{
-Dowa_JSON_Entry *object = Conversation_API_Parse_Body(p_request, p_arena);
-if (!object)
-return Conversation_API_Error(
-p_arena, "400", "invalid_json", "Request body must be a JSON object");
-char *parsed_title = Dowa_JSON_Get_String(object, "title");
-if (parsed_title)
-title = parsed_title;
-}
-if (strlen(title) > CONVERSATION_TITLE_MAX)
-return Conversation_API_Error(
-p_arena, "400", "invalid_title", "Title exceeds 200 bytes");
-char conversation_id[37];
-if (Conversation_Store_Create_Conversation(
-g_conversation_store,
-title,
-conversation_id) != CONVERSATION_STORE_OK)
-return Conversation_API_Error(
-p_arena, "500", "create_failed", "Unable to create conversation");
-char *response_body = Dowa_Arena_Allocate(p_arena, 64);
-snprintf(response_body, 64, "{\"id\":\"%s\"}", conversation_id);
-return Conversation_API_JSON_Response(p_arena, "201", response_body);
-}
 static boolean Conversation_API_Append(
 char *output,
 size_t capacity,
 size_t *p_offset,
 return FALSE;
 *p_offset += (size_t)written;
 return TRUE;
 }
+/* ------------------------------------------------------------------ */
+/* GET /api/conversations?cursor=<ts>_<id>&limit=20                    */
+/* ------------------------------------------------------------------ */
+static Seobeo_Request_Entry *Conversation_API_List(
+Seobeo_Request_Entry *p_request,
+Dowa_Arena *p_arena)
+{
+if (!g_conversation_store)
+return Conversation_API_Error(
+p_arena, "503", "store_unavailable", "Conversation store unavailable");
+Auth_Principal principal;
+char new_guest_cookie[CONV_GUEST_COOKIE_CAPACITY] = {0};
+if (!Conversation_API_Resolve(p_request, &principal, new_guest_cookie, p_arena))
+return Conversation_API_Error(p_arena, "500", "internal_error", "Session error");
+if (principal.must_change_password)
+return Conversation_API_Error_With_Cookie(
+p_arena, "403", "password_change_required",
+"Password change required", new_guest_cookie);
+Conversation_Owner owner;
+Conversation_API_Owner_From_Principal(&principal, &owner);
+/* Parse cursor and limit from query string */
+char cursor_buf[80] = {0};
+char limit_buf[8] = {0};
+Conversation_API_Query_Param(p_request, "cursor", cursor_buf, sizeof(cursor_buf));
+Conversation_API_Query_Param(p_request, "limit", limit_buf, sizeof(limit_buf));
+int64 cursor_updated_at = 0;
+char cursor_id[37] = {0};
+if (cursor_buf[0] != '\0')
+{
+/* cursor format: <updated_at>_<uuid> */
+const char *underscore = strchr(cursor_buf, '_');
+if (!underscore || underscore == cursor_buf ||
+strlen(underscore + 1) != 36)
+return Conversation_API_Error_With_Cookie(
+p_arena, "400", "invalid_cursor", "Cursor format invalid",
+new_guest_cookie);
+char ts_part[32] = {0};
+size_t ts_len = (size_t)(underscore - cursor_buf);
+if (ts_len >= sizeof(ts_part))
+return Conversation_API_Error_With_Cookie(
+p_arena, "400", "invalid_cursor", "Cursor format invalid",
+new_guest_cookie);
+memcpy(ts_part, cursor_buf, ts_len);
+cursor_updated_at = (int64)atoll(ts_part);
+if (cursor_updated_at <= 0)
+return Conversation_API_Error_With_Cookie(
+p_arena, "400", "invalid_cursor", "Cursor timestamp invalid",
+new_guest_cookie);
+strncpy(cursor_id, underscore + 1, 36);
+cursor_id[36] = '\0';
+}
+int32 limit = 20;
+if (limit_buf[0] != '\0')
+{
+int parsed = atoi(limit_buf);
+if (parsed >= 1 && parsed <= 50)
+limit = parsed;
+else if (parsed > 50)
+limit = 50;
+}
+Conversation_Summary *summaries = NULL;
+int32 count = 0;
+Conversation_Store_Result result = Conversation_Store_List(
+g_conversation_store, &owner,
+cursor_updated_at, cursor_id[0] ? cursor_id : NULL,
+limit, &summaries, &count, p_arena);
+if (result != CONVERSATION_STORE_OK)
+return Conversation_API_Error_With_Cookie(
+p_arena, "500", "list_failed", "Unable to list conversations",
+new_guest_cookie);
+/* Estimate response size */
+size_t capacity = 128;
+for (int32 i = 0; i < count; i++)
+{
+Conversation_Summary *s = &summaries[i];
+capacity += (s->title ? strlen(s->title) : 0) * 6 +
+(s->last_message_preview ? strlen(s->last_message_preview) : 0) * 6 +
+256;
+}
+char *body = Dowa_Arena_Allocate(p_arena, capacity);
+if (!body)
+return Conversation_API_Error_With_Cookie(
+p_arena, "500", "serialize_failed", "Response exceeds memory limit",
+new_guest_cookie);
+size_t offset = 0;
+if (!Conversation_API_Append(body, capacity, &offset,
+"{\"conversations\":["))
+return Conversation_API_Error_With_Cookie(
+p_arena, "500", "serialize_failed", "Response too large",
+new_guest_cookie);
+for (int32 i = 0; i < count; i++)
+{
+Conversation_Summary *s = &summaries[i];
+char *esc_title = Dowa_JSON_Escape_String(
+s->title ? s->title : "", 0, p_arena);
+char *esc_preview = Dowa_JSON_Escape_String(
+s->last_message_preview ? s->last_message_preview : "", 0, p_arena);
+if (!Conversation_API_Append(
+body, capacity, &offset,
+"%s{\"id\":\"%s\",\"title\":\"%s\",\"status\":\"%s\","
+"\"created_at\":%lld,\"updated_at\":%lld,"
+"\"turn_count\":%lld,\"last_message_preview\":\"%s\"}",
+i == 0 ? "" : ",",
+s->id ? s->id : "",
+esc_title ? esc_title : "",
+s->status ? s->status : "",
+(long long)s->created_at,
+(long long)s->updated_at,
+(long long)s->turn_count,
+esc_preview ? esc_preview : ""))
+return Conversation_API_Error_With_Cookie(
+p_arena, "500", "serialize_failed", "Response too large",
+new_guest_cookie);
+}
+/* Next cursor: last item's (updated_at, id) */
+char cursor_out[80] = "null";
+if (count == limit && count > 0)
+{
+Conversation_Summary *last = &summaries[count - 1];
+if (last->id)
+snprintf(cursor_out, sizeof(cursor_out), "\"%lld_%s\"",
+(long long)last->updated_at, last->id);
+}
+if (!Conversation_API_Append(body, capacity, &offset,
+"],\"cursor\":%s}", cursor_out))
+return Conversation_API_Error_With_Cookie(
+p_arena, "500", "serialize_failed", "Response too large",
+new_guest_cookie);
+return Conversation_API_JSON_Response_With_Cookie(
+p_arena, "200", body, new_guest_cookie);
+}
+/* ------------------------------------------------------------------ */
+/* POST /api/conversations                                              */
+/* ------------------------------------------------------------------ */
+static Seobeo_Request_Entry *Conversation_API_Create(
+Seobeo_Request_Entry *p_request,
+Dowa_Arena *p_arena)
+{
+if (!g_conversation_store)
+return Conversation_API_Error(
+p_arena, "503", "store_unavailable", "Conversation store unavailable");
+Auth_Principal principal;
+boolean found = FALSE;
+if (!Conversation_API_Resolve_Existing(p_request, &principal, p_arena, &found))
+return Conversation_API_Error(p_arena, "500", "internal_error", "Session error");
+if (!found)
+return Conversation_API_Error(
+p_arena, "401", "auth_required", "Bootstrap session first");
+if (principal.must_change_password)
+return Conversation_API_Error(
+p_arena, "403", "password_change_required",
+"Password change required");
+if (!Auth_API_Verify_CSRF(p_request, &principal))
+return Conversation_API_Error(
+p_arena, "403", "csrf_invalid", "Same-origin and CSRF token required");
+Conversation_Owner owner;
+Conversation_API_Owner_From_Principal(&principal, &owner);
+const char *title = "";
+const char *body = Conversation_API_Request_Value(p_request, "Body");
+if (body && body[0] != '\0')
+{
+Dowa_JSON_Entry *object = Conversation_API_Parse_Body(p_request, p_arena);
+if (!object)
+return Conversation_API_Error(
+p_arena, "400", "invalid_json", "Request body must be a JSON object");
+char *parsed_title = Dowa_JSON_Get_String(object, "title");
+if (parsed_title)
+title = parsed_title;
+}
+if (strlen(title) > CONVERSATION_TITLE_MAX)
+return Conversation_API_Error(
+p_arena, "400", "invalid_title", "Title exceeds 200 bytes");
+char conversation_id[37];
+if (Conversation_Store_Create_Owned(
+g_conversation_store, title, &owner,
+conversation_id) != CONVERSATION_STORE_OK)
+return Conversation_API_Error(
+p_arena, "500", "create_failed", "Unable to create conversation");
+char *response_body = Dowa_Arena_Allocate(p_arena, 64);
+snprintf(response_body, 64, "{\"id\":\"%s\"}", conversation_id);
+return Conversation_API_JSON_Response(p_arena, "201", response_body);
+}
+/* ------------------------------------------------------------------ */
+/* GET /api/conversations/:conversation_id                              */
+/* ------------------------------------------------------------------ */
 static Seobeo_Request_Entry *Conversation_API_Get(
 Seobeo_Request_Entry *p_request,
 Dowa_Arena *p_arena)
 {
-if (!Conversation_API_Is_Enabled())
+if (!g_conversation_store)
 return Conversation_API_Error(
-p_arena, "503", "inference_disabled", "Inference API is disabled");
+p_arena, "503", "store_unavailable", "Conversation store unavailable");
+Auth_Principal principal;
+char new_guest_cookie[CONV_GUEST_COOKIE_CAPACITY] = {0};
+if (!Conversation_API_Resolve(p_request, &principal, new_guest_cookie, p_arena))
+return Conversation_API_Error(p_arena, "500", "internal_error", "Session error");
+if (principal.must_change_password)
+return Conversation_API_Error_With_Cookie(
+p_arena, "403", "password_change_required",
+"Password change required", new_guest_cookie);
+Conversation_Owner owner;
+Conversation_API_Owner_From_Principal(&principal, &owner);
 const char *conversation_id =
 Conversation_API_Request_Value(p_request, ":conversation_id");
 if (!conversation_id)
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
-p_arena, "400", "missing_id", "Conversation ID is required");
+p_arena, "400", "missing_id", "Conversation ID is required",
+new_guest_cookie);
 Conversation_Record record;
-Conversation_Store_Result result = Conversation_Store_Get(
+Conversation_Store_Result result = Conversation_Store_Get_Owned(
-g_conversation_store, conversation_id, &record, p_arena);
+g_conversation_store, conversation_id, &owner, &record, p_arena);
 if (result == CONVERSATION_STORE_NOT_FOUND)
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
-p_arena, "404", "not_found", "Conversation not found");
+p_arena, "404", "not_found", "Conversation not found",
+new_guest_cookie);
 if (result != CONVERSATION_STORE_OK)
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
-p_arena, "500", "load_failed", "Unable to load conversation");
+p_arena, "500", "load_failed", "Unable to load conversation",
+new_guest_cookie);
 if (!record.id || !record.title || !record.status)
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
-p_arena, "500", "load_failed", "Conversation data exceeded limits");
+p_arena, "500", "load_failed", "Conversation data exceeded limits",
+new_guest_cookie);
 size_t history_size = strlen(record.title) + strlen(record.status);
 for (size_t i = 0; i < Dowa_Array_Length(record.turns); i++)
 {
 Conversation_Turn *p_turn = &record.turns[i];
 if (!p_turn->role || !p_turn->content || !p_turn->status ||
 !p_turn->request_id || !p_turn->error_message)
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
-p_arena, "500", "load_failed", "Conversation data exceeded limits");
+p_arena, "500", "load_failed", "Conversation data exceeded limits",
+new_guest_cookie);
 history_size +=
 strlen(p_turn->role) + strlen(p_turn->content) +
 strlen(p_turn->status) + strlen(p_turn->request_id) +
 strlen(p_turn->error_message);
 if (history_size > CONVERSATION_HISTORY_MAX)
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
 p_arena,
 "413",
 "history_too_large",
-"Conversation history exceeds response limit");
+"Conversation history exceeds response limit",
+new_guest_cookie);
 }
 char *escaped_title = Dowa_JSON_Escape_String(record.title, 0, p_arena);
 if (!escaped_title)
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
-p_arena, "500", "serialize_failed", "Unable to serialize conversation");
+p_arena, "500", "serialize_failed", "Unable to serialize conversation",
+new_guest_cookie);
 size_t capacity = strlen(escaped_title) + 512;
 for (size_t i = 0; i < Dowa_Array_Length(record.turns); i++)
 {
 Conversation_Turn *p_turn = &record.turns[i];
 capacity +=
 strlen(p_turn->status) + strlen(p_turn->request_id) +
 strlen(p_turn->error_message)) * 6 + 320;
 }
 char *body = Dowa_Arena_Allocate(p_arena, capacity);
 if (!body)
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
-p_arena, "500", "serialize_failed", "Response exceeds memory limit");
+p_arena, "500", "serialize_failed", "Response exceeds memory limit",
+new_guest_cookie);
 size_t offset = 0;
 if (!Conversation_API_Append(
 body,
 capacity,
 &offset,
 record.id,
 escaped_title,
 record.status,
 (long long)record.created_at,
 (long long)record.updated_at))
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
-p_arena, "500", "serialize_failed", "Response too large");
+p_arena, "500", "serialize_failed", "Response too large",
+new_guest_cookie);
 for (size_t i = 0; i < Dowa_Array_Length(record.turns); i++)
 {
 Conversation_Turn *p_turn = &record.turns[i];
 char *role = Dowa_JSON_Escape_String(p_turn->role, 0, p_arena);
 error,
 (long long)p_turn->input_tokens,
 (long long)p_turn->output_tokens,
 (long long)p_turn->created_at,
 (long long)p_turn->completed_at))
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
-p_arena, "500", "serialize_failed", "Response too large");
+p_arena, "500", "serialize_failed", "Response too large",
+new_guest_cookie);
 }
 if (!Conversation_API_Append(body, capacity, &offset, "]}"))
-return Conversation_API_Error(
+return Conversation_API_Error_With_Cookie(
-p_arena, "500", "serialize_failed", "Response too large");
+p_arena, "500", "serialize_failed", "Response too large",
-return Conversation_API_JSON_Response(p_arena, "200", body);
+new_guest_cookie);
-}
+return Conversation_API_JSON_Response_With_Cookie(
+p_arena, "200", body, new_guest_cookie);
+}
+/* ------------------------------------------------------------------ */
+/* PATCH /api/conversations/:conversation_id                            */
+/* ------------------------------------------------------------------ */
 static Seobeo_Request_Entry *Conversation_API_Update(
 Seobeo_Request_Entry *p_request,
 Dowa_Arena *p_arena)
 {
-if (!Conversation_API_Is_Enabled())
+if (!g_conversation_store)
 return Conversation_API_Error(
-p_arena, "503", "inference_disabled", "Inference API is disabled");
+p_arena, "503", "store_unavailable", "Conversation store unavailable");
-if (!Conversation_API_Is_Same_Origin(p_request))
-return Conversation_API_Error(
+Auth_Principal principal;
-p_arena, "403", "origin_rejected", "Same-origin request required");
+boolean found = FALSE;
+if (!Conversation_API_Resolve_Existing(p_request, &principal, p_arena, &found))
+return Conversation_API_Error(p_arena, "500", "internal_error", "Session error");
+if (!found)
+return Conversation_API_Error(
+p_arena, "401", "auth_required", "Bootstrap session first");
+if (principal.must_change_password)
+return Conversation_API_Error(
+p_arena, "403", "password_change_required",
+"Password change required");
+if (!Auth_API_Verify_CSRF(p_request, &principal))
+return Conversation_API_Error(
+p_arena, "403", "csrf_invalid", "Same-origin and CSRF token required");
+Conversation_Owner owner;
+Conversation_API_Owner_From_Principal(&principal, &owner);
 const char *conversation_id =
 Conversation_API_Request_Value(p_request, ":conversation_id");
 Dowa_JSON_Entry *object = Conversation_API_Parse_Body(p_request, p_arena);
 char *title = object ? Dowa_JSON_Get_String(object, "title") : NULL;
 if (!conversation_id || !title)
 p_arena, "400", "invalid_request", "Conversation ID and title required");
 if (strlen(title) > CONVERSATION_TITLE_MAX)
 return Conversation_API_Error(
 p_arena, "400", "invalid_title", "Title exceeds 200 bytes");
-Conversation_Store_Result result = Conversation_Store_Update_Title(
+Conversation_Store_Result result = Conversation_Store_Update_Title_Owned(
-g_conversation_store, conversation_id, title);
+g_conversation_store, conversation_id, &owner, title);
 if (result == CONVERSATION_STORE_NOT_FOUND)
 return Conversation_API_Error(
 p_arena, "404", "not_found", "Conversation not found");
 if (result != CONVERSATION_STORE_OK)
 return Conversation_API_Error(
 p_arena, "500", "update_failed", "Unable to update conversation");
 return Conversation_API_JSON_Response(p_arena, "200", "{\"ok\":true}");
 }
+/* ------------------------------------------------------------------ */
+/* DELETE /api/conversations/:conversation_id                           */
+/* ------------------------------------------------------------------ */
 static Seobeo_Request_Entry *Conversation_API_Delete(
 Seobeo_Request_Entry *p_request,
 Dowa_Arena *p_arena)
 {
-if (!Conversation_API_Is_Enabled())
+if (!g_conversation_store)
 return Conversation_API_Error(
-p_arena, "503", "inference_disabled", "Inference API is disabled");
+p_arena, "503", "store_unavailable", "Conversation store unavailable");
-if (!Conversation_API_Is_Same_Origin(p_request))
-return Conversation_API_Error(
+Auth_Principal principal;
-p_arena, "403", "origin_rejected", "Same-origin request required");
+boolean found = FALSE;
+if (!Conversation_API_Resolve_Existing(p_request, &principal, p_arena, &found))
+return Conversation_API_Error(p_arena, "500", "internal_error", "Session error");
+if (!found)
+return Conversation_API_Error(
+p_arena, "401", "auth_required", "Bootstrap session first");
+if (principal.must_change_password)
+return Conversation_API_Error(
+p_arena, "403", "password_change_required",
+"Password change required");
+if (!Auth_API_Verify_CSRF(p_request, &principal))
+return Conversation_API_Error(
+p_arena, "403", "csrf_invalid", "Same-origin and CSRF token required");
+Conversation_Owner owner;
+Conversation_API_Owner_From_Principal(&principal, &owner);
 const char *conversation_id =
 Conversation_API_Request_Value(p_request, ":conversation_id");
 if (!conversation_id)
 return Conversation_API_Error(
 p_arena, "400", "missing_id", "Conversation ID is required");
-Conversation_Store_Result result = Conversation_Store_Delete(
-g_conversation_store, conversation_id);
+Conversation_Store_Result result = Conversation_Store_Delete_Owned(
+g_conversation_store, conversation_id, &owner);
 if (result == CONVERSATION_STORE_NOT_FOUND)
 return Conversation_API_Error(
 p_arena, "404", "not_found", "Conversation not found");
 if (result != CONVERSATION_STORE_OK)
 return Conversation_API_Error(
 p_arena, "500", "delete_failed", "Unable to delete conversation");
 if (Inference_Bridge_Is_Ready(g_inference_bridge))
 {
 char request_id[37];
 if (Conversation_Store_Generate_UUID(request_id))
 Inference_Bridge_Delete_Conversation(
 Dowa_HashMap_Push_Arena(p_response, "status", "204", p_arena);
 Dowa_HashMap_Push_Arena(p_response, "body", "", p_arena);
 return p_response;
 }
+/* ------------------------------------------------------------------ */
+/* POST /api/conversations/claim  (body: {"conversationId":"<uuid>"}) */
+/* ID stays in request body — never appears in URL or request log.    */
+/* ------------------------------------------------------------------ */
+static Seobeo_Request_Entry *Conversation_API_Claim_Body(
+Seobeo_Request_Entry *p_request,
+Dowa_Arena *p_arena)
+{
+if (!g_conversation_store)
+return Conversation_API_Error(
+p_arena, "503", "store_unavailable", "Conversation store unavailable");
+Auth_Principal principal;
+boolean found = FALSE;
+if (!Conversation_API_Resolve_Existing(p_request, &principal, p_arena, &found))
+return Conversation_API_Error(p_arena, "500", "internal_error", "Session error");
+if (!found)
+return Conversation_API_Error(
+p_arena, "401", "auth_required", "Bootstrap session first");
+/* Guests may not claim; forced-password-change users blocked */
+if (principal.kind != AUTH_PRINCIPAL_USER)
+return Conversation_API_Error(
+p_arena, "403", "forbidden", "Must be authenticated to claim");
+if (principal.must_change_password)
+return Conversation_API_Error(
+p_arena, "403", "password_change_required",
+"Password change required");
+if (!Auth_API_Verify_CSRF(p_request, &principal))
+return Conversation_API_Error(
+p_arena, "403", "csrf_invalid", "Same-origin and CSRF token required");
+Dowa_JSON_Entry *object = Conversation_API_Parse_Body(p_request, p_arena);
+if (!object)
+return Conversation_API_Error(
+p_arena, "400", "invalid_json", "Request body must be a JSON object");
+const char *conversation_id = Dowa_JSON_Get_String(object, "conversationId");
+if (!conversation_id || conversation_id[0] == '\0')
+return Conversation_API_Error(
+p_arena, "400", "missing_id", "conversationId is required");
+if (strlen(conversation_id) > 36)
+return Conversation_API_Error(
+p_arena, "400", "invalid_id", "conversationId is invalid");
+Conversation_Store_Result result = Conversation_Store_Claim_Legacy(
+g_conversation_store, conversation_id, principal.user_id);
+if (result == CONVERSATION_STORE_NOT_FOUND)
+return Conversation_API_Error(
+p_arena, "404", "not_found", "Conversation not found");
+if (result == CONVERSATION_STORE_CONFLICT)
+return Conversation_API_Error(
+p_arena, "409", "already_owned", "Conversation is already owned");
+if (result != CONVERSATION_STORE_OK)
+return Conversation_API_Error(
+p_arena, "500", "claim_failed", "Unable to claim conversation");
+return Conversation_API_JSON_Response(p_arena, "200", "{\"ok\":true}");
+}
+/* ------------------------------------------------------------------ */
+/* GET /api/inference/health                                            */
+/* ------------------------------------------------------------------ */
 static Seobeo_Request_Entry *Conversation_API_Health(
 Seobeo_Request_Entry *p_request,
 Dowa_Arena *p_arena)
 {
 (void)p_request;
 boolean ready =
-Conversation_API_Is_Enabled() &&
+Conversation_API_Is_Inference_Ready() &&
 g_conversation_store &&
 Inference_Bridge_Is_Ready(g_inference_bridge);
 return Conversation_API_JSON_Response(
 p_arena,
 ready ? "200" : "503",
 ready ? "{\"status\":\"ready\"}" : "{\"status\":\"unavailable\"}");
 }
+/* ------------------------------------------------------------------ */
+/* POST /api/conversations/:conversation_id/turns  (streaming)          */
+/* ------------------------------------------------------------------ */
+/*
+* SSE client-disconnect callback.
+* Called by Seobeo_SSE_Server_Detach_Handle after g_sse_mutex is released.
+* Finds the pending turn for the disconnected stream and finalizes it once.
+* Must NOT hold g_sse_mutex when called; acquires g_pending_mutex.
+*/
+static void Conversation_API_On_SSE_Detach(
+Seobeo_SSE_Stream *p_stream,
+void              *ctx)
+{
+(void)ctx;
+pthread_mutex_lock(&g_pending_mutex);
+for (Pending_Turn *p_turn = g_pending_turns;
+p_turn;
+p_turn = p_turn->p_next)
+{
+if (p_turn->p_stream == p_stream && !p_turn->finalized)
+{
+p_turn->aborted = TRUE;
+snprintf(p_turn->error_message, sizeof(p_turn->error_message),
+"Client disconnected");
+Conversation_API_Finalize_Pending(p_turn);
+break;
+}
+}
+pthread_mutex_unlock(&g_pending_mutex);
+}
 static void Conversation_API_Turn_Stream(
 Seobeo_Handle *p_handle,
 Seobeo_Request_Entry *p_request,
 Dowa_Arena *p_arena)
 {
-if (!Conversation_API_Is_Enabled())
+/* Resolve existing identity first so we can apply controls per-principal. */
+Auth_Principal principal;
+boolean found = FALSE;
+if (!Conversation_API_Resolve_Existing(p_request, &principal, p_arena, &found))
+{
+Conversation_API_Send_Stream_Error(
+p_handle, 500, "internal_error", "Session error");
+return;
+}
+if (!found)
+{
+Conversation_API_Send_Stream_Error(
+p_handle, 401, "auth_required", "Bootstrap session first");
+return;
+}
+if (principal.must_change_password)
+{
+Conversation_API_Send_Stream_Error(
+p_handle, 403, "password_change_required",
+"Password change required");
+return;
+}
+if (!Auth_API_Verify_CSRF(p_request, &principal))
+{
+Conversation_API_Send_Stream_Error(
+p_handle, 403, "csrf_invalid", "Same-origin and CSRF token required");
+return;
+}
+/* Guests require inference to be explicitly enabled; authenticated users
+* always proceed subject to the global bridge-ready check below. */
+if (principal.kind == AUTH_PRINCIPAL_GUEST &&
+!Conversation_API_Is_Inference_Ready())
 {
 Conversation_API_Send_Stream_Error(
 p_handle, 503, "inference_disabled", "Inference API is disabled");
 return;
 }
-if (!Conversation_API_Is_Same_Origin(p_request))
-{
-Conversation_API_Send_Stream_Error(
-p_handle, 403, "origin_rejected", "Same-origin request required");
-return;
-}
 if (!g_conversation_store || !Inference_Bridge_Is_Ready(g_inference_bridge))
 {
 Conversation_API_Send_Stream_Error(
 p_handle, 503, "inference_unavailable", "Inference runtime unavailable");
 return;
 }
+/* Map principal to owner — copy IDs before arena may expire (req 8) */
+Conversation_Owner owner;
+Conversation_API_Owner_From_Principal(&principal, &owner);
 const char *conversation_id =
 Conversation_API_Request_Value(p_request, ":conversation_id");
 Dowa_JSON_Entry *object = Conversation_API_Parse_Body(p_request, p_arena);
 char *prompt = object ? Dowa_JSON_Get_String(object, "prompt") : NULL;
 if (!conversation_id || !prompt || prompt[0] == '\0')
 p_handle, 413, "prompt_too_large", "Prompt exceeds 32 KiB");
 return;
 }
 if (!Conversation_API_Acquire_Turn_Slot())
 {
-Conversation_API_Send_Stream_Error(
+/* Temporary capacity limit — advise client to retry in 5 s. */
-p_handle, 429, "rate_limited", "Inference capacity exhausted");
+static const char rate_body[] =
+"{\"error\":{\"code\":\"rate_limited\","
+"\"message\":\"Inference capacity exhausted\"}}";
+char rate_header[512];
+snprintf(rate_header, sizeof(rate_header),
+"HTTP/1.1 429 Too Many Requests\r\n"
+"Content-Type: application/json; charset=utf-8\r\n"
+"Content-Length: %zu\r\n"
+"Retry-After: 5\r\n"
+"Connection: close\r\n"
+"\r\n",
+sizeof(rate_body) - 1);
+Seobeo_Handle_Queue(
+p_handle, (const uint8 *)rate_header, (uint32)strlen(rate_header));
+Seobeo_Handle_Queue(
+p_handle, (const uint8 *)rate_body,
+(uint32)(sizeof(rate_body) - 1));
+Seobeo_Handle_Flush(p_handle);
 return;
 }
 char request_id[37];
 if (!Conversation_Store_Generate_UUID(request_id))
 Conversation_API_Release_Turn_Slot();
 Conversation_API_Send_Stream_Error(
 p_handle, 500, "id_failed", "Unable to create request ID");
 return;
 }
-Conversation_Store_Result result = Conversation_Store_Begin_Turn(
-g_conversation_store,
+/* --- Guest quota reservation (before persisting turn) --- */
-conversation_id,
+boolean is_guest_reserved = FALSE;
-request_id,
+char    quota_guest_id[37] = {0};
-prompt);
+if (principal.kind == AUTH_PRINCIPAL_GUEST)
+{
+Auth_Store *p_auth_store = Auth_API_Get_Store();
+if (!p_auth_store)
+{
+Conversation_API_Release_Turn_Slot();
+Conversation_API_Send_Stream_Error(
+p_handle, 503, "store_unavailable", "Auth store unavailable");
+return;
+}
+int64 now_unix     = (int64)time(NULL);
+int64 window_start = conv__utc_window_start(now_unix);
+int64 resets_at    = window_start + 86400LL;
+Auth_Store_Guest_Quota_Result quota_result = Auth_Store_Guest_Reserve(
+p_auth_store,
+principal.guest_id,
+request_id,
+window_start,
+g_guest_request_output_tokens,
+g_guest_daily_turns,
+g_guest_daily_output_tokens,
+now_unix + 3600);
+if (quota_result == AUTH_STORE_GUEST_QUOTA_TURNS_EXHAUSTED ||
+quota_result == AUTH_STORE_GUEST_QUOTA_TOKENS_EXHAUSTED)
+{
+/* Fetch current usage for 429 payload. */
+Auth_Store_Guest_Usage usage;
+memset(&usage, 0, sizeof(usage));
+Auth_Store_Guest_Get_Usage(
+p_auth_store, principal.guest_id, window_start, &usage);
+int64 turns_remaining =
+g_guest_daily_turns - usage.turns_used;
+if (turns_remaining < 0) turns_remaining = 0;
+int64 tokens_remaining =
+g_guest_daily_output_tokens
+- usage.output_tokens_used
+- usage.output_tokens_reserved;
+if (tokens_remaining < 0) tokens_remaining = 0;
+const char *code = (quota_result == AUTH_STORE_GUEST_QUOTA_TURNS_EXHAUSTED)
+? "guest_quota_turns_exhausted"
+: "guest_quota_tokens_exhausted";
+const char *message = (quota_result == AUTH_STORE_GUEST_QUOTA_TURNS_EXHAUSTED)
+? "Daily turn limit reached"
+: "Daily output token limit reached";
+char quota_body[1024];
+int qlen = snprintf(
+quota_body, sizeof(quota_body),
+"{\"error\":{\"code\":\"%s\",\"message\":\"%s\","
+"\"quota\":{\"turnsLimit\":%lld,\"turnsUsed\":%lld,"
+"\"turnsRemaining\":%lld,\"outputTokensLimit\":%lld,"
+"\"outputTokensUsed\":%lld,\"outputTokensReserved\":%lld,"
+"\"outputTokensRemaining\":%lld,\"resetsAt\":%lld}}}",
+code, message,
+(long long)g_guest_daily_turns,
+(long long)usage.turns_used,
+(long long)turns_remaining,
+(long long)g_guest_daily_output_tokens,
+(long long)usage.output_tokens_used,
+(long long)usage.output_tokens_reserved,
+(long long)tokens_remaining,
+(long long)resets_at);
+if (qlen <= 0 || (size_t)qlen >= sizeof(quota_body))
+{
+Conversation_API_Release_Turn_Slot();
+Conversation_API_Send_Stream_Error(
+p_handle, 429, code, message);
+return;
+}
+char header[512];
+Seobeo_Web_Header_Generate(header, 429,
+"application/json; charset=utf-8", qlen);
+Seobeo_Handle_Queue(
+p_handle, (const uint8 *)header, (uint32)strlen(header));
+Seobeo_Handle_Queue(
+p_handle, (const uint8 *)quota_body, (uint32)qlen);
+Seobeo_Handle_Flush(p_handle);
+Conversation_API_Release_Turn_Slot();
+return;
+}
+if (quota_result != AUTH_STORE_GUEST_QUOTA_OK)
+{
+Conversation_API_Release_Turn_Slot();
+Conversation_API_Send_Stream_Error(
+p_handle, 500, "quota_error", "Unable to check guest quota");
+return;
+}
+is_guest_reserved = TRUE;
+snprintf(quota_guest_id, sizeof(quota_guest_id), "%s",
+principal.guest_id);
+}
+Conversation_Store_Result result = Conversation_Store_Begin_Turn_Owned(
+g_conversation_store, conversation_id, &owner, request_id, prompt);
 if (result == CONVERSATION_STORE_NOT_FOUND)
 {
+if (is_guest_reserved)
+Auth_Store_Guest_Release(Auth_API_Get_Store(), request_id);
 Conversation_API_Release_Turn_Slot();
 Conversation_API_Send_Stream_Error(
 p_handle, 404, "not_found", "Conversation not found");
 return;
 }
 if (result == CONVERSATION_STORE_CONFLICT)
 {
+if (is_guest_reserved)
+Auth_Store_Guest_Release(Auth_API_Get_Store(), request_id);
 Conversation_API_Release_Turn_Slot();
 Conversation_API_Send_Stream_Error(
 p_handle, 409, "turn_in_progress", "Conversation already has an active turn");
 return;
 }
 if (result != CONVERSATION_STORE_OK)
 {
+if (is_guest_reserved)
+Auth_Store_Guest_Release(Auth_API_Get_Store(), request_id);
 Conversation_API_Release_Turn_Slot();
 Conversation_API_Send_Stream_Error(
 p_handle, 500, "turn_failed", "Unable to persist turn");
 return;
 }
 Seobeo_SSE_Stream *p_stream = Seobeo_SSE_Server_Attach(
 p_handle,
 "/api/conversations/turns");
 if (!p_stream || !Seobeo_SSE_Retain(p_stream))
 {
+if (is_guest_reserved)
+Auth_Store_Guest_Release(Auth_API_Get_Store(), request_id);
 Conversation_API_Release_Turn_Slot();
 Conversation_Store_Fail_Turn(
 g_conversation_store,
 conversation_id,
 request_id,
 }
 Pending_Turn *p_turn = calloc(1, sizeof(*p_turn));
 if (!p_turn)
 {
+if (is_guest_reserved)
+Auth_Store_Guest_Release(Auth_API_Get_Store(), request_id);
 Conversation_API_Release_Turn_Slot();
 Conversation_Store_Fail_Turn(
 g_conversation_store,
 conversation_id,
 request_id,
 snprintf(
 p_turn->conversation_id,
 sizeof(p_turn->conversation_id),
 "%s",
 conversation_id);
+/* Copy owner and quota fields before arena expires (req 8) */
+p_turn->owner              = owner;
+p_turn->is_guest_reserved  = is_guest_reserved;
+p_turn->reserved_output_tokens =
+is_guest_reserved ? g_guest_request_output_tokens : 0;
+snprintf(p_turn->guest_id, sizeof(p_turn->guest_id), "%s", quota_guest_id);
 p_turn->p_stream = p_stream;
+/* Register detach callback so client disconnect triggers finalization. */
+Seobeo_SSE_Set_Detach_Callback(p_stream, Conversation_API_On_SSE_Detach, NULL);
 pthread_mutex_lock(&g_pending_mutex);
 p_turn->p_next = g_pending_turns;
 g_pending_turns = p_turn;
 pthread_mutex_unlock(&g_pending_mutex);
 }
 pthread_mutex_unlock(&g_pending_mutex);
 }
 }
-boolean Conversation_API_Init(const char *database_path)
+boolean Conversation_API_Init(
+const char                          *database_path,
+const Conversation_API_Guest_Policy *p_policy)
 {
 if (g_conversation_store)
 return TRUE;
-const char *allow_anonymous = getenv(
-"MRJUNEJUNE_ALLOW_ANONYMOUS_INFERENCE");
+if (p_policy)
-g_anonymous_inference_enabled =
+{
-allow_anonymous &&
+/* Validate policy ranges. */
-(strcmp(allow_anonymous, "1") == 0 ||
+if (p_policy->daily_turns < CONV_GUEST_DAILY_TURNS_MIN ||
-strcasecmp(allow_anonymous, "true") == 0);
+p_policy->daily_turns > CONV_GUEST_DAILY_TURNS_MAX)
+{
+Seobeo_Log(SEOBEO_ERROR,
+"[CONV] daily_turns must be %d..%d\n",
+CONV_GUEST_DAILY_TURNS_MIN, CONV_GUEST_DAILY_TURNS_MAX);
+return FALSE;
+}
+if (p_policy->daily_output_tokens < CONV_GUEST_DAILY_OUTPUT_TOKENS_MIN ||
+p_policy->daily_output_tokens > CONV_GUEST_DAILY_OUTPUT_TOKENS_MAX)
+{
+Seobeo_Log(SEOBEO_ERROR,
+"[CONV] daily_output_tokens must be %d..%d\n",
+CONV_GUEST_DAILY_OUTPUT_TOKENS_MIN,
+CONV_GUEST_DAILY_OUTPUT_TOKENS_MAX);
+return FALSE;
+}
+if (p_policy->request_output_tokens < CONV_GUEST_REQUEST_OUTPUT_TOKENS_MIN ||
+p_policy->request_output_tokens > p_policy->daily_output_tokens)
+{
+Seobeo_Log(SEOBEO_ERROR,
+"[CONV] request_output_tokens must be 1..%lld\n",
+(long long)p_policy->daily_output_tokens);
+return FALSE;
+}
+g_guest_inference_enabled     = p_policy->guest_inference_enabled;
+g_guest_daily_turns           = p_policy->daily_turns;
+g_guest_daily_output_tokens   = p_policy->daily_output_tokens;
+g_guest_request_output_tokens = p_policy->request_output_tokens;
+}
+else
+{
+/* No explicit policy: read from environment (backwards compat). */
+const char *allow_guest = getenv("MRJUNEJUNE_ALLOW_GUEST_INFERENCE");
+if (!allow_guest)
+{
+const char *allow_anon = getenv("MRJUNEJUNE_ALLOW_ANONYMOUS_INFERENCE");
+if (allow_anon)
+{
+Seobeo_Log(SEOBEO_WARNING,
+"[CONV] MRJUNEJUNE_ALLOW_ANONYMOUS_INFERENCE is deprecated;"
+" use MRJUNEJUNE_ALLOW_GUEST_INFERENCE\n");
+allow_guest = allow_anon;
+}
+}
+g_guest_inference_enabled =
+allow_guest &&
+(strcmp(allow_guest, "1") == 0 ||
+strcasecmp(allow_guest, "true") == 0);
+g_guest_request_output_tokens =
+g_guest_daily_output_tokens < CONV_GUEST_REQUEST_OUTPUT_TOKENS_DEFAULT
+? g_guest_daily_output_tokens
+: CONV_GUEST_REQUEST_OUTPUT_TOKENS_DEFAULT;
+}
 g_conversation_store = Conversation_Store_Create(database_path);
 return g_conversation_store != NULL;
 }
 boolean Conversation_API_Enable_Inference(
 return FALSE;
 }
 return TRUE;
 }
+/* Guest-to-user transfer hook registered with Auth_API on init */
+static boolean Conversation_API_Guest_Transfer_Hook(
+const char *guest_id,
+const char *user_id,
+void *context)
+{
+(void)context;
+if (!g_conversation_store)
+return FALSE;
+/* Atomically transfer conversation ownership AND clear outstanding quota
+* reservations in one transaction (auth and conv tables share the same
+* SQLite file, so the write lock covers both). */
+return Conversation_Store_Transfer_Guest_To_User_Atomic(
+g_conversation_store, guest_id, user_id) == CONVERSATION_STORE_OK;
+}
 void Conversation_API_Register_Routes(void)
 {
+/* Wire guest-to-user transfer on login */
+Auth_API_Register_Guest_Transfer_Hook(
+Conversation_API_Guest_Transfer_Hook, NULL);
+/* Wire quota callback for the session endpoint. */
+Auth_API_Register_Guest_Quota_Cb(conv_guest_quota_cb);
 Seobeo_Router_Register(
 "GET", "/api/inference/health", Conversation_API_Health);
+Seobeo_Router_Register(
+"GET", "/api/conversations", Conversation_API_List);
 Seobeo_Router_Register("POST", "/api/conversations", Conversation_API_Create);
+/* Body-based claim: ID stays in request body, not in URL or logs. */
+Seobeo_Router_Register(
+"POST", "/api/conversations/claim", Conversation_API_Claim_Body);
 Seobeo_Router_Register(
 "GET", "/api/conversations/:conversation_id", Conversation_API_Get);
 Seobeo_Router_Register(
 "PATCH", "/api/conversations/:conversation_id", Conversation_API_Update);
 Seobeo_Router_Register(
 pthread_mutex_lock(&g_pending_mutex);
 while (g_pending_turns)
 {
 Pending_Turn *p_turn = g_pending_turns;
 g_pending_turns = p_turn->p_next;
+/* Release guest quota reservation on server shutdown (keep turn charge). */
+if (p_turn->is_guest_reserved)
+{
+Auth_Store *p_auth_store = Auth_API_Get_Store();
+if (p_auth_store)
+Auth_Store_Guest_Release(p_auth_store, p_turn->request_id);
+}
 Conversation_Store_Fail_Turn(
 g_conversation_store,
 p_turn->conversation_id,
 p_turn->request_id,
 "Server shutdown",
 Conversation_API_Release_Turn_Slot();
 }
 pthread_mutex_unlock(&g_pending_mutex);
 Conversation_Store_Destroy(g_conversation_store);
 g_conversation_store = NULL;
-g_anonymous_inference_enabled = FALSE;
+g_guest_inference_enabled       = FALSE;
-}
+g_guest_daily_turns             = CONV_GUEST_DAILY_TURNS_DEFAULT;
+g_guest_daily_output_tokens     = CONV_GUEST_DAILY_OUTPUT_TOKENS_DEFAULT;
+g_guest_request_output_tokens   = CONV_GUEST_REQUEST_OUTPUT_TOKENS_DEFAULT;
+}

Mercurial

comparison mrjunejune/conversation_api.c @ 264:04fee26ecce0