Internal user notes

[davidism]

Add comments to each user, possibly referencing a specific message for context.

[kms70847]

Who should have the ability to read these user notes? Who should have the ability to create/edit these user notes?

I'm imagining that the primary method of access here is through a user script that adds these notes to the box that appears when you click on a user's name in the chat room, possibly popping out to a larger panel if there's a lot of data.

But if we do that, then it's not clear to me how we'd restrict access to only trusted users. The source code of both the user script and the server would be accessible to anyone looking at this repository. That allows attackers to thwart simple forms of authentication like "tell the server your user id", since they have full control over their own client's behavior and can easily impersonate others.

[davidism]

As discussed in chat:

1. Generate a token: https://pythonhosted.org/itsdangerous/
2. If the userscript can't find the token, ask the user to enter one
3. Requests send this token as a header
4. Server checks if the token is valid