signatures: verified changes

GET /admin/changes shows whether a signature by its node vouches for
each change.

Auth plan M5.

5 files changed, 32 insertions, 16 deletions

diff --git a/docs/api.md b/docs/api.md
index a02d3d5..89da7ba 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -237,7 +237,8 @@ signs it, so a member could name another. In a swarm without a registry, user na
 are each node's own (`--htpasswd`, or its proxy's): `alice` on two nodes is one person
 only where their operators make it so, which nothing checks.
 `GET /admin/changes` lists them,
-newest first, with the paths each touched; `GET /admin/changes/settings` those that
+newest first, with the paths each touched and whether a signature by its node vouches
+for it (`verified`, Signed changes); `GET /admin/changes/settings` those that
 touched what is at `settings`.
 Every node holds every change, so user names are known to the whole swarm, and so is
 who wrote what, until a remake drops the history ([`remakes.md`](remakes.md)).
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 7aba2fe..d067f4f 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -601,7 +601,7 @@ paths:
                     type: array
                     items:
                       type: object
-                      required: [hash, at, paths]
+                      required: [hash, at, verified, paths]
                       properties:
                         hash:
                           type: string
@@ -611,6 +611,9 @@ paths:
                           type: string
                         user:
                           type: string
+                        verified:
+                          type: boolean
+                          description: A signature by its node vouches for it, as far as this node has the signatures (`api.md`, Signed changes).
                         paths:
                           type: array
                           items:
@@ -652,7 +655,7 @@ paths:
                     type: array
                     items:
                       type: object
-                      required: [hash, at, paths]
+                      required: [hash, at, verified, paths]
                       properties:
                         hash:
                           type: string
@@ -662,6 +665,9 @@ paths:
                           type: string
                         user:
                           type: string
+                        verified:
+                          type: boolean
+                          description: A signature by its node vouches for it, as far as this node has the signatures (`api.md`, Signed changes).
                         paths:
                           type: array
                           items:
diff --git a/docs/trust.md b/docs/trust.md
index 8b0f72a..70369e2 100644
--- a/docs/trust.md
+++ b/docs/trust.md
@@ -61,8 +61,12 @@ node acts on what the document says:
 
 * **User data**: any member can write or delete any path.
 * **Who wrote what** (`GET /admin/changes`): each change names its node and API user
-  as the writing node says; nothing signs that, so a member can name another. The
-  names of the users who write are in the document, and so on every node.
+  as the writing node says. Nodes sign their changes ([`api.md`](api.md), Signed
+  changes), so a change a signature vouches for shows `verified`: its node made it.
+  One that shows unverified may yet be vouched for by its node's next signature, or
+  may be another member's claiming that node; nothing is refused for it yet. The user a
+  change names is its node's claim, signed or not. The names of the users who write
+  are in the document, and so on every node.
 * **The member registry**: each node writes its own entry, but nothing stops a member
   from writing others'. The registry decides the topology and, through the alive
   stamps, the electorate of a remake.
diff --git a/src/api/changes.rs b/src/api/changes.rs
index 419f5ed..c3a847d 100644
--- a/src/api/changes.rs
+++ b/src/api/changes.rs
@@ -2,8 +2,9 @@
 //! or of what is at a path (as `/store/<path>` names it). Every change names the node that
 //! committed it (its author) and, for a write through the API, the user who wrote it (in
 //! its message, `User:`), with when (its writer's clock) and the store paths it touched
-//! (`document::replica::Writer`). Every node holds every change, so any node answers
-//! for the whole swarm, as far as it has synced.
+//! (`document::replica::Writer`), and whether a signature by that node vouches for it
+//! (`document::signatures`). Every node holds every change, so any node answers for the
+//! whole swarm, as far as it has synced.
 
 use axum::{
     Json,
@@ -39,6 +40,9 @@ pub(crate) struct ChangeReport {
     /// The user it was written for through the API, if any.
     #[serde(skip_serializing_if = "Option::is_none")]
     user: Option<String>,
+    /// Whether a signature by its node vouches for it, as far as this node has the
+    /// signatures (`document::signatures`).
+    verified: bool,
     /// The store paths it touched (a list's items by index).
     paths: Vec<String>,
 }
@@ -82,18 +86,19 @@ async fn report(
         return Err(StatusCode::SERVICE_UNAVAILABLE);
     }
     let limit = query.limit.unwrap_or(100).clamp(1, MAX_LIMIT);
-    Ok(Json(
-        state
-            .render(
-                move |doc| changes(doc, limit, path.as_deref()),
-                |report| report,
-            )
-            .await,
-    ))
+    let doc = std::sync::Arc::clone(&state.doc);
+    let report = tokio::task::spawn_blocking(move || {
+        let replica = doc.blocking_read();
+        changes(&replica.doc, &replica.signatures, limit, path.as_deref())
+    })
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Ok(Json(report))
 }
 
 fn changes(
     doc: &crate::document::Document,
+    signatures: &crate::document::signatures::Signatures,
     limit: usize,
     path: Option<&[String]>,
 ) -> ChangesReport {
@@ -128,6 +133,7 @@ fn changes(
                 .as_deref()
                 .and_then(crate::document::replica::user_of)
                 .map(str::to_owned),
+            verified: signatures.verified(&meta.actor, meta.seq),
             paths: paths.iter().map(|path| path.join("/")).collect(),
         });
     }
diff --git a/src/document/signatures.rs b/src/document/signatures.rs
index a6a30f7..d347e10 100644
--- a/src/document/signatures.rs
+++ b/src/document/signatures.rs
@@ -341,7 +341,6 @@ impl Signatures {
     }
 
     /// Whether a signature vouches for `actor`'s change `seq`.
-    #[cfg_attr(not(test), allow(dead_code))]
     pub(crate) fn verified(&self, actor: &super::ActorId, seq: u64) -> bool {
         self.latest
             .get(actor)