dashboard: what its user may read

The dashboard's document box is read through the store, as its user
may, and the page is told only of changes where its user may read.

Auth plan M1 (the dashboard).

2 files changed, 71 insertions, 4 deletions

diff --git a/docs/access.md b/docs/access.md
index cd11723..7a85c94 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -55,7 +55,8 @@ change to it counts on a node as soon as it has reached it.
 * **Protocol data** is in the store too, under `_continuum`: `read` and `write` on it
   as on any path.
 * **Looking at the node** (`/admin/stats`, `GET /peers`, the dashboard): any user with
-  a capability.
+  a capability. The dashboard's document box is read through the store, as the user
+  may; the page is told only of changes where its user may read.
 * **Remakes** (`/admin/remakes`): `read` on `_continuum/remakes` to look, `write` to
   propose or abort one. **Forgetting a peer** (`DELETE /peers/…`): `write` on
   `_continuum/forgotten`.
diff --git a/src/api/dashboard/mod.rs b/src/api/dashboard/mod.rs
index bea5493..b89955a 100644
--- a/src/api/dashboard/mod.rs
+++ b/src/api/dashboard/mod.rs
@@ -100,7 +100,8 @@ struct Hub {
     /// Each patch, to the clients connected.
     patches: broadcast::Sender<Arc<Published>>,
     /// Where the document changed since the last tick, to the clients connected:
-    /// `{"paths": [...]}`, or `{"all": true}` if too many or not known.
+    /// `{"paths": [...]}`, or `{"all": true}` if too many or not known. Shared by every page
+    /// open; each is told of the paths its user may read at least partly (`changed_for`).
     documents: broadcast::Sender<Arc<String>>,
     /// The messages exchanged since the last tick, one by one (`traffic::MessageLog`),
     /// to the clients connected: a JSON list.
@@ -672,7 +673,10 @@ async fn current_state(Extension(hub): Extension<Arc<Hub>>) -> Response {
 /// changed (`Hub::documents`, at most every tick), `messages` with the messages since
 /// the last tick (`Hub::messages`), and `offline` when the node stops, which ends the
 /// stream.
-async fn events(Extension(hub): Extension<Arc<Hub>>) -> impl IntoResponse {
+async fn events(
+    Extension(hub): Extension<Arc<Hub>>,
+    Extension(access): Extension<super::access::Access>,
+) -> impl IntoResponse {
     // Subscribed before the snapshot is read: no patch after it is missed.
     let mut patches = hub.patches.subscribe();
     let mut documents = hub.documents.subscribe();
@@ -696,7 +700,9 @@ async fn events(Extension(hub): Extension<Arc<Hub>>) -> impl IntoResponse {
             let received = match next {
                 Next::Patch(received) => received,
                 Next::Document(Ok(changed)) => {
-                    yield Ok(Event::default().event("document").data(changed.as_str()));
+                    if let Some(changed) = changed_for(&changed, &access) {
+                        yield Ok(Event::default().event("document").data(changed));
+                    }
                     continue;
                 }
                 Next::Document(Err(broadcast::error::RecvError::Lagged(_))) => {
@@ -756,6 +762,36 @@ fn snapshot_event(published: &Published) -> Event {
         .data(published.json())
 }
 
+/// A `document` event (`Hub::documents`) as the page of a user with `access` is told
+/// it: of the changed paths, those it may read at least partly (`access::Visible`), so
+/// that it isn't told where in the document others write what it may not read. None if
+/// none is left. A few prefix comparisons per path and capability, once a tick per
+/// page.
+fn changed_for(changed: &str, access: &super::access::Access) -> Option<String> {
+    use super::access::{Access, Visible};
+    if matches!(access, Access::Everything) {
+        return Some(changed.to_owned());
+    }
+    let mut parsed: JsonValue = serde_json::from_str(changed).ok()?;
+    let Some(paths) = parsed.get_mut("paths").and_then(JsonValue::as_array_mut) else {
+        // `{"all": true}`: the page reads again what it shows, as its user may.
+        return Some(changed.to_owned());
+    };
+    paths.retain(|path| {
+        let path: Vec<String> = path
+            .as_array()
+            .map(|segments| {
+                segments
+                    .iter()
+                    .filter_map(|segment| segment.as_str().map(str::to_owned))
+                    .collect()
+            })
+            .unwrap_or_default();
+        access.visible(&path) != Visible::Nothing
+    });
+    (!paths.is_empty()).then(|| parsed.to_string())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -803,6 +839,36 @@ mod tests {
     }
 
     #[test]
+    fn each_page_is_told_of_what_its_user_may_read() {
+        use super::super::access::Access;
+        use crate::access::{Capability, Caps};
+        let reader = Access::Caps(Caps::new(vec![Capability {
+            path: vec!["servers".to_owned(), "eu".to_owned()],
+            rights: ["read".to_owned()].into(),
+            by: String::new(),
+            since: 0,
+        }]));
+        let changed = json!({ "paths": [["servers", "eu", "a"], ["servers", "us"], ["servers"]] })
+            .to_string();
+        let told: JsonValue =
+            serde_json::from_str(&changed_for(&changed, &reader).unwrap()).unwrap();
+        assert_eq!(
+            told,
+            json!({ "paths": [["servers", "eu", "a"], ["servers"]] })
+        );
+        let elsewhere = json!({ "paths": [["accounts"]] }).to_string();
+        assert_eq!(changed_for(&elsewhere, &reader), None);
+        assert_eq!(
+            changed_for(r#"{"all":true}"#, &reader).as_deref(),
+            Some(r#"{"all":true}"#)
+        );
+        assert_eq!(
+            changed_for(&elsewhere, &Access::Everything),
+            Some(elsewhere.clone())
+        );
+    }
+
+    #[test]
     fn ages_alone_are_no_change() {
         let old =
             json!({ "uptimeSecs": 1, "peers": { "p": { "lastSeenSecsAgo": 3, "rttMs": 2 } } });