api: a stream opened with a token ends with it

A token was checked when a request came, and a stream answered to it (the dashboard's
events, a subscription's links and messages, the store's streams) then went on for as
long as the client kept it open: past the token's expiry, past its user's tokens being
revoked, its user disabled or removed, its session ended.

Now a middleware inside `login::bearer` (`login::streams_end`) ends a streaming answer
(`text/event-stream`, `application/x-ndjson`) to a request with a token at the token's
deadline, its expiry, or as soon as the document no longer takes it
(`token::still_taken`, the checks `verify` makes of the document, now its own
function): looked at when a change touches protocol data (the root, a switch, among
it), and when a session ends on the node itself in a swarm without a registry
(`AppState::session_ended`). No polling: a timer for the expiry, and the changes as
they come. The client reconnects with the token it has then; a refreshed token is a
new one, so a stream lasts a token's lifetime at most (12 hours by default).

`futures` is a dependency of every build now (for `take_until`), not only of libp2p's
and Tor's.

1 files changed, 4 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 988d619..1385950 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -128,7 +128,10 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store
   "log out"): `_continuum/sessions/<name>/<session>`, until when the session would have
   lasted, written by the user or one who manages users; a remake's snapshot leaves it
   out once that has passed. Without a registry, the node ending it refuses the
-  session's tokens itself, until it restarts; others take them until they expire. A token of a node banned or forgotten by the swarm isn't
+  session's tokens itself, until it restarts; others take them until they expire.
+  A stream opened with a token (server-sent events, the store's streams) ends with it:
+  when it expires, or once the node holds a change that revokes it (looked at as
+  protocol data changes), a session's end on the node itself included. A token of a node banned or forgotten by the swarm isn't
   taken either. In a swarm without a registry, a token is taken until it expires. The
   user a logout names is its node's word, and a logout no deciding path, even under a
   strict policy: any member could log any user out. It ends sessions; and a value there