diff options
| author | tv <tv@krebsco.de> | 2026-11-09 17:35:12 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-09 19:10:26 +0100 |
| commit | 5f7e29cec4333715346b4bf3195633db93449d9d (patch) | |
| tree | 3574cb120e01c4272452666aeb518ac0d24e8e90 /docs/access.md | |
| parent | 3bf93bc192bf362b58b2161ac05da0bb8323bf43 (diff) | |
auth: whoami says what the request may do
`GET /auth/whoami` lists the user's capabilities (`caps`) and its token's `limit`, if
any, side by side; what the request may do is what both give, as endpoints decide it.
It says so now (`may`): the capabilities, or with a limit each capability met with each
of the limit's (`Capability::meet`): at the deeper of the two paths, a `*` of one
taking the other's key there, with the rights both name; nothing where the paths part,
no right is shared, or the path is protocol data one of them doesn't name.
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/docs/access.md b/docs/access.md index 1397656..571034e 100644 --- a/docs/access.md +++ b/docs/access.md @@ -177,8 +177,10 @@ forgets it. The login page token pasted, from a login by key, say; the dashboard renews it while open ([`dashboard.md`](dashboard.md)). -`GET /auth/whoami` says the swarm, who a request's user is, how it proved it, and what -it may do. +`GET /auth/whoami` says the swarm, who a request's user is, how it proved it, its +capabilities (`caps`), and what this request may do (`may`): those, or with a token +that says less (`limit`), what both give, each capability's path the deeper of the two +and its rights those both name. Pages of other origins, the dashboards of other members, may call a node with a token: its own links (`/admin/dashboard/links/own`, and its events) and messages |