diff options
| author | tv <tv@krebsco.de> | 2026-11-07 22:35:21 +0100 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-07 22:35:21 +0100 |
| commit | a3e936154e07ba3b95157d26ffeae9364f3d5cef (patch) | |
| tree | 771a46e192e9cee20833cc61c9e7e6dad239baba /docs/access.md | |
| parent | 02e06975d02bd8f02d811b4dd1d45ecad2374861 (diff) | |
access: logouts apart from users' entries
_continuum/logouts/<name> holds when a user's tokens were last revoked,
written by the user itself or by one who may manage users, so users'
entries can be signed by their managers alone.
Auth plan M7.
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/docs/access.md b/docs/access.md index 3818b04..682b22b 100644 --- a/docs/access.md +++ b/docs/access.md @@ -96,7 +96,7 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store then the user logs in again. A refreshed token may say less (`limit`), never more. * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens, by the user (`POST /auth/logout`) or by one who may manage users (`DELETE - /admin/users/{name}/tokens`), which sets `tokensNotBefore` in its entry: tokens issued + /admin/users/{name}/tokens`), which sets `_continuum/logouts/<name>`: tokens issued before aren't taken any more. A token of a node forgotten by the swarm isn't taken either. In a swarm without a registry, a token is taken until it expires. * **What it means to trust**: any member could sign a token for any user, as it could |