access: authorization at the API

Every request is judged by the registry the node holds: store reads
pruned to what the user may read, writes refused where it may not,
admin endpoints by protocol capabilities. Without a registry, as
before (--protocol-writers for protocol data).

Auth plan M1.

1 files changed, 8 insertions, 3 deletions

diff --git a/docs/api.md b/docs/api.md
index cdc722e..5486378 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -33,7 +33,11 @@ curl -u alice:secret -X POST 'localhost:3000/store/stats/visits?increment=1'  #
   asks. Numbers in JSON are stored as integers where they fit, as floats otherwise.
 * Every request needs a user from the node's `--htpasswd` (basic authentication), or
   named by a reverse proxy in front that authenticated it (`--user-header`;
-  [`operations.md`](operations.md), Behind a reverse proxy). Users are all alike: each can read and write everything but protocol data (below).
+  [`operations.md`](operations.md), Behind a reverse proxy). What each may do, the swarm's user
+  registry says, by path ([`access.md`](access.md)): `403` where it doesn't let the user, and
+  of a part it may only partly read, a read shows the keys on the way to what it may.
+  In a swarm without a registry, users are all alike: each can read and write
+  everything but protocol data (below).
 * A key with `/` in it, or an empty key, can be written inside a value at its parent,
   but not named in a path: read it through the parent.
 
@@ -238,8 +242,9 @@ who wrote what, until a remake drops the history ([`remakes.md`](remakes.md)).
 
 `_continuum` holds what the nodes coordinate through: the swarm ID, the member registry,
 remakes and votes ([`architecture.md`](architecture.md), The document). It is part of the store and shows
-in `GET /store`, but isn't application data: only users in `--protocol-writers` may
-write it, for repairs. Keep application data out of it, and leave it out when reading
+in `GET /store`, but isn't application data: only users given it may write it
+([`access.md`](access.md); in a swarm without a user registry, those in `--protocol-writers`), for
+repairs. Keep application data out of it, and leave it out when reading
 the whole store if it's in the way.
 
 ## Large stores