diff options
| author | tv <tv@krebsco.de> | 2026-11-08 09:41:05 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 14:28:56 +0100 |
| commit | 4ecb4ee5c0a49fc6d78ae06e21f6bb1571e290cb (patch) | |
| tree | d7e6858f48b654070b2ffd7650c7b6313c290cdd /docs/openapi.yaml | |
| parent | b08c0bfd3ffcfd39ef2689882fafafbc31f16ffd (diff) | |
remake: replay from the quarantine where the user may write
POST /admin/quarantine/{id}/replay needs write on _continuum, which
never covers user data, and replayed every path of the entry as the
user who asked: every node refused the user data in it. It now
replays only the paths the user may write and keeps the rest in the
entry (left), for one who may; 403 if the user may write none.
Review finding 3 (quarantine replays).
Diffstat (limited to 'docs/openapi.yaml')
| -rw-r--r-- | docs/openapi.yaml | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/docs/openapi.yaml b/docs/openapi.yaml index d3715b1..960ab14 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -1705,8 +1705,9 @@ paths: summary: Replay quarantined writes description: | Writes them into the current epoch at their old paths, as fresh writes (they - win over what is there), and removes the entry. If none can be written, the - entry stays. + win over what is there), and removes the entry. Only paths the user may write + (every node judges the change by them): the rest stay in the entry (`left`), for + one who may. If none can be written, the entry stays. responses: '200': description: Replayed. @@ -1714,14 +1715,23 @@ paths: application/json: schema: type: object - required: [replayed, failed] + required: [replayed, failed, left] properties: replayed: type: integer failed: type: integer + left: + type: integer + description: Paths the user may not write, left in the entry. '401': $ref: '#/components/responses/Unauthorized' + '403': + description: The user may write none of its paths. + content: + application/json: + schema: + $ref: '#/components/schemas/Error' '404': $ref: '#/components/responses/Error' '409': |