access: values signed by their users

access::envelope: cv1.<payload>.<signature>, the payload naming the
path, value, user, time and the envelope it replaces (prev), signed
with one of the user's SSH keys from the registry (keys). Checked
against the registry as the writer saw it.

Auth plan M7.

1 files changed, 16 insertions, 0 deletions

diff --git a/src/access/registry.rs b/src/access/registry.rs
index 5899bdd..eb7919c 100644
--- a/src/access/registry.rs
+++ b/src/access/registry.rs
@@ -69,6 +69,10 @@ pub(crate) struct User {
     /// Tokens issued before (Unix ms) are no longer taken (`token::verify`): how all
     /// of a user's tokens are revoked at once.
     pub(crate) tokens_not_before: u64,
+    /// Its keys (`keys/<id>`, `authorized_keys` lines, `access::sshsig`): what it signs
+    /// values with (`access::envelope`) and logs in with. One that doesn't read is left
+    /// out.
+    pub(crate) keys: BTreeMap<String, super::sshsig::PublicKey>,
 }
 
 impl User {
@@ -101,6 +105,18 @@ impl User {
                 None => 0,
                 Some(at) => at.as_u64().unwrap_or(u64::MAX),
             },
+            keys: value
+                .get("keys")
+                .and_then(JsonValue::as_object)
+                .map(|keys| {
+                    keys.iter()
+                        .filter_map(|(id, line)| {
+                            let key = super::sshsig::PublicKey::parse(line.as_str()?).ok()?;
+                            Some((id.clone(), key))
+                        })
+                        .collect()
+                })
+                .unwrap_or_default(),
         }
     }