access: tokens

ct1 tokens: who, how they logged in, a session, when they expire, and
optionally a narrower limit; signed by the issuing node's key and taken
by every member (a node ID is its key). Revocation by the registry as
it stands when a request comes.

Auth plan M2.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/access/registry.rs b/src/access/registry.rs
index 9eafc82..e0cbe47 100644
--- a/src/access/registry.rs
+++ b/src/access/registry.rs
@@ -63,6 +63,9 @@ pub(crate) struct User {
     pub(crate) by: String,
     pub(crate) caps: BTreeMap<String, Capability>,
     pub(crate) disabled: bool,
+    /// Tokens issued before (Unix ms) are no longer taken (`token::verify`): how all
+    /// of a user's tokens are revoked at once.
+    pub(crate) tokens_not_before: u64,
 }
 
 impl User {
@@ -90,6 +93,11 @@ impl User {
             disabled: value
                 .get("disabled")
                 .is_some_and(|disabled| disabled != &JsonValue::Bool(false)),
+            // A damaged one revokes every token.
+            tokens_not_before: match value.get("tokensNotBefore") {
+                None => 0,
+                Some(at) => at.as_u64().unwrap_or(u64::MAX),
+            },
         }
     }