access: logouts apart from users' entries

_continuum/logouts/<name> holds when a user's tokens were last revoked,
written by the user itself or by one who may manage users, so users'
entries can be signed by their managers alone.

Auth plan M7.

1 files changed, 2 insertions, 7 deletions

diff --git a/src/access/rules.rs b/src/access/rules.rs
index c061893..4df0ba8 100644
--- a/src/access/rules.rs
+++ b/src/access/rules.rs
@@ -125,12 +125,7 @@ pub(crate) fn judge(doc: &Document, epoch: Epoch, change: &Change<'_>) -> Result
             // Written by a root only.
             (Some(meta::EPOCHS | meta::SWARM), _) => false,
             // Logging out: a user revokes its own tokens (`POST /auth/logout`).
-            (Some(meta::USERS), Some(owner))
-                if path.get(3).map(String::as_str) == Some("tokensNotBefore")
-                    && change.user == Some(owner) =>
-            {
-                true
-            }
+            (Some(meta::LOGOUTS), Some(owner)) => change.user == Some(owner) || user_may(path),
             (Some(meta::REMAKES), Some(id)) => match path.get(3).map(String::as_str) {
                 // Its coordinator's; or a record carried into a new epoch whole, by the
                 // node that coordinated it (`remake::switch`): its proposal written with it.
@@ -312,7 +307,7 @@ mod tests {
             &["_continuum/neighbours"]
         )));
         // Logging out: its own tokens only.
-        let tokens = "_continuum/users/bob/tokensNotBefore";
+        let tokens = "_continuum/logouts/bob";
         assert!(judged(&doc, "a", Some("bob"), &[tokens]).is_ok());
         assert!(refused(judged(&doc, "a", Some("alice"), &[tokens])));
     }