access: signed values judged on receipt

Inspection gives each operation's kind; under strict every node
refuses, at a signed place, anything but an envelope that checks and
replaces the one there (deleting first as replacing does), anything
within one, and above one anything replacing what holds one.

Auth plan M7.

1 files changed, 19 insertions, 6 deletions

diff --git a/src/access/screen.rs b/src/access/screen.rs
index 507de1d..736e04a 100644
--- a/src/access/screen.rs
+++ b/src/access/screen.rs
@@ -4,8 +4,8 @@
 //!
 //! A change is judged at the heads its writer saw. Those of a batch aren't in the
 //! document yet, so one is judged at the changes of the document its batch ancestors
-//! build on: what rules read there (the members, the user registry, remake proposals)
-//! is what its writer saw, unless one of those ancestors changed it. So a change that
+//! build on: what rules read there (the members, the user registry, remake proposals,
+//! the policy, bans) is what its writer saw, unless one of those ancestors changed it. So a change that
 //! does (`relevant`) is applied before the next is judged: the rest go in at once.
 //!
 //! A change whose dependencies are neither in the document nor among those received
@@ -19,7 +19,7 @@ use std::collections::{BTreeSet, HashMap, HashSet};
 use anyhow::Result;
 
 use super::rules::{self, Refusal};
-use crate::document::inspect::{Inspector, Path};
+use crate::document::inspect::{Inspector, Op, Path};
 use crate::document::meta;
 use crate::document::replica::{Epoch, user_of};
 use crate::document::signatures::Signatures;
@@ -133,7 +133,11 @@ pub(crate) fn apply(
 
     let decoded: Vec<crate::document::ExpandedChange> =
         ready.iter().map(|change| change.decode()).collect();
-    let paths = Inspector::new(doc).paths(&decoded);
+    let ops: Vec<Vec<Op>> = Inspector::new(doc).ops(&decoded);
+    let paths: Vec<BTreeSet<Path>> = ops
+        .iter()
+        .map(|ops| ops.iter().map(|op| op.path.clone()).collect())
+        .collect();
     // Who made each: its author, or that of its actor's first change (in the document,
     // or among these).
     let mut authors: HashMap<crate::document::ActorId, String> = HashMap::new();
@@ -216,6 +220,7 @@ pub(crate) fn apply(
                 committer,
                 user: user.as_deref(),
                 paths: &paths[index],
+                ops: &ops[index],
             },
         );
         match judged {
@@ -285,13 +290,21 @@ pub(crate) fn apply_bytes(
 }
 
 /// Whether a change touching `paths` changes what rules read: the members, the user
-/// registry, remake records, the protocol data as a whole.
+/// registry, remake records, the policy and the rest of `_continuum/access`, bans, the
+/// protocol data as a whole.
 fn relevant(paths: &BTreeSet<Path>) -> bool {
     paths.iter().any(|path| match path.as_slice() {
         [] => true,
         [root, ..] if root != meta::ROOT => false,
         [_] => true,
-        [_, part, ..] => [meta::MEMBERS, meta::USERS, meta::REMAKES].contains(&part.as_str()),
+        [_, part, ..] => [
+            meta::MEMBERS,
+            meta::USERS,
+            meta::REMAKES,
+            meta::ACCESS,
+            meta::BANNED,
+        ]
+        .contains(&part.as_str()),
     })
 }