remake: a strict remake makes the registry, policy and bans anew

Review 2, N12: a strict remake kept only the values at the signed
places its manifest names, and copied what holds them as it was. A
member that replaced _continuum/users by a scalar before the turn left
the strict epoch without a registry, where any member may do anything.

The holders of the registry, `_continuum/access` and the bans are now
made anew as maps, with only what the manifest keeps copied into them;
and a manifest keeping no user is refused (at proposal, vote and build
alike), as a strict swarm without one would trust every member.

1 files changed, 9 insertions, 0 deletions

diff --git a/src/access/strict.rs b/src/access/strict.rs
index f5051a8..0fa6577 100644
--- a/src/access/strict.rs
+++ b/src/access/strict.rs
@@ -140,6 +140,15 @@ pub(crate) fn read(text: &str) -> Result<Manifest, String> {
     if manifest.policy.get("values").and_then(JsonValue::as_str) != Some("signed") {
         return Err("its policy isn't strict (\"values\": \"signed\")".to_owned());
     }
+    // A strict swarm without a registry would let every member do anything.
+    let users = crate::access::registry::users_dir();
+    if !manifest
+        .keep
+        .iter()
+        .any(|kept| kept.path.len() == users.len() + 1 && kept.path.starts_with(&users))
+    {
+        return Err("it keeps no user".to_owned());
+    }
     Ok(manifest)
 }