diff options
| author | tv <tv@krebsco.de> | 2026-11-09 04:46:19 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-09 05:48:17 +0100 |
| commit | 98a9180e39742725a61fb1966e342d7d212beee9 (patch) | |
| tree | cc4b8b5b8a1f022a00e5b46e2f849a3edc72301d /src/access | |
| parent | 97a69e09021244e994602ac5038b4bd7bc16ba78 (diff) | |
access: what a node holds alone by `_continuum/local/<node ID>/<name>`
Setting a node's log filter took `write` on `_continuum`, all of the protocol data:
whoever could change one node's logging could change the swarm's members, remakes and
users too. Now what a node holds alone has paths of its own for capabilities, under
`_continuum/local/<node ID>/`: `log` (`/admin/log`), `config` (`/admin/config`) and
`debug` (`/debug`, always `write`), `read` to look and `write` to act
(`api::access::needed`, which takes the node's ID). So `_continuum/local/<node ID>` is
everything on one node, `_continuum/local/*/log` the log filter on every node, and
holders of `_continuum` keep it all.
Nothing is stored there: the store refuses writes under `_continuum/local`, and the
rules refuse a change touching it, as for epoch metadata. The quarantine stays with
`_continuum`: its entries are everyone's writes, which a node-local capability
mustn't show.
Diffstat (limited to 'src/access')
| -rw-r--r-- | src/access/rules.rs | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/access/rules.rs b/src/access/rules.rs index d8162a6..d120961 100644 --- a/src/access/rules.rs +++ b/src/access/rules.rs @@ -265,6 +265,8 @@ pub(crate) fn judge_reading( } // Written by a root only. (Some(meta::EPOCHS | meta::SWARM), _) => false, + // Never stored: named for capabilities only (`api::access::needed`). + (Some(meta::LOCAL), _) => false, // Logging out: a user revokes its own tokens (`POST /auth/logout`); one who // manages users, anyone's (`DELETE /admin/users/{name}/tokens`). (Some(meta::LOGOUTS), Some(owner)) => { |