access: keeping the swarm manageable

A write that would leave its own writer unable to manage users
(deleting, disabling or narrowing its entry, removing the registry) is
refused; --protocol-writers can set a registry right that nobody may
manage any more.

Auth plan M1.

1 files changed, 8 insertions, 1 deletions

diff --git a/src/api/access.rs b/src/api/access.rs
index 8a3e630..ade6542 100644
--- a/src/api/access.rs
+++ b/src/api/access.rs
@@ -9,7 +9,7 @@ use axum::{
     response::Response,
 };
 use serde_json::Value as JsonValue;
-use tracing::debug;
+use tracing::{debug, warn};
 
 use super::auth::AuthenticatedUser;
 use super::error_response;
@@ -194,6 +194,13 @@ pub(crate) async fn authorize(
         let replica = state.doc.read().await;
         if !registry::exists(&replica.doc) {
             Access::Everything
+        } else if state.protocol_writers.contains(&user)
+            && registry::managers(&replica.doc).is_empty()
+        {
+            // Nobody may manage users any more (two removals at once, merged; or an
+            // entry damaged): this node's protocol writers may set it right.
+            warn!(user = %user, "The user registry has nobody who may manage users; a protocol writer may do everything until it has");
+            Access::Everything
         } else {
             match registry::user(&replica.doc, &user) {
                 Some(entry) => Access::Caps(entry.caps()),