users: a user manages its own keys

Only a user who may manage users could change a user's keys: a user
couldn't add a new laptop's key, or remove a lost one.

A user now manages its own keys, whatever else it may do:

* GET /auth/keys: its keys, its entry, and the envelope holding it
  under a strict policy (`signed`), to sign against.
* PUT /auth/keys/{id} with an authorized_keys line, DELETE
  /auth/keys/{id}: one change, as the user. The rules take a write of
  _continuum/users/<name>/keys/… from the user it names.
* Under a strict policy, the user signs its entry with only its keys
  changed, with a key it holds already (envelope::check takes that from
  the user itself), PUT to its own entry even without write on the
  registry; continuum-signed key-add and key-remove do so.

1 files changed, 5 insertions, 0 deletions

diff --git a/src/api/mod.rs b/src/api/mod.rs
index 0e7fc21..43d3c20 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -74,6 +74,11 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) ->
         )
         .route("/auth/logout", axum::routing::post(login::logout))
         .route("/auth/whoami", get(login::whoami))
+        .route("/auth/keys", get(users::own_keys))
+        .route(
+            "/auth/keys/{id}",
+            axum::routing::put(users::put_own_key).delete(users::delete_own_key),
+        )
         .route("/admin/users", get(users::list).post(users::add_several))
         .route("/admin/users/{name}/tokens", delete(users::revoke_tokens))
         .route(