access: the policy enforced

_continuum/access/policy ({"version": 1}) has every node screen every
change it receives, on every path changes come in. A policy a node
doesn't know stops its writes through the API. GET /admin/refused.

Auth plan M6.

1 files changed, 2 insertions, 0 deletions

diff --git a/src/api/mod.rs b/src/api/mod.rs
index 38868e2..a12e219 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -62,6 +62,7 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) ->
         .route("/admin/stats", get(stats::get_stats))
         .route("/admin/document", get(document::get_document))
         .route("/admin/changes", get(changes::get_changes))
+        .route("/admin/refused", get(changes::get_refused))
         .route("/admin/changes/{*key}", get(changes::get_changes_at))
         .route("/admin/config", get(config::get_config))
         .route("/auth/login", axum::routing::post(login::login))
@@ -311,6 +312,7 @@ pub(crate) fn store_status(error: StoreError, context: &str) -> ApiError {
         | StoreError::NotCastable { .. } => StatusCode::CONFLICT,
         StoreError::NotFound | StoreError::UnknownHeads => StatusCode::NOT_FOUND,
         StoreError::Rejoining => StatusCode::SERVICE_UNAVAILABLE,
+        StoreError::UnknownPolicy(_) => StatusCode::CONFLICT,
         other => {
             error!(error = %format!("{other:#}"), "{context}");
             return StatusCode::INTERNAL_SERVER_ERROR.into();