users: a user manages its own keys

Only a user who may manage users could change a user's keys: a user
couldn't add a new laptop's key, or remove a lost one.

A user now manages its own keys, whatever else it may do:

* GET /auth/keys: its keys, its entry, and the envelope holding it
  under a strict policy (`signed`), to sign against.
* PUT /auth/keys/{id} with an authorized_keys line, DELETE
  /auth/keys/{id}: one change, as the user. The rules take a write of
  _continuum/users/<name>/keys/… from the user it names.
* Under a strict policy, the user signs its entry with only its keys
  changed, with a key it holds already (envelope::check takes that from
  the user itself), PUT to its own entry even without write on the
  registry; continuum-signed key-add and key-remove do so.

1 files changed, 10 insertions, 1 deletions

diff --git a/src/api/store.rs b/src/api/store.rs
index 81d0046..16dd966 100644
--- a/src/api/store.rs
+++ b/src/api/store.rs
@@ -464,7 +464,16 @@ pub(crate) async fn put_store_entry(
         return Err(StatusCode::SERVICE_UNAVAILABLE.into());
     }
 
-    let path = parse_write_path(&state, &user, &access, &key, "PUT")?;
+    // A user's own entry, signed by it: its keys are its own to change, whatever else it
+    // may do (`envelope::check` takes nothing else changed).
+    let own_entry = media_type(&headers) == SIGNED
+        && parse_key_path(&key)
+            .is_ok_and(|path| path == crate::access::registry::user_path(&user.0));
+    let path = if own_entry {
+        crate::access::registry::user_path(&user.0)
+    } else {
+        parse_write_path(&state, &user, &access, &key, "PUT")?
+    };
     let sign = Sign::Write {
         path: path.clone(),
         asked: query.signed,