api: signed values at the store

PUT with application/continuum-signed writes an envelope where values
are signed (403/409 saying why); reads open envelopes and name the
signer (x-continuum-signed-by), ?raw=true shows them. Under strict,
unsigned writes reaching a signed value and the users API are 409.

Auth plan M7.

1 files changed, 11 insertions, 1 deletions

diff --git a/src/api/users.rs b/src/api/users.rs
index 3b8174d..8972566 100644
--- a/src/api/users.rs
+++ b/src/api/users.rs
@@ -122,7 +122,7 @@ fn may_manage(state: &AppState, user: &str, access: &Access) -> Result<(), ApiEr
 
 /// A user's entry as the API shows it: as recorded, with its name.
 fn shown(doc: &impl crate::document::ReadDoc, name: &str) -> Option<JsonValue> {
-    let mut entry = store::read_path(doc, &registry::user_path(name)).ok()??;
+    let mut entry = store::read_plain(doc, &registry::user_path(name)).ok()??;
     if let Some(object) = entry.as_object_mut() {
         object.insert("name".to_owned(), json!(name));
     }
@@ -168,6 +168,16 @@ async fn change(
     let since = state.clock.now_millis().as_u64();
     state
         .mutate_doc_for(Some(user.to_owned()), Sign::Protocol, move |doc| {
+            if crate::access::policy::of(&*doc).strict() {
+                return Err(ApiError(
+                    StatusCode::CONFLICT,
+                    Some(
+                        "users sign their entries (strict policy): PUT each signed to \
+                         /store/_continuum/users/<name> (docs/access.md)"
+                            .to_owned(),
+                    ),
+                ));
+            }
             let before = Before::of(&*doc, &writer);
             f(doc, &by, since)?;
             registry_kept(&*doc, &registry::users_dir(), before, &writer)