access: signed values judged on receipt

Inspection gives each operation's kind; under strict every node
refuses, at a signed place, anything but an envelope that checks and
replaces the one there (deleting first as replacing does), anything
within one, and above one anything replacing what holds one.

Auth plan M7.

1 files changed, 5 insertions, 1 deletions

diff --git a/src/api/store.rs b/src/api/store.rs
index b5baa23..e61a09d 100644
--- a/src/api/store.rs
+++ b/src/api/store.rs
@@ -564,7 +564,11 @@ async fn put_signed(
             envelope::check(&*doc, &sealed, &path, previous.as_deref())
                 .map_err(|error| ApiError(StatusCode::FORBIDDEN, Some(error)))?;
             let before = Before::of(&*doc, &writer);
-            store::write_path(doc, &path, &JsonValue::String(sealed))
+            // A plain string, whatever was there: what every node checks it as
+            // (`access::rules`).
+            let envelope = Val::Scalar(ScalarValue::Str(sealed.into()));
+            let writing = store::Writing::new(store::Sticky::No, TimestampFormat::default(), true);
+            store::write_val_path(doc, &path, &envelope, writing)
                 .map_err(|e| store_status(e, "Failed to write store value"))?;
             registry_kept(&*doc, &path, before, &writer)?;
             read_shown(