access: signatures required

"signatures": "required": a change counts only once a signature by its
committer vouches for it, and waits until then; every node then signs
every change it makes.

Auth plan M6.

1 files changed, 14 insertions, 1 deletions

diff --git a/src/document/replica.rs b/src/document/replica.rs
index a409969..cdf789c 100644
--- a/src/document/replica.rs
+++ b/src/document/replica.rs
@@ -230,6 +230,19 @@ impl Replica {
         &mut self,
         f: impl FnOnce(&mut Document, &mut automerge::PatchLog) -> (T, bool),
     ) -> T {
+        self.logged_signed(|doc, _, log| f(doc, log))
+    }
+
+    /// [`logged`](Self::logged), `f` given the document's signatures too
+    /// (`access::screen`, judging received changes, checks theirs).
+    pub(crate) fn logged_signed<T>(
+        &mut self,
+        f: impl FnOnce(
+            &mut Document,
+            &mut super::signatures::Signatures,
+            &mut automerge::PatchLog,
+        ) -> (T, bool),
+    ) -> T {
         use crate::locks::MutexExt;
         let before = sorted_heads(&self.doc);
         let mut log = self.log.lock_or_recover();
@@ -238,7 +251,7 @@ impl Replica {
             // lead here.
             *log = Log::at(self.epoch_seq, before);
         }
-        let (out, whole) = f(&mut self.doc, &mut log.patches);
+        let (out, whole) = f(&mut self.doc, &mut self.signatures, &mut log.patches);
         let after = sorted_heads(&self.doc);
         if whole {
             log.to = after;