access: authorization at the API

Every request is judged by the registry the node holds: store reads
pruned to what the user may read, writes refused where it may not,
admin endpoints by protocol capabilities. Without a registry, as
before (--protocol-writers for protocol data).

Auth plan M1.

1 files changed, 12 insertions, 2 deletions

diff --git a/src/document/store.rs b/src/document/store.rs
index db5ecbc..b343a2e 100644
--- a/src/document/store.rs
+++ b/src/document/store.rs
@@ -1251,6 +1251,16 @@ pub(crate) fn delete_path(
     path: &[String],
     prune: bool,
 ) -> Result<(), StoreError> {
+    delete_path_pruning(doc, path, prune.then_some(1))
+}
+
+/// [`delete_path`], pruning maps left empty from the deepest up to the one at depth
+/// `prune` (`Some(1)`: a top-level key at most; the root never), if given.
+pub(crate) fn delete_path_pruning(
+    doc: &mut impl Transactable,
+    path: &[String],
+    prune: Option<usize>,
+) -> Result<(), StoreError> {
     let (leaf, parents) = path.split_last().ok_or(StoreError::NotFound)?;
 
     // levels[d] = what path[..d] resolves to
@@ -1279,9 +1289,9 @@ pub(crate) fn delete_path(
         Resolved::Other(..) => return Err(StoreError::NotFound),
     }
 
-    if prune {
+    if let Some(floor) = prune {
         // Never prune the root (depth 0), nor through a list.
-        for depth in (1..levels.len()).rev() {
+        for depth in (floor.max(1)..levels.len()).rev() {
             let (Resolved::Maps(above), Resolved::Maps(maps)) =
                 (&levels[depth - 1], &levels[depth])
             else {