access: a node judges its own changes before they leave

The API checks the path a request asks for; the rules judge everything
the change does. Where they disagreed, the honest node's change was
refused by every other node, and with signatures required the node was
refused as a whole. The plan had both gates run the same judgement.

Under a policy, each change a node makes (its own writes and those
through the API) is now judged by rules::judge as receivers will judge
it, before it is signed or sent; one every node would refuse is rolled
back (the document forked at the heads before it, same actor: the
change never left) and the request refused with 403 (StoreError::
Refused). rules::judge_held, judging a change the document holds,
moves from swarm::refusals to access::rules for both.

The simulations that play a member past its own checks write with a
helper that bypasses them (forge).

Review finding 3 (the same judgement at both gates).

1 files changed, 4 insertions, 0 deletions

diff --git a/src/document/store.rs b/src/document/store.rs
index c946fef..d323928 100644
--- a/src/document/store.rs
+++ b/src/document/store.rs
@@ -181,6 +181,10 @@ pub(crate) enum StoreError {
         "the swarm's policy (_continuum/access/policy) is one this node doesn't know ({0}); upgrade it to write"
     )]
     UnknownPolicy(String),
+    /// Every node would refuse the change this write makes (`access::rules`), why:
+    /// the write is rolled back.
+    #[error("every node would refuse this write: {0}")]
+    Refused(String),
     #[error(transparent)]
     Doc(#[from] automerge::AutomergeError),
     #[error(transparent)]