access: the policy enforced

_continuum/access/policy ({"version": 1}) has every node screen every
change it receives, on every path changes come in. A policy a node
doesn't know stops its writes through the API. GET /admin/refused.

Auth plan M6.

1 files changed, 10 insertions, 0 deletions

diff --git a/src/document/sync.rs b/src/document/sync.rs
index 8cb740b..f124ee8 100644
--- a/src/document/sync.rs
+++ b/src/document/sync.rs
@@ -22,6 +22,16 @@ use crate::transport::SyncPayload;
 /// A sync message from a peer, decoded (`decode`), to apply (`SyncSession::receive`).
 pub(crate) struct Received(sync::Message);
 
+impl Received {
+    /// The changes it carries, as their chunks, taken out of it: applied otherwise
+    /// (`access::screen`), what is left of it says what the peer has and needs.
+    pub(crate) fn take_changes(&mut self) -> Vec<u8> {
+        let bytes = self.0.changes.iter().flatten().copied().collect();
+        self.0.changes = sync::ChunkList::empty();
+        bytes
+    }
+}
+
 /// The changes none of the others depend on, sorted as heads are (`get_heads`).
 fn tips<'a>(
     changes: impl Iterator<