access: bootstrap users only

The first users come only from --bootstrap-users; the genesis node
warns of htpasswd users that aren't among them.

Auth plan M1.

1 files changed, 15 insertions, 7 deletions

diff --git a/src/main.rs b/src/main.rs
index 2b8c376..fb3c0ad 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -97,16 +97,24 @@ async fn main() -> Result<()> {
     // A broken htpasswd will abort startup.
     let auth_state =
         AuthState::from_settings(&args)?.context("htpasswd or user-header is required")?;
-    // A new swarm's first users, if it is to have a user registry.
-    let first_users = if args.genesis && !args.bootstrap_users.is_empty() {
-        let htpasswd = match args.htpasswd.as_deref() {
-            Some(path) => api::auth::htpasswd_names(path)?,
-            None => Vec::new(),
-        };
-        access::registry::first_users(&args.bootstrap_users, &htpasswd)
+    // A new swarm's first users, if it is to have a user registry; the users of the
+    // htpasswd file that aren't among them may do nothing until they are added.
+    let first_users = if args.genesis {
+        access::registry::first_users(&args.bootstrap_users)
     } else {
         Vec::new()
     };
+    if !first_users.is_empty()
+        && let Some(path) = args.htpasswd.as_deref()
+    {
+        let missing: Vec<String> = api::auth::htpasswd_names(path)?
+            .into_iter()
+            .filter(|name| !args.bootstrap_users.contains(name))
+            .collect();
+        if !missing.is_empty() {
+            warn!(users = ?missing, "Users of htpasswd not among bootstrap-users: the new swarm's registry doesn't have them, so they may do nothing until added (docs/access.md)");
+        }
+    }
 
     info!(
         bind_addr = ?args.bind_addr.iter().map(ToString::to_string).collect::<Vec<_>>(),