access: the policy enforced

_continuum/access/policy ({"version": 1}) has every node screen every
change it receives, on every path changes come in. A policy a node
doesn't know stops its writes through the API. GET /admin/refused.

Auth plan M6.

1 files changed, 18 insertions, 3 deletions

diff --git a/src/state/host.rs b/src/state/host.rs
index a48a6fb..e401509 100644
--- a/src/state/host.rs
+++ b/src/state/host.rs
@@ -403,9 +403,24 @@ impl Host for AppState {
             tokio::task::spawn_blocking(move || {
                 let result = {
                     let mut replica = state.doc.blocking_write();
-                    let result = replica
-                        .apply_changes([change])
-                        .map_err(|error| error.to_string());
+                    let result = if crate::access::policy::of(&replica.doc).enforced() {
+                        // Judged first (`access::screen`).
+                        let (epoch, epoch_seq) = (replica.epoch, replica.epoch_seq);
+                        crate::access::screen::apply_bytes(
+                            &mut replica.doc,
+                            epoch,
+                            epoch_seq,
+                            change.raw_bytes(),
+                            &state.screening,
+                            &mut crate::document::PatchLog::inactive(),
+                        )
+                        .map(|_| ())
+                        .map_err(|error| format!("{error:#}"))
+                    } else {
+                        replica
+                            .apply_changes([change])
+                            .map_err(|error| error.to_string())
+                    };
                     replica.refresh_heads();
                     result
                 }; // lock released before notifying