auth: logging in by key

POST /auth/challenge and /auth/login/key: a node-signed challenge,
valid five minutes and taken once, signed with one of the user's SSH
keys (ssh-keygen -Y sign -n continuum-login), for a token.

Auth plan M7 (key login, M2b).

1 files changed, 2 insertions, 0 deletions

diff --git a/src/state/mod.rs b/src/state/mod.rs
index 7ee0acb..5a36faa 100644
--- a/src/state/mod.rs
+++ b/src/state/mod.rs
@@ -153,6 +153,8 @@ pub(crate) struct AppState {
     /// Received changes waiting for their dependencies, and those refused, while the
     /// policy has them judged (`access::screen`). Locked after the document.
     pub(crate) screening: Arc<std::sync::Mutex<crate::access::screen::Screening>>,
+    /// The challenges logins by key used, until they expire (`access::challenge`).
+    pub(crate) challenges: Arc<std::sync::Mutex<crate::access::challenge::Used>>,
     pub(crate) token_lifetime: Duration,
     pub(crate) session_lifetime: Duration,
     /// Origins whose pages may call this node's open endpoints (`api::cors`).