access: the policy enforced

_continuum/access/policy ({"version": 1}) has every node screen every
change it receives, on every path changes come in. A policy a node
doesn't know stops its writes through the API. GET /admin/refused.

Auth plan M6.

1 files changed, 11 insertions, 0 deletions

diff --git a/src/state/mod.rs b/src/state/mod.rs
index ff19124..049c9e6 100644
--- a/src/state/mod.rs
+++ b/src/state/mod.rs
@@ -150,6 +150,9 @@ pub(crate) struct AppState {
     /// Which of its changes this node signs besides those a write's `Sign` says
     /// (`--sign-every`).
     pub(crate) sign_every: SignEvery,
+    /// Received changes waiting for their dependencies, and those refused, while the
+    /// policy has them judged (`access::screen`). Locked after the document.
+    pub(crate) screening: Arc<std::sync::Mutex<crate::access::screen::Screening>>,
     pub(crate) token_lifetime: Duration,
     pub(crate) session_lifetime: Duration,
     /// Origins whose pages may call this node's open endpoints (`api::cors`).
@@ -490,6 +493,14 @@ impl AppState {
         tokio::task::spawn_blocking(move || {
             let result = {
                 let mut replica = state.doc.blocking_write();
+                // A write through the API under a policy this node doesn't know: what
+                // the others would refuse it can't tell (`access::policy`).
+                if user.is_some()
+                    && let crate::access::policy::Policy::Unknown(why) =
+                        crate::access::policy::of(&replica.doc)
+                {
+                    return Err(E::from(StoreError::UnknownPolicy(why)));
+                }
                 // Checked here, under the lock: the caller's readiness check (if any)
                 // was before a rejoin could swap in a fresh document.
                 if !replica.writable {