access: no manages flag

GET /admin/users no longer lists a manages flag per user: whether a
user may manage users follows from its capabilities.

Auth plan M1 (cleanup).

2 files changed, 3 insertions, 8 deletions

diff --git a/src/api/login.rs b/src/api/login.rs
index 09b8f2e..023408e 100644
--- a/src/api/login.rs
+++ b/src/api/login.rs
@@ -27,12 +27,11 @@ use serde::Deserialize;
 use serde_json::{Value as JsonValue, json};
 use tracing::{debug, info};
 
-use super::access::Access;
 use super::auth::{AuthenticatedUser, Via};
 use super::users::CapRequest;
 use super::{ApiError, error_response};
 use crate::access::token::{self, Claims};
-use crate::access::{Capability, Right, registry};
+use crate::access::{Capability, registry};
 use crate::state::AppState;
 
 /// The token a request came with, as taken (a request extension, set by `bearer`).
@@ -289,7 +288,6 @@ pub(crate) async fn whoami(
     State(state): State<AppState>,
     Extension(user): Extension<AuthenticatedUser>,
     Extension(via): Extension<Via>,
-    Extension(access): Extension<Access>,
     token: Option<Extension<Token>>,
 ) -> Json<JsonValue> {
     let replica = state.doc.read().await;
@@ -311,7 +309,6 @@ pub(crate) async fn whoami(
         "registry": registry::exists(&replica.doc),
         "caps": entry.as_ref().map(|entry| &entry.caps),
         "disabled": entry.as_ref().map(|entry| entry.disabled),
-        "managesUsers": access.allows(Right::Write, &registry::users_dir()),
         "token": token,
     }))
 }
diff --git a/src/api/users.rs b/src/api/users.rs
index 7c65eb5..1d01af7 100644
--- a/src/api/users.rs
+++ b/src/api/users.rs
@@ -1,7 +1,7 @@
 //! `/admin/users`: the swarm's users and what each may do (`access.md`), managed
 //! through the API rather than by writing the registry's entries through the store.
 //!
-//! * `GET /admin/users`: every user, its entry and whether it may manage users.
+//! * `GET /admin/users`: every user and its entry.
 //! * `GET /admin/users/{name}`: one.
 //! * `POST /admin/users/{name}`: adds a user, with the capabilities of the body
 //!   (`{"caps": [{"path": [...], "rights": ["read", "write"]}, …]}`, none if absent);
@@ -119,13 +119,11 @@ fn may_manage(state: &AppState, user: &str, access: &Access) -> Result<(), ApiEr
     }
 }
 
-/// A user's entry as the API shows it: as recorded, and whether it may manage users.
+/// A user's entry as the API shows it: as recorded, with its name.
 fn shown(doc: &impl crate::document::ReadDoc, name: &str) -> Option<JsonValue> {
     let mut entry = store::read_path(doc, &registry::user_path(name)).ok()??;
-    let manages = registry::caps_of(doc, name).allows(Right::Write, &registry::users_dir());
     if let Some(object) = entry.as_object_mut() {
         object.insert("name".to_owned(), json!(name));
-        object.insert("manages".to_owned(), json!(manages));
     }
     Some(entry)
 }