diff options
| -rw-r--r-- | docs/access.md | 4 | ||||
| -rw-r--r-- | src/remake/api.rs | 8 | ||||
| -rw-r--r-- | src/remake/vote.rs | 17 |
3 files changed, 21 insertions, 8 deletions
diff --git a/docs/access.md b/docs/access.md index 03b70b8..d1f69e1 100644 --- a/docs/access.md +++ b/docs/access.md @@ -407,7 +407,9 @@ registry, the policy and the bans change only as a user who may change them sign ### Turning a swarm strict -A running swarm turns strict through a remake of its own kind, `strict`: compaction +A running swarm turns strict through a remake of its own kind, `strict`, once (a swarm +strict already takes none: its registry, policy and bans change by their users' +signatures, not by a majority of members): compaction that keeps, at the places values are signed (the registry, `_continuum/access`, the bans, the paths listed in `userSigned`), only the values an operator looked over and signed, and sets the strict policy. What was written after its base reaches the new diff --git a/src/remake/api.rs b/src/remake/api.rs index d3df908..1da0539 100644 --- a/src/remake/api.rs +++ b/src/remake/api.rs @@ -383,22 +383,24 @@ async fn start_kind<H: Host>( // A strict remake: proposed only with a manifest this node would vote for. if kind.name() == "strict" { - let swarm = host + let (swarm, strict) = host .read_doc(|doc| { - crate::document::store::read_path( + let swarm = crate::document::store::read_path( doc, &crate::document::meta::path(&[crate::document::meta::SWARM]), ) .ok() .flatten() .and_then(|swarm| swarm.as_str().map(str::to_owned)) - .unwrap_or_default() + .unwrap_or_default(); + (swarm, crate::access::policy::of(doc).strict()) }) .await; if let Err(why) = super::vote::strict_taken( &host, prepared.content.as_deref(), &swarm, + strict, &EpochRecord::from(host.current_epoch()), request.base_heads.as_deref(), ) { diff --git a/src/remake/vote.rs b/src/remake/vote.rs index 7e678e6..ac94306 100644 --- a/src/remake/vote.rs +++ b/src/remake/vote.rs @@ -281,7 +281,7 @@ pub(super) async fn cast<H: Host>(host: &H) { // Usually there is nothing to vote on: look first, without writing. let (voter, wanted) = (me.clone(), epoch.clone()); let now = host.now_millis(); - let (due, missed, swarm) = host + let (due, missed, (swarm, strict)) = host .read_doc(move |doc| { let all = records::load_all(doc); let register = records::load_register(doc); @@ -304,7 +304,8 @@ pub(super) async fn cast<H: Host>(host: &H) { .flatten() .and_then(|swarm| swarm.as_str().map(str::to_owned)) .unwrap_or_default(); - (due, missed, swarm) + let strict = crate::access::policy::of(doc).strict(); + (due, missed, (swarm, strict)) }) .await; for id in missed { @@ -336,6 +337,7 @@ pub(super) async fn cast<H: Host>(host: &H) { host, bytes.as_deref().map(Vec::as_slice), &swarm, + strict, &proposal.from_epoch, proposal.base_heads.as_deref(), ) @@ -381,15 +383,22 @@ pub(super) async fn cast<H: Host>(host: &H) { } /// Whether this node takes a strict remake's manifest (`content`, for `swarm`): signed -/// by one of its `--strict-keys`, for the remake's epoch and base (`epoch`, `base`). Why -/// not, if not. +/// by one of its `--strict-keys`, for the remake's epoch and base (`epoch`, `base`), in +/// a swarm not strict yet (`strict`: once it is, its registry, policy and bans change by +/// their users' signatures, not by a majority of members). Why not, if not. pub(super) fn strict_taken<H: Host>( host: &H, content: Option<&[u8]>, swarm: &str, + strict: bool, epoch: &EpochRecord, base: Option<&[String]>, ) -> Result<(), String> { + if strict { + return Err( + "the swarm is strict already: its registry changes by its users' signatures".to_owned(), + ); + } let text = content .and_then(|bytes| std::str::from_utf8(bytes).ok()) .ok_or("no manifest")?; |