diff options
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 22 |
1 files changed, 18 insertions, 4 deletions
diff --git a/docs/access.md b/docs/access.md index e8108e2..909d915 100644 --- a/docs/access.md +++ b/docs/access.md @@ -107,7 +107,9 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store by the user (`POST /auth/logout`) or by one who may manage users (`DELETE /admin/users/{name}/tokens`), which sets `_continuum/logouts/<name>`: tokens issued before aren't taken any more. A token of a node banned or forgotten by the swarm isn't - taken either. In a swarm without a registry, a token is taken until it expires. + taken either. In a swarm without a registry, a token is taken until it expires. The + user a logout names is its node's word, and a logout no deciding path, even under a + strict policy: any member could log any user out. It ends sessions, nothing more. * **What it means to trust**: any member could sign a token for any user, as it could write anything as anyone ([`trust.md`](trust.md)). A token is a bearer's: whoever holds it is the user until it ends, so it goes over TLS only, as passwords do. @@ -123,7 +125,9 @@ jq -n --arg c "$c" --rawfile s sig '{user: "alice", challenge: $c, signature: $s curl -s -X POST localhost:3000/auth/login/key -H 'Content-Type: application/json' -d @- ``` -A challenge is the node's, signed by it, valid for five minutes, and taken once; +A challenge is the node's, signed by it, valid for five minutes, and taken once (the +node remembers which in memory: after a restart, one captured in its five minutes +could be taken once more; it goes over TLS, as passwords do); the signature must be by one of the user's keys, as the registry the node holds then says, and the user enabled (`401` if not, saying why). A swarm without a registry has no keys (`409`). @@ -361,8 +365,18 @@ A node takes one only from that user, for that path, replacing what is there, by of the user's keys, and if the user may write there ([`api.md`](api.md), Signed values); it writes nothing else there, nor within or above such a value (`409`), and the users API changes nothing (`409`). Values there before the policy stay as they are until -replaced: a registry whose entries hold the users' keys turns strict as it is. Without -the policy, signed values may be written all the same, and plain ones too. +replaced: a registry whose entries hold the users' keys turns strict as it is. As it is +means trusted as it is: whatever entries, policy and bans it holds then count, plain +values and envelopes alike, checked or not, whoever wrote them before (under a policy +that isn't strict, a member may write as any user). Look them over before turning +strict (`continuum-signed verify` on each entry). A value there that isn't an envelope +starts its chain anew: any envelope its user once signed for that path replacing +nothing (`prev` empty) can be put there again. Without the policy, signed values may +be written all the same, and plain ones too. + +Keep two users who may manage users, or two keys each: under a strict policy, a +registry whose only manager lost its keys changes no more (the protocol writers do +everything there again only while nobody may manage users). Every node judges the changes it receives alike (Changes judged on every node, above), as their writer saw the registry: at such a place, only a string that is an envelope |