diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/access.md | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/docs/access.md b/docs/access.md index 4a0fd0e..83c39f9 100644 --- a/docs/access.md +++ b/docs/access.md @@ -277,6 +277,24 @@ over it, as `ssh-keygen -Y sign -n continuum-value` makes it, with one of its `k it logs in by key, writes and deletes signed values (`put config '{"mode": "fast"}'`), and checks one against its user's keys (`verify config`). +What a client reads to check a signature, the signer's keys, is in the registry, and +whom to seal for (Values sealed for their readers, below) in `_continuum/access`: both +protocol data, which a user's capabilities cover only if given so. Neither holds +secrets (every member holds the document), so give the users who check or seal reading +them: + +```sh +curl -u alice -X POST -H 'Content-Type: application/json' \ + --data '{"path": ["_continuum", "users"], "rights": ["read"]}' \ + http://localhost:3000/admin/users/bob/caps +curl -u alice -X POST -H 'Content-Type: application/json' \ + --data '{"path": ["_continuum", "access"], "rights": ["read"]}' \ + http://localhost:3000/admin/users/bob/caps +``` + +Under a strict policy, the same, as part of bob's entry, signed (`continuum-signed put +_continuum/users/bob '{…}'`). + A node takes one only from that user, for that path, replacing what is there, by one of the user's keys, and if the user may write there ([`api.md`](api.md), Signed values); it writes nothing else there, nor within or above such a value (`409`), and the users |