diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/access.md | 3 | ||||
| -rw-r--r-- | docs/api.md | 10 | ||||
| -rw-r--r-- | docs/openapi.yaml | 4 |
3 files changed, 10 insertions, 7 deletions
diff --git a/docs/access.md b/docs/access.md index a85dfa4..e8108e2 100644 --- a/docs/access.md +++ b/docs/access.md @@ -139,7 +139,8 @@ forgets it. The login page token pasted, from a login by key, say; the dashboard renews it while open ([`dashboard.md`](dashboard.md)). -`GET /auth/whoami` says who a request's user is, how it proved it, and what it may do. +`GET /auth/whoami` says the swarm, who a request's user is, how it proved it, and what +it may do. Pages of other origins, the dashboards of other members, may call a node with a token: its own links (`/admin/dashboard/links/own`, and its events) and messages diff --git a/docs/api.md b/docs/api.md index 019f9cf..cf05046 100644 --- a/docs/api.md +++ b/docs/api.md @@ -281,18 +281,20 @@ their users), a user writes one by signing it with its SSH key: the payload, one of JSON, then the signature, as `application/continuum-signed`. ```sh -# The envelope there, if any, and what replaces it names: its SHA-256 (none: ""). +# The swarm it is for; the envelope there, if any, and what replaces it names: its +# SHA-256 (none: ""). +swarm=$(curl -sf -u alice localhost:3000/auth/whoami | jq -r .swarm) read=$(curl -sf -u alice -H 'Accept: text/plain' 'localhost:3000/store/config?raw=true') prev=${read:+$(printf %s "$read" | sha256sum | cut -d' ' -f1)} -printf '{"path":["config"],"value":{"mode":"fast"},"user":"alice","at":%s,"prev":"%s"}' \ - "$(date +%s000)" "$prev" > payload +printf '{"swarm":"%s","path":["config"],"value":{"mode":"fast"},"user":"alice","at":%s,"prev":"%s"}' \ + "$swarm" "$(date +%s000)" "$prev" > payload ssh-keygen -Y sign -f ~/.ssh/id_ed25519 -n continuum-value payload { cat payload; echo; cat payload.sig; } | curl -X PUT localhost:3000/store/config \ -u alice -H 'Content-Type: application/continuum-signed' --data-binary @- ``` The node writes it as its envelope if the authenticated user signed it (`403` if not), -for this path, with one of its keys, may write there (`403`), and it replaces what is +for this swarm and this path, with one of its keys, may write there (`403`), and it replaces what is there (`prev`, the SHA-256 of the envelope it replaces; `409` if it names another: read again and sign anew), and only where values are signed (`409` elsewhere). It answers with the value, as a `PUT` does; a signed `null` deletes, with `204`. Under diff --git a/docs/openapi.yaml b/docs/openapi.yaml index f0d54a9..13d8a65 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -192,7 +192,7 @@ paths: schema: type: string example: | - {"path":["config"],"value":{"mode":"fast"},"user":"alice","at":1762400000000,"prev":""} + {"swarm":"6f9a…","path":["config"],"value":{"mode":"fast"},"user":"alice","at":1762400000000,"prev":""} -----BEGIN SSH SIGNATURE----- U1NIU0lH… -----END SSH SIGNATURE----- @@ -981,7 +981,7 @@ paths: get: tags: [Auth] summary: Who you are here - description: The user, how it proved it (`htpasswd`, `header`, `token`), its registry entry's capabilities, and its token's claims if it came with one. + description: The swarm, the user, how it proved it (`htpasswd`, `header`, `token`), its registry entry's capabilities, and its token's claims if it came with one. responses: '200': description: Who. |