1 files changed, 24 insertions, 1 deletions

diff --git a/src/access/envelope.rs b/src/access/envelope.rs
index 1804b98..e0c8909 100644
--- a/src/access/envelope.rs
+++ b/src/access/envelope.rs
@@ -108,6 +108,9 @@ fn agree(pattern: &[String], path: &[String]) -> bool {
 /// A signed value's payload.
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub(crate) struct Payload {
+    /// The swarm it is for: one user, with the same name and key in two swarms, signs
+    /// for one only.
+    pub(crate) swarm: String,
     pub(crate) path: Vec<String>,
     pub(crate) value: JsonValue,
     pub(crate) user: String,
@@ -170,7 +173,7 @@ pub(crate) fn read(envelope: &str) -> Result<Payload, String> {
 
 /// Checks `envelope` as the value at `path`, replacing `previous` (the envelope there
 /// before, if any), against the user registry `doc` holds (as the writer saw it): for
-/// that path, naming what it replaces, signed by one of its user's keys, a user who may
+/// its swarm, that path, naming what it replaces, signed by one of its user's keys, a user who may
 /// write there.
 pub(crate) fn check(
     doc: &impl ReadDoc,
@@ -179,6 +182,15 @@ pub(crate) fn check(
     previous: Option<&str>,
 ) -> Result<Signed, String> {
     let (bytes, payload, signature) = open(envelope)?;
+    let swarm = store::read_path(
+        doc,
+        &crate::document::meta::path(&[crate::document::meta::SWARM]),
+    )
+    .ok()
+    .flatten();
+    if swarm.as_ref().and_then(JsonValue::as_str) != Some(payload.swarm.as_str()) {
+        return Err(format!("signed for swarm {}, not this one", payload.swarm));
+    }
     if payload.path != path {
         return Err(format!(
             "signed for /{}, not /{}",
@@ -223,6 +235,7 @@ mod tests {
         let line = sshsig::PublicKey(key.verifying_key().to_bytes()).line();
         let mut doc = Document::new();
         change(&mut doc, |doc| {
+            store::write_path(doc, &path("_continuum/swarm"), &json!("s")).unwrap();
             let mut alice = registry::entry("root", 1, &[(path("config"), &[Right::Write][..])]);
             alice["keys"] = json!({ "laptop": line });
             store::write_path(doc, &registry::user_path("alice"), &alice).unwrap();
@@ -240,6 +253,7 @@ mod tests {
 
     fn payload(user: &str, at: &str, value: JsonValue, prev: &str) -> Payload {
         Payload {
+            swarm: "s".to_owned(),
             path: path(at),
             value,
             user: user.to_owned(),
@@ -282,6 +296,15 @@ mod tests {
         let tampered = first.replacen("cv1.", "cv1.e30", 1);
         assert!(check(&doc, &tampered, &path("config"), None).is_err());
         assert!(check(&doc, "plain", &path("config"), None).is_err());
+        // For another swarm.
+        let elsewhere = signed(
+            &key,
+            &Payload {
+                swarm: "t".to_owned(),
+                ..payload("alice", "config", json!({"mode": "fast"}), "")
+            },
+        );
+        assert!(check(&doc, &elsewhere, &path("config"), None).is_err());
     }
 
     #[test]