diff options
Diffstat (limited to 'src/access/rules.rs')
| -rw-r--r-- | src/access/rules.rs | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/src/access/rules.rs b/src/access/rules.rs index 4e4e6e9..b5dcf3a 100644 --- a/src/access/rules.rs +++ b/src/access/rules.rs @@ -193,6 +193,13 @@ pub(crate) fn judge(doc: &Document, epoch: Epoch, change: &Change<'_>) -> Result || user_may(path) || user_may(&meta::path(&[meta::USERS])) } + // Under a strict policy, a user's own entry, as an envelope: signed by the user + // with only its keys changed (`envelope::check`, run by `signed_values`). + (Some(meta::USERS), Some(owner)) + if path.len() == 3 && change.user == Some(owner) && policy.strict() => + { + true + } // A user's own keys (`/auth/keys`), whatever else it may do, one left at // least. (Some(meta::USERS), Some(owner)) @@ -885,6 +892,27 @@ mod tests { ))); } + /// Under a strict policy, a user's own entry is its own to write (what it may sign + /// there, `envelope::check` says); not another's; without strict, not its own either. + #[test] + fn users_write_their_own_entry_under_strict() { + let mut doc = swarm(true); + let own = "_continuum/users/bob"; + assert!(refused(judged(&doc, "a", Some("bob"), &[own]))); + write( + &mut doc, + "_continuum/access/policy", + json!({"version": 1, "values": "signed"}), + ); + assert!(judged(&doc, "a", Some("bob"), &[own]).is_ok()); + assert!(refused(judged( + &doc, + "a", + Some("bob"), + &["_continuum/users/alice"] + ))); + } + /// A node that isn't a member may only register itself. #[test] fn strangers_register_themselves_only() { |