aboutsummaryrefslogtreecommitdiffstats
path: root/src/access
diff options
context:
space:
mode:
Diffstat (limited to 'src/access')
-rw-r--r--src/access/rules.rs170
-rw-r--r--src/access/screen.rs1
2 files changed, 11 insertions, 160 deletions
diff --git a/src/access/rules.rs b/src/access/rules.rs
index b5dcf3a..ed9ee4b 100644
--- a/src/access/rules.rs
+++ b/src/access/rules.rs
@@ -56,8 +56,6 @@ pub(crate) struct Change<'a> {
pub(crate) paths: &'a BTreeSet<Path>,
/// Its operations, where each is and what it does there (`inspect::Inspector::ops`).
pub(crate) ops: &'a [Op],
- /// When it was made (ms), as its writer says.
- pub(crate) time: u64,
}
/// Why a change is refused.
@@ -214,12 +212,10 @@ pub(crate) fn judge(doc: &Document, epoch: Epoch, change: &Change<'_>) -> Result
// Its coordinator's; or the record of the remake that made the epoch,
// carried into it whole (its proposal written with it) by the coordinator
// its snapshot names (`remake::switch`), where there is none.
- // Also by one who may write it; and an abort by any member, once the
- // remake expired a grace period ago (`aborts_expired`).
+ // Also by one who may write it (an operator aborting an expired remake,
+ // or superseding it, `remake::api`).
Some("decision") => match coordinator(&at, id) {
- Some(coordinator) => {
- coordinator == node || user_may(path) || aborts_expired(&at, id, change)
- }
+ Some(coordinator) => coordinator == node || user_may(path),
None if user_may(path) => true,
None => {
change
@@ -306,7 +302,6 @@ pub(crate) fn judge_held(
user: user.as_deref(),
paths: &paths,
ops: &ops,
- time: u64::try_from(change.timestamp()).unwrap_or(0),
},
);
Some(match judged {
@@ -455,38 +450,6 @@ fn made_the_epoch(at: &At<'_>, epoch: Epoch, id: &str, node: &str) -> bool {
== Some(node)
}
-/// Whether `change` aborts remake `id`, undecided at `at`, as any member may: once it
-/// expired a grace period ago (`remake::proposal::abortable_at`, its coordinator's grace
-/// period), by the change's time. That is its writer's word: a member could abort a
-/// remake early, as it could ask its coordinator to; never commit one.
-fn aborts_expired(at: &At<'_>, id: &str, change: &Change<'_>) -> bool {
- if store::read_path(at, &meta::path(&[meta::REMAKES, id, "decision"]))
- .ok()
- .flatten()
- .is_some()
- {
- return false;
- }
- let outcome = meta::path(&[meta::REMAKES, id, "decision", "outcome"]);
- let mut outcomes = change.ops.iter().filter(|op| op.path == outcome).peekable();
- if outcomes.peek().is_none()
- || !outcomes.all(|op| matches!(&op.action, Action::PutString(value) if value == "aborted"))
- {
- return false;
- }
- let Some(proposal) = store::read_path(at, &meta::path(&[meta::REMAKES, id, "proposal"]))
- .ok()
- .flatten()
- else {
- return false;
- };
- let number = |key: &str| proposal.get(key).and_then(serde_json::Value::as_u64);
- let (Some(settle_until), Some(grace)) = (number("settleUntil"), number("graceMs")) else {
- return false;
- };
- change.time >= settle_until.saturating_add(grace.saturating_mul(2))
-}
-
/// Whether `owner` has a key left after `ops`, its keys at `at` as they change them.
fn keys_left(at: &At<'_>, owner: &str, ops: &[Op]) -> bool {
let keys = meta::path(&[meta::USERS, owner, "keys"]);
@@ -593,7 +556,6 @@ mod tests {
user,
paths: &touched,
ops: &[],
- time: 0,
},
)
}
@@ -678,7 +640,6 @@ mod tests {
user: None,
paths: &touched,
ops: &[],
- time: 0,
},
)
};
@@ -766,130 +727,26 @@ mod tests {
user: None,
paths: &touched,
ops: &[],
- time: 0,
},
);
assert!(earlier.is_ok());
}
- /// A remake's decision: its coordinator's, one who may write it; an abort, any
- /// member's, once the remake expired a grace period ago, by the change's time.
+ /// A remake's decision: its coordinator's, or one who may write it; no other
+ /// member's, whatever its time.
#[test]
- fn expired_remakes_aborted_by_any_member() {
+ fn decisions_by_the_coordinator_or_who_may() {
let mut doc = swarm(true);
write(
&mut doc,
- "_continuum/remakes/r4/proposal",
- json!({"coordinator": "a", "settleUntil": 1_000, "graceMs": 100}),
- );
- write(
- &mut doc,
"_continuum/users/carol",
registry::entry("a", 2, &[(path("_continuum"), &[Right::Write][..])]),
);
- let decide = |user: Option<&str>, outcome: &str, time: u64| {
- let ops = vec![
- Op {
- path: path("_continuum/remakes/r4/decision"),
- action: Action::MakeMap,
- },
- Op {
- path: path("_continuum/remakes/r4/decision/outcome"),
- action: Action::PutString(outcome.to_owned()),
- },
- Op {
- path: path("_continuum/remakes/r4/decision/decidedAt"),
- action: Action::Other,
- },
- ];
- let deps = doc.get_heads();
- let touched: BTreeSet<Path> = ops.iter().map(|op| op.path.clone()).collect();
- judge(
- &doc,
- Epoch::GENESIS,
- &Change {
- hash: ChangeHash([9; 32]),
- deps: &deps,
- seen: &deps,
- committer: Some("b"),
- user,
- paths: &touched,
- ops: &ops,
- time,
- },
- )
- };
- // Expired at 1100; abortable by others a grace period later.
- assert!(refused(decide(None, "aborted", 1_199)));
- assert!(decide(None, "aborted", 1_200).is_ok());
- assert!(refused(decide(None, "committed", 5_000)));
- // One who may write protocol data, any decision, any time.
- assert!(decide(Some("carol"), "committed", 0).is_ok());
- }
-
- /// A user's own keys: its own to change, whatever else it may do, one left at least;
- /// another's, or the rest of its own entry, not.
- #[test]
- fn users_change_their_own_keys() {
- let mut doc = swarm(true);
- let judged_ops = |doc: &Document, user: Option<&str>, ops: Vec<Op>| {
- let deps = doc.get_heads();
- let touched: BTreeSet<Path> = ops.iter().map(|op| op.path.clone()).collect();
- judge(
- doc,
- Epoch::GENESIS,
- &Change {
- hash: ChangeHash([9; 32]),
- deps: &deps,
- seen: &deps,
- committer: Some("a"),
- user,
- paths: &touched,
- ops: &ops,
- time: 0,
- },
- )
- };
- let op = |at: &str, action: Action| Op {
- path: path(at),
- action,
- };
- let put = |at: &str| op(at, Action::PutString("ssh-ed25519 AAAA".to_owned()));
- let bobs = "_continuum/users/bob/keys/laptop";
- assert!(judged_ops(&doc, Some("bob"), vec![put(bobs)]).is_ok());
- assert!(refused(judged_ops(
- &doc,
- Some("bob"),
- vec![put("_continuum/users/alice/keys/laptop")]
- )));
- assert!(refused(judged_ops(
- &doc,
- Some("bob"),
- vec![op("_continuum/users/bob/caps", Action::MakeMap)]
- )));
- assert!(refused(judged_ops(&doc, None, vec![put(bobs)])));
- // With one key: another added, one of two removed; not the last.
- write(&mut doc, bobs, json!("ssh-ed25519 AAAA"));
- let phone = "_continuum/users/bob/keys/phone";
- assert!(judged_ops(&doc, Some("bob"), vec![put(phone)]).is_ok());
- assert!(refused(judged_ops(
- &doc,
- Some("bob"),
- vec![op(bobs, Action::Delete)]
- )));
- assert!(
- judged_ops(
- &doc,
- Some("bob"),
- vec![put(phone), op(bobs, Action::Delete)]
- )
- .is_ok()
- );
- assert!(refused(judged_ops(
- &doc,
- Some("bob"),
- vec![op("_continuum/users/bob/keys", Action::Delete)]
- )));
+ let decision = "_continuum/remakes/r1/decision";
+ assert!(judged(&doc, "a", None, &[decision]).is_ok());
+ assert!(refused(judged(&doc, "b", None, &[decision])));
+ assert!(refused(judged(&doc, "b", Some("bob"), &[decision])));
+ assert!(judged(&doc, "b", Some("carol"), &[decision]).is_ok());
}
/// Under a strict policy, a user's own entry is its own to write (what it may sign
@@ -973,7 +830,6 @@ mod tests {
user: Some("alice"),
paths: &touched,
ops: &[],
- time: 0,
},
)
};
@@ -1037,7 +893,6 @@ mod tests {
user: Some("alice"),
paths: &touched,
ops: &ops,
- time: 0,
},
)
};
@@ -1128,7 +983,6 @@ mod tests {
user: Some("alice"),
paths: &touched,
ops: &ops,
- time: 0,
},
)
};
@@ -1206,7 +1060,6 @@ mod tests {
user: Some("bob"),
paths: &touched,
ops: &ops,
- time: 0,
},
)
};
@@ -1261,7 +1114,6 @@ mod tests {
user: None,
paths: &touched,
ops: &[],
- time: 0,
},
)
};
diff --git a/src/access/screen.rs b/src/access/screen.rs
index 5584b2b..d7c9389 100644
--- a/src/access/screen.rs
+++ b/src/access/screen.rs
@@ -442,7 +442,6 @@ pub(crate) fn apply(
user: user.as_deref(),
paths: &paths[index],
ops: &ops[index],
- time: u64::try_from(change.timestamp()).unwrap_or(0),
},
);
match judged {