1 files changed, 26 insertions, 1 deletions

diff --git a/src/api/mod.rs b/src/api/mod.rs
index ce1f6ae..1fba48b 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -24,7 +24,7 @@ use tracing::{error, warn};
 use utoipa::OpenApi;
 use utoipa_swagger_ui::SwaggerUi;
 
-use crate::api::auth::{AuthState, basic_auth};
+use crate::api::auth::{AuthState, AuthenticatedUser, basic_auth};
 use crate::document::store::StoreError;
 use crate::state::AppState;
 
@@ -104,6 +104,31 @@ fn parse_key_path(key: &str) -> Result<Vec<String>, StatusCode> {
     Ok(segments)
 }
 
+/// A path for a write. Protocol data (`_continuum`: remake records, members, forget
+/// records, epoch metadata) is what every node acts on, so a write there acts on the
+/// whole swarm: only users listed in `--protocol-writers` may, and each such write is
+/// logged. Epoch metadata (and `_continuum` as a whole, which contains it) is never
+/// writable: the protocol reads it at the snapshot change, so an edit only misleads
+/// whoever reads it later. `403` otherwise.
+fn parse_write_path(
+    state: &AppState,
+    user: &AuthenticatedUser,
+    key: &str,
+    method: &str,
+) -> Result<Vec<String>, StatusCode> {
+    let path = parse_key_path(key)?;
+    if path.first().map(String::as_str) != Some(crate::remake::snapshot::META_ROOT) {
+        return Ok(path);
+    }
+    let epochs = path.len() < 2 || path[1] == crate::remake::snapshot::EPOCHS;
+    if epochs || !state.protocol_writers.contains(&user.0) {
+        warn!(user = %user.0, method, path = %key, "Refused a write to protocol data");
+        return Err(StatusCode::FORBIDDEN);
+    }
+    warn!(user = %user.0, method, path = %key, "Protocol data written through the store API; this acts on the whole swarm");
+    Ok(path)
+}
+
 fn response_for_value(
     value: &JsonValue,
     accept: Option<&HeaderValue>,