aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* access: --bootstrap-keystv3 days8-21/+98
| | | | | | | The first users' SSH keys, recorded at genesis with their entries, so a swarm can be strict from its start. Auth plan M7.
* auth: logging in by keytv3 days8-7/+383
| | | | | | | | POST /auth/challenge and /auth/login/key: a node-signed challenge, valid five minutes and taken once, signed with one of the user's SSH keys (ssh-keygen -Y sign -n continuum-login), for a token. Auth plan M7 (key login, M2b).
* access: signed values judged on receipttv3 days5-19/+319
| | | | | | | | | Inspection gives each operation's kind; under strict every node refuses, at a signed place, anything but an envelope that checks and replaces the one there (deleting first as replacing does), anything within one, and above one anything replacing what holds one. Auth plan M7.
* access: a node registers before it writestv3 days3-38/+116
| | | | | | | | | Under a policy, a change by a node that isn't a member is refused with all built on it: a node's registration is written before any write of its own or through the API, not after (the registration itself exempt). Auth plan M6 (fix).
* api: signed values at the storetv3 days8-27/+416
| | | | | | | | | PUT with application/continuum-signed writes an envelope where values are signed (403/409 saying why); reads open envelopes and name the signer (x-continuum-signed-by), ?raw=true shows them. Under strict, unsigned writes reaching a signed value and the users API are 409. Auth plan M7.
* access: strict policy, signed pathstv3 days6-26/+151
| | | | | | | | | "values": "signed" (strict, requiring signatures too): the registry, _continuum/access, bans and the paths in _continuum/access/userSigned (* for any key) hold values their users signed. Envelopes read as the values they hold where the node reads protocol data. Auth plan M7.
* access: logouts apart from users' entriestv3 days7-25/+32
| | | | | | | | _continuum/logouts/<name> holds when a user's tokens were last revoked, written by the user itself or by one who may manage users, so users' entries can be signed by their managers alone. Auth plan M7.
* access: values signed by their userstv3 days5-2/+289
| | | | | | | | | access::envelope: cv1.<payload>.<signature>, the payload naming the path, value, user, time and the envelope it replaces (prev), signed with one of the user's SSH keys from the registry (keys). Checked against the registry as the writer saw it. Auth plan M7.
* access: SSH signaturestv3 days2-0/+260
| | | | | | | access::sshsig: OpenSSH's SSHSIG, verified and made natively (Ed25519, sha512/sha256), checked against OpenSSH's own test vector. Auth plan M7.
* docs: what is left of write protectiontv3 days1-1/+1
| | | | future-work brought up to date with M6.
* access: banstv3 days6-2/+91
| | | | | | | | _continuum/banned/<node ID>: every node refuses the banned node's changes from then on (judged as the ban stood) and leaves its handshakes unanswered. Auth plan M6.
* simtest: the policy, and a remake under ittv3 days2-0/+165
| | | | | | | | A swarm judging every change: honest writes everywhere, a joining node registers, a forged write stays where it was made; a compaction under the policy refuses nothing honest. Auth plan M6.
* access: signatures requiredtv3 days10-26/+290
| | | | | | | | "signatures": "required": a change counts only once a signature by its committer vouches for it, and waits until then; every node then signs every change it makes. Auth plan M6.
* access: the policy enforcedtv3 days15-11/+374
| | | | | | | | _continuum/access/policy ({"version": 1}) has every node screen every change it receives, on every path changes come in. A policy a node doesn't know stops its writes through the API. GET /admin/refused. Auth plan M6.
* access: screening received changestv3 days5-2/+418
| | | | | | | | | access::screen: a batch of received changes judged change by change, those that change what rules read applied before the next is judged; a refused change stays out with whatever builds on it, kept aside for operators; changes missing dependencies wait. Auth plan M6.
* remake: replays keep their writerstv3 days6-28/+203
| | | | | | | | A remake's replay writes each value as the user who wrote it, splitting where several users wrote under a path, so replays are judged as the original writes. Auth plan M6 (remakes, 2.4).
* remake: forgetting and releasing name their usertv3 days5-7/+53
| | | | | | | Forget records and released quarantines name the user who made them, so they are judged by its capabilities. Auth plan M6.
* access: rules by pathtv3 days4-2/+411
| | | | | | | | | | access::rules::judge: a change judged as its writer saw the document (at its dependencies): committer a member or registering itself; members' entries and votes their own; epochs and swarm ID from roots; a remake's decision by its coordinator; the rest by the registry for the user the change names. Auth plan M6.
* inspect: the paths changes touchtv3 days3-1/+300
| | | | | | | | document::inspect: each change's paths read from its operations before it is applied, the same on every node: an object's place as made, cut at lists and text; unknown objects at the root. Auth plan M6.
* bench: change pathstv3 days3-3/+155
| | | | | | | Finding the paths changes touch, from documents and from raw change bytes, measured before M6 is built. Auth plan M6 (measure first).
* simtest: signed changestv3 days2-1/+115
| | | | | | | Every change vouched for on every node within a second; a forged signature vouches for nothing. Auth plan M5.
* signatures: verified changestv3 days5-16/+32
| | | | | | | GET /admin/changes shows whether a signature by its node vouches for each change. Auth plan M5.
* signatures: on their own (SIGNATURES)tv3 days13-8/+140
| | | | | | | Signatures no sync message took go on their own within a second, to each peer not sent them yet (wire version bumped). Auth plan M5.
* signatures: with sync messagestv3 days9-45/+314
| | | | | | | Sync messages carry, for each actor's writes, the latest signature the sender checked; the receiver checks it once it holds the change. Auth plan M5.
* signatures: kept in the document filetv3 days9-62/+268
| | | | | | | A node's signatures are saved with its document (--document-file) and loaded with it. Auth plan M5.
* signatures: --sign-everytv3 days8-6/+198
| | | | | | | | Changes left unsigned are vouched for by the node's next signature: --sign-every 1s (default) signs the latest within a second, all signs every change, none only those that must be. Auth plan M5.
* signatures: changes signed by their nodetv3 days12-14/+283
| | | | | | | | | | Every node signs the changes it commits with its node key, an Ed25519 signature over the change's hash, kept beside the document. One signature on an actor's latest change vouches for its earlier ones. Protocol data and paths listed in _continuum/access/signed are signed, and writes with ?signed=true. Auth plan M5.
* bench: change signaturestv3 days2-1/+231
| | | | | | | Signing and checking change signatures, per change and per actor's latest change, measured before M5 is built (development.md). Auth plan M5 (measure first).
* docs: user names from the registrytv3 days1-3/+5
| | | | | | api.md names users as the registry has them. Auth plan M1 (docs).
* access: no manages flagtv3 days3-10/+4
| | | | | | | GET /admin/users no longer lists a manages flag per user: whether a user may manage users follows from its capabilities. Auth plan M1 (cleanup).
* dashboard: subscriptions under patchestv3 days1-5/+17
| | | | | | | Subscribed nodes' data merged into the state as the page patches it, not overwritten by the next patch. Auth plan M3 (fix).
* dashboard: without LINKS; LINKS removedtv3 days24-1905/+332
| | | | | | | | | The dashboard reads every member's links from the members themselves; LINKS and LINKS_REPLY, swarm::links and their wire tags go (wire version bumped). Nodes the browser can't reach are drawn from what the reachable ones measure. Auth plan M3.
* dashboard: clocks on the pagetv3 days4-145/+53
| | | | | | | | The page compares the clocks the reports on its map carry: this node's peers', and those of the nodes it subscribes to; the node no longer gathers them from LINKS (api/dashboard/clocks.rs goes). Auth plan M3 (preparing LINKS' removal).
* dashboard: the writers' trees as this node knows themtv3 days3-50/+20
| | | | | | | | The tree drawn is computed as every node computes its own part of it: from the member list, and whom it and its neighbours reach, as they told it; no longer from the links members report over LINKS. Auth plan M3 (preparing LINKS' removal).
* dashboard: subscribed nodes' messages in the consoletv3 days7-88/+183
| | | | | | | Each tick's messages of a subscribed node, listed in the console with this node's own, from its own stream. Auth plan M3 (live data from every reachable node).
* dashboard: subscribed nodes' messages as dotstv3 days6-63/+187
| | | | | | | The page reads a subscribed node's message counts from it too, and draws them as dots on the map, as this node's own. Auth plan M3 (live data from every reachable node).
* dashboard: subscriptionstv3 days2-9/+233
| | | | | | | | Double-click a node to subscribe: the page reads its own links from it directly with a narrowed token (reading the member list only), drawn over what this node knows; kept per swarm in the browser. Auth plan M3.
* dashboard: own links over the API, and CORStv3 days12-1/+276
| | | | | | | | | GET /admin/dashboard/links/own and its event stream: a node's own links, as LINKS_REPLY carried them, for other members' dashboards with a token. CORS for the members' dashboard origins and --cors-origins, without credentials. Auth plan M3.
* docs: tokens through a proxy; token formats latertv3 days2-14/+53
| | | | | | | | operations.md: an nginx proxy passing requests with a token on to the node and asking the others for its own login. future-work: other token formats. Auth plan M2.
* store: keys_at tells no map from an empty onetv3 days7-16/+29
| | | | | | | | registry::exists counted any value at _continuum/users as a registry; keys_at answers None where there is no map, and its users (records, members, forget records, remakes) say what they make of it. Auth plan M1 (fix).
* auth: logging in, and tokens as bearerstv3 days15-8/+648
| | | | | | | | | POST /auth/login (by htpasswd or the proxy), /auth/refresh, /auth/logout, GET /auth/whoami; every request may bring Authorization: Bearer instead of a password. --token-lifetime and --session-lifetime. Auth plan M2.
* access: tokenstv3 days4-7/+369
| | | | | | | | | ct1 tokens: who, how they logged in, a session, when they expire, and optionally a narrower limit; signed by the issuing node's key and taken by every member (a node ID is its key). Revocation by the registry as it stands when a request comes. Auth plan M2.
* access: the users endpointstv3 days10-120/+681
| | | | | | | | /admin/users: list, add (one or several), remove, disable, grant and revoke capabilities; each one change, refused if it would lock its writer out. Capabilities as the store's paths name them. Auth plan M1.
* access: bootstrap users onlytv3 days5-42/+37
| | | | | | | The first users come only from --bootstrap-users; the genesis node warns of htpasswd users that aren't among them. Auth plan M1.
* dashboard: what its user may readtv3 days2-4/+71
| | | | | | | The dashboard's document box is read through the store, as its user may, and the page is told only of changes where its user may read. Auth plan M1 (the dashboard).
* access: genesis of swarms from before the registrytv3 days5-54/+34
| | | | | | | | Swarms started before the registry keep working without one; the genesis node's options for a registry apply only to new swarms. What tests and migration leave is noted in future-work. Auth plan M1, bootstrap and migration (2.5).
* access: keeping the swarm manageabletv3 days4-21/+143
| | | | | | | | | A write that would leave its own writer unable to manage users (deleting, disabling or narrowing its entry, removing the registry) is refused; --protocol-writers can set a registry right that nobody may manage any more. Auth plan M1.
* access: authorization at the APItv3 days11-65/+584
| | | | | | | | | Every request is judged by the registry the node holds: store reads pruned to what the user may read, writes refused where it may not, admin endpoints by protocol capabilities. Without a registry, as before (--protocol-writers for protocol data). Auth plan M1.
* access: first users at genesistv3 days11-1/+208
| | | | | | | | --bootstrap-users gives a new swarm a registry from its first change, each first user with everything; other users may do nothing until added. Without it the swarm has no registry and works as before. Auth plan M1.
* access: the user registrytv3 days5-0/+423
| | | | | | | | | _continuum/users/<name>: one entry per user, with capabilities by path (read, write) granted by whom and when, and a disabled flag. Read leniently: a damaged entry gives less, never more. Protocol data stays apart: a capability outside _continuum never covers it. Auth plan M1.