aboutsummaryrefslogtreecommitdiffstats
path: root/docs/access.md
Commit message (Collapse)AuthorAgeFilesLines
* auth: logging in by keytv4 days1-0/+16
| | | | | | | | POST /auth/challenge and /auth/login/key: a node-signed challenge, valid five minutes and taken once, signed with one of the user's SSH keys (ssh-keygen -Y sign -n continuum-login), for a token. Auth plan M7 (key login, M2b).
* access: signed values judged on receipttv4 days1-3/+6
| | | | | | | | | Inspection gives each operation's kind; under strict every node refuses, at a signed place, anything but an envelope that checks and replaces the one there (deleting first as replacing does), anything within one, and above one anything replacing what holds one. Auth plan M7.
* access: a node registers before it writestv4 days1-1/+2
| | | | | | | | | Under a policy, a change by a node that isn't a member is refused with all built on it: a node's registration is written before any write of its own or through the API, not after (the registration itself exempt). Auth plan M6 (fix).
* api: signed values at the storetv4 days1-0/+32
| | | | | | | | | PUT with application/continuum-signed writes an envelope where values are signed (403/409 saying why); reads open envelopes and name the signer (x-continuum-signed-by), ?raw=true shows them. Under strict, unsigned writes reaching a signed value and the users API are 409. Auth plan M7.
* access: logouts apart from users' entriestv4 days1-1/+1
| | | | | | | | _continuum/logouts/<name> holds when a user's tokens were last revoked, written by the user itself or by one who may manage users, so users' entries can be signed by their managers alone. Auth plan M7.
* access: banstv4 days1-1/+16
| | | | | | | | _continuum/banned/<node ID>: every node refuses the banned node's changes from then on (judged as the ban stood) and leaves its handshakes unanswered. Auth plan M6.
* access: signatures requiredtv4 days1-3/+8
| | | | | | | | "signatures": "required": a change counts only once a signature by its committer vouches for it, and waits until then; every node then signs every change it makes. Auth plan M6.
* access: the policy enforcedtv4 days1-0/+47
| | | | | | | | _continuum/access/policy ({"version": 1}) has every node screen every change it receives, on every path changes come in. A policy a node doesn't know stops its writes through the API. GET /admin/refused. Auth plan M6.
* dashboard: subscribed nodes' messages in the consoletv4 days1-2/+2
| | | | | | | Each tick's messages of a subscribed node, listed in the console with this node's own, from its own stream. Auth plan M3 (live data from every reachable node).
* dashboard: subscribed nodes' messages as dotstv4 days1-2/+3
| | | | | | | The page reads a subscribed node's message counts from it too, and draws them as dots on the map, as this node's own. Auth plan M3 (live data from every reachable node).
* dashboard: own links over the API, and CORStv4 days1-0/+6
| | | | | | | | | GET /admin/dashboard/links/own and its event stream: a node's own links, as LINKS_REPLY carried them, for other members' dashboards with a token. CORS for the members' dashboard origins and --cors-origins, without credentials. Auth plan M3.
* auth: logging in, and tokens as bearerstv4 days1-0/+32
| | | | | | | | | POST /auth/login (by htpasswd or the proxy), /auth/refresh, /auth/logout, GET /auth/whoami; every request may bring Authorization: Bearer instead of a password. --token-lifetime and --session-lifetime. Auth plan M2.
* access: the users endpointstv4 days1-15/+38
| | | | | | | | /admin/users: list, add (one or several), remove, disable, grant and revoke capabilities; each one change, refused if it would lock its writer out. Capabilities as the store's paths name them. Auth plan M1.
* access: bootstrap users onlytv4 days1-3/+6
| | | | | | | The first users come only from --bootstrap-users; the genesis node warns of htpasswd users that aren't among them. Auth plan M1.
* dashboard: what its user may readtv4 days1-1/+2
| | | | | | | The dashboard's document box is read through the store, as its user may, and the page is told only of changes where its user may read. Auth plan M1 (the dashboard).
* access: genesis of swarms from before the registrytv4 days1-8/+5
| | | | | | | | Swarms started before the registry keep working without one; the genesis node's options for a registry apply only to new swarms. What tests and migration leave is noted in future-work. Auth plan M1, bootstrap and migration (2.5).
* access: keeping the swarm manageabletv4 days1-2/+13
| | | | | | | | | A write that would leave its own writer unable to manage users (deleting, disabling or narrowing its entry, removing the registry) is refused; --protocol-writers can set a registry right that nobody may manage any more. Auth plan M1.
* access: authorization at the APItv4 days1-0/+50
| | | | | | | | | Every request is judged by the registry the node holds: store reads pruned to what the user may read, writes refused where it may not, admin endpoints by protocol capabilities. Without a registry, as before (--protocol-writers for protocol data). Auth plan M1.
* access: first users at genesistv4 days1-0/+42
--bootstrap-users gives a new swarm a registry from its first change, each first user with everything; other users may do nothing until added. Without it the swarm has no registry and works as before. Auth plan M1.