aboutsummaryrefslogtreecommitdiffstats
path: root/src/access/mod.rs
Commit message (Collapse)AuthorAgeFilesLines
* access: values sealed for their readerstv4 days1-0/+1
| | | | | | | | | | cs1.<age file>: a value encrypted with age to its readers' SSH keys, which no node decrypts. _continuum/access/sealed declares paths whose values must be sealed, for named readers or anyone; nodes check the recipients by age's key tags, at the API and on receipt. Auth plan M8, reworked: sealed values instead of containers, readers as users only (nodes hold no keys).
* auth: logging in by keytv4 days1-0/+1
| | | | | | | | POST /auth/challenge and /auth/login/key: a node-signed challenge, valid five minutes and taken once, signed with one of the user's SSH keys (ssh-keygen -Y sign -n continuum-login), for a token. Auth plan M7 (key login, M2b).
* api: signed values at the storetv4 days1-5/+0
| | | | | | | | | PUT with application/continuum-signed writes an envelope where values are signed (403/409 saying why); reads open envelopes and name the signer (x-continuum-signed-by), ?raw=true shows them. Under strict, unsigned writes reaching a signed value and the users API are 409. Auth plan M7.
* access: values signed by their userstv4 days1-0/+3
| | | | | | | | | access::envelope: cv1.<payload>.<signature>, the payload naming the path, value, user, time and the envelope it replaces (prev), signed with one of the user's SSH keys from the registry (keys). Checked against the registry as the writer saw it. Auth plan M7.
* access: SSH signaturestv4 days1-0/+4
| | | | | | | access::sshsig: OpenSSH's SSHSIG, verified and made natively (Ed25519, sha512/sha256), checked against OpenSSH's own test vector. Auth plan M7.
* access: banstv4 days1-0/+1
| | | | | | | | _continuum/banned/<node ID>: every node refuses the banned node's changes from then on (judged as the ban stood) and leaves its handshakes unanswered. Auth plan M6.
* access: the policy enforcedtv4 days1-4/+1
| | | | | | | | _continuum/access/policy ({"version": 1}) has every node screen every change it receives, on every path changes come in. A policy a node doesn't know stops its writes through the API. GET /admin/refused. Auth plan M6.
* access: screening received changestv4 days1-0/+3
| | | | | | | | | access::screen: a batch of received changes judged change by change, those that change what rules read applied before the next is judged; a refused change stays out with whatever builds on it, kept aside for operators; changes missing dependencies wait. Auth plan M6.
* access: rules by pathtv4 days1-0/+3
| | | | | | | | | | access::rules::judge: a change judged as its writer saw the document (at its dependencies): committer a member or registering itself; members' entries and votes their own; epochs and swarm ID from roots; a remake's decision by its coordinator; the rest by the registry for the user the change names. Auth plan M6.
* access: tokenstv4 days1-7/+62
| | | | | | | | | ct1 tokens: who, how they logged in, a session, when they expire, and optionally a narrower limit; signed by the issuing node's key and taken by every member (a node ID is its key). Revocation by the registry as it stands when a request comes. Auth plan M2.
* access: the user registrytv4 days1-0/+179
_continuum/users/<name>: one entry per user, with capabilities by path (read, write) granted by whom and when, and a disabled flag. Read leniently: a damaged entry gives less, never more. Protocol data stays apart: a capability outside _continuum never covers it. Auth plan M1.