aboutsummaryrefslogtreecommitdiffstats
path: root/src/api/users.rs
Commit message (Collapse)AuthorAgeFilesLines
* api: signed values at the storetv4 days1-1/+11
| | | | | | | | | PUT with application/continuum-signed writes an envelope where values are signed (403/409 saying why); reads open envelopes and name the signer (x-continuum-signed-by), ?raw=true shows them. Under strict, unsigned writes reaching a signed value and the users API are 409. Auth plan M7.
* signatures: changes signed by their nodetv4 days1-1/+2
| | | | | | | | | | Every node signs the changes it commits with its node key, an Ed25519 signature over the change's hash, kept beside the document. One signature on an actor's latest change vouches for its earlier ones. Protocol data and paths listed in _continuum/access/signed are signed, and writes with ?signed=true. Auth plan M5.
* access: no manages flagtv4 days1-4/+2
| | | | | | | GET /admin/users no longer lists a manages flag per user: whether a user may manage users follows from its capabilities. Auth plan M1 (cleanup).
* auth: logging in, and tokens as bearerstv4 days1-0/+33
| | | | | | | | | POST /auth/login (by htpasswd or the proxy), /auth/refresh, /auth/logout, GET /auth/whoami; every request may bring Authorization: Bearer instead of a password. --token-lifetime and --session-lifetime. Auth plan M2.
* access: the users endpointstv4 days1-0/+344
/admin/users: list, add (one or several), remove, disable, grant and revoke capabilities; each one change, refused if it would lock its writer out. Capabilities as the store's paths name them. Auth plan M1.