aboutsummaryrefslogtreecommitdiffstats
path: root/src/document
Commit message (Collapse)AuthorAgeFilesLines
* access: signed values judged on receipttv4 days1-8/+89
| | | | | | | | | Inspection gives each operation's kind; under strict every node refuses, at a signed place, anything but an envelope that checks and replaces the one there (deleting first as replacing does), anything within one, and above one anything replacing what holds one. Auth plan M7.
* access: strict policy, signed pathstv4 days2-1/+54
| | | | | | | | | "values": "signed" (strict, requiring signatures too): the registry, _continuum/access, bans and the paths in _continuum/access/userSigned (* for any key) hold values their users signed. Envelopes read as the values they hold where the node reads protocol data. Auth plan M7.
* access: logouts apart from users' entriestv4 days1-0/+2
| | | | | | | | _continuum/logouts/<name> holds when a user's tokens were last revoked, written by the user itself or by one who may manage users, so users' entries can be signed by their managers alone. Auth plan M7.
* access: values signed by their userstv4 days1-0/+1
| | | | | | | | | access::envelope: cv1.<payload>.<signature>, the payload naming the path, value, user, time and the envelope it replaces (prev), signed with one of the user's SSH keys from the registry (keys). Checked against the registry as the writer saw it. Auth plan M7.
* docs: what is left of write protectiontv4 days1-1/+1
| | | | future-work brought up to date with M6.
* access: banstv4 days1-0/+3
| | | | | | | | _continuum/banned/<node ID>: every node refuses the banned node's changes from then on (judged as the ban stood) and leaves its handshakes unanswered. Auth plan M6.
* access: signatures requiredtv4 days2-1/+62
| | | | | | | | "signatures": "required": a change counts only once a signature by its committer vouches for it, and waits until then; every node then signs every change it makes. Auth plan M6.
* access: the policy enforcedtv4 days2-0/+16
| | | | | | | | _continuum/access/policy ({"version": 1}) has every node screen every change it receives, on every path changes come in. A policy a node doesn't know stops its writes through the API. GET /admin/refused. Auth plan M6.
* access: screening received changestv4 days2-1/+29
| | | | | | | | | access::screen: a batch of received changes judged change by change, those that change what rules read applied before the next is judged; a refused change stays out with whatever builds on it, kept aside for operators; changes missing dependencies wait. Auth plan M6.
* remake: replays keep their writerstv4 days1-2/+2
| | | | | | | | A remake's replay writes each value as the user who wrote it, splitting where several users wrote under a path, so replays are judged as the original writes. Auth plan M6 (remakes, 2.4).
* access: rules by pathtv4 days2-2/+4
| | | | | | | | | | access::rules::judge: a change judged as its writer saw the document (at its dependencies): committer a member or registering itself; members' entries and votes their own; epochs and swarm ID from roots; a remake's decision by its coordinator; the rest by the registry for the user the change names. Auth plan M6.
* inspect: the paths changes touchtv4 days3-1/+300
| | | | | | | | document::inspect: each change's paths read from its operations before it is applied, the same on every node: an object's place as made, cut at lists and text; unknown objects at the root. Auth plan M6.
* bench: change pathstv4 days2-2/+153
| | | | | | | Finding the paths changes touch, from documents and from raw change bytes, measured before M6 is built. Auth plan M6 (measure first).
* signatures: verified changestv4 days1-1/+0
| | | | | | | GET /admin/changes shows whether a signature by its node vouches for each change. Auth plan M5.
* signatures: with sync messagestv4 days2-38/+249
| | | | | | | Sync messages carry, for each actor's writes, the latest signature the sender checked; the receiver checks it once it holds the change. Auth plan M5.
* signatures: kept in the document filetv4 days2-35/+203
| | | | | | | A node's signatures are saved with its document (--document-file) and loaded with it. Auth plan M5.
* signatures: --sign-everytv4 days1-2/+140
| | | | | | | | Changes left unsigned are vouched for by the node's next signature: --sign-every 1s (default) signs the latest within a second, all signs every change, none only those that must be. Auth plan M5.
* signatures: changes signed by their nodetv4 days3-0/+188
| | | | | | | | | | Every node signs the changes it commits with its node key, an Ed25519 signature over the change's hash, kept beside the document. One signature on an actor's latest change vouches for its earlier ones. Protocol data and paths listed in _continuum/access/signed are signed, and writes with ?signed=true. Auth plan M5.
* bench: change signaturestv4 days1-0/+229
| | | | | | | Signing and checking change signatures, per change and per actor's latest change, measured before M5 is built (development.md). Auth plan M5 (measure first).
* store: keys_at tells no map from an empty onetv4 days1-9/+8
| | | | | | | | registry::exists counted any value at _continuum/users as a registry; keys_at answers None where there is no map, and its users (records, members, forget records, remakes) say what they make of it. Auth plan M1 (fix).
* access: authorization at the APItv4 days1-2/+12
| | | | | | | | | Every request is judged by the registry the node holds: store reads pruned to what the user may read, writes refused where it may not, admin endpoints by protocol capabilities. Without a registry, as before (--protocol-writers for protocol data). Auth plan M1.
* access: the user registrytv4 days2-0/+8
| | | | | | | | | _continuum/users/<name>: one entry per user, with capabilities by path (read, write) granted by whom and when, and a disabled flag. Read leniently: a damaged entry gives less, never more. Protocol data stays apart: a capability outside _continuum never covers it. Auth plan M1.
* refuse misplaced authorstv5 days3-8/+253
|
* HyParView (slim)tv5 days1-0/+5
|
* heads heard in announcementstv5 days1-6/+6
|
* heads heard in repliestv5 days1-3/+3
|
* heads heard forget senttv5 days1-0/+90
|
* sent hashes elsewhere measuredtv5 days1-0/+10
|
* known elsewhere prunedtv5 days1-0/+5
|
* sent hashes trimmedtv5 days1-5/+78
|
* sent hashes measuredtv5 days1-0/+8
|
* swarm neighbourstv6 days1-0/+3
|
* answering behind countedtv6 days1-0/+17
|
* late messages keep newer headstv6 days1-0/+73
|
* session model testtv6 days2-0/+331
|
* automerge pinnedtv6 days1-0/+103
|
* one walk sincetv6 days2-26/+52
|
* no bloom bytestv6 days1-14/+9
|
* handed over stays senttv6 days1-2/+35
|
* waiting not twicetv6 days1-0/+7
|
* offer answerstv6 days1-0/+10
|
* add pushes match automerge testtv6 days1-0/+48
|
* broken pushes refusedtv6 days1-11/+31
|
* pushed have is the senders headstv6 days1-10/+39
|
* pushed heads as tipstv6 days1-6/+60
|
* push changes experimenttv6 days1-0/+123
|
* announce only to those behindtv7 days2-0/+48
|
* asked known elsewheretv7 days1-7/+36
|
* predecessors go alongtv7 days1-3/+60
|
* covered neighbours have ittv7 days2-9/+52
|