aboutsummaryrefslogtreecommitdiffstats
path: root/src/state/mod.rs
Commit message (Collapse)AuthorAgeFilesLines
* access: a node judges its own changes before they leavetv3 days1-3/+51
| | | | | | | | | | | | | | | | | | | | The API checks the path a request asks for; the rules judge everything the change does. Where they disagreed, the honest node's change was refused by every other node, and with signatures required the node was refused as a whole. The plan had both gates run the same judgement. Under a policy, each change a node makes (its own writes and those through the API) is now judged by rules::judge as receivers will judge it, before it is signed or sent; one every node would refuse is rolled back (the document forked at the heads before it, same actor: the change never left) and the request refused with 403 (StoreError:: Refused). rules::judge_held, judging a change the document holds, moves from swarm::refusals to access::rules for both. The simulations that play a member past its own checks write with a helper that bypasses them (forge). Review finding 3 (the same judgement at both gates).
* auth: logging in by keytv3 days1-0/+2
| | | | | | | | POST /auth/challenge and /auth/login/key: a node-signed challenge, valid five minutes and taken once, signed with one of the user's SSH keys (ssh-keygen -Y sign -n continuum-login), for a token. Auth plan M7 (key login, M2b).
* access: a node registers before it writestv3 days1-19/+83
| | | | | | | | | Under a policy, a change by a node that isn't a member is refused with all built on it: a node's registration is written before any write of its own or through the API, not after (the registration itself exempt). Auth plan M6 (fix).
* access: signatures requiredtv3 days1-1/+4
| | | | | | | | "signatures": "required": a change counts only once a signature by its committer vouches for it, and waits until then; every node then signs every change it makes. Auth plan M6.
* access: the policy enforcedtv3 days1-0/+11
| | | | | | | | _continuum/access/policy ({"version": 1}) has every node screen every change it receives, on every path changes come in. A policy a node doesn't know stops its writes through the API. GET /admin/refused. Auth plan M6.
* signatures: with sync messagestv3 days1-3/+7
| | | | | | | Sync messages carry, for each actor's writes, the latest signature the sender checked; the receiver checks it once it holds the change. Auth plan M5.
* signatures: --sign-everytv3 days1-3/+30
| | | | | | | | Changes left unsigned are vouched for by the node's next signature: --sign-every 1s (default) signs the latest within a second, all signs every change, none only those that must be. Auth plan M5.
* signatures: changes signed by their nodetv3 days1-5/+25
| | | | | | | | | | Every node signs the changes it commits with its node key, an Ed25519 signature over the change's hash, kept beside the document. One signature on an actor's latest change vouches for its earlier ones. Protocol data and paths listed in _continuum/access/signed are signed, and writes with ?signed=true. Auth plan M5.
* dashboard: without LINKS; LINKS removedtv3 days1-2/+0
| | | | | | | | | The dashboard reads every member's links from the members themselves; LINKS and LINKS_REPLY, swarm::links and their wire tags go (wire version bumped). Nodes the browser can't reach are drawn from what the reachable ones measure. Auth plan M3.
* dashboard: own links over the API, and CORStv3 days1-0/+2
| | | | | | | | | GET /admin/dashboard/links/own and its event stream: a node's own links, as LINKS_REPLY carried them, for other members' dashboards with a token. CORS for the members' dashboard origins and --cors-origins, without credentials. Auth plan M3.
* auth: logging in, and tokens as bearerstv3 days1-0/+4
| | | | | | | | | POST /auth/login (by htpasswd or the proxy), /auth/refresh, /auth/logout, GET /auth/whoami; every request may bring Authorization: Bearer instead of a password. --token-lifetime and --session-lifetime. Auth plan M2.
* access: first users at genesistv3 days1-0/+2
| | | | | | | | --bootstrap-users gives a new swarm a registry from its first change, each first user with everything; other users may do nothing until added. Without it the swarm has no registry and works as before. Auth plan M1.
* HyParView (slim)tv5 days1-4/+21
|
* dissemination traittv5 days1-0/+2
|
* topology traittv5 days1-0/+2
|
* working links recordedtv5 days1-0/+2
|
* push by defaulttv6 days1-4/+0
|
* push changes experimenttv6 days1-0/+4
|
* slow round back offtv7 days1-0/+2
|
* announce what trees misstv8 days1-0/+3
|
* add writer treestv8 days1-3/+4
|
* measure 2-hop neighbourhoodtv8 days1-0/+2
|
* add stream heartbeattv8 days1-0/+3
|
* dashboard: double-click opens peer dashboardtv9 days1-0/+3
|
* api: add x-continuum-heads to writestv9 days1-6/+10
|
* record node ID and API user for every writetv9 days1-1/+24
|
* introduce per-transport sync reply timeouttv10 days1-1/+1
|
* peer worker forget records on changetv10 days1-0/+3
|
* peer worker sleeps until deadline, not fixed timetv10 days1-0/+5
|
* bootstrap: replace pull by progress notifytv10 days1-0/+4
|
* document: allow writes during rejointv10 days1-4/+17
|
* LWW everywhere, mostlytv10 days1-0/+2
|
* state: drop epoch_txtv10 days1-5/+4
| | | | The stamp is the only lock-free epoch label.
* document: reject writes during rejointv10 days1-3/+9
|
* use Automerge as Document instead of AutoCommittv11 days1-9/+5
| | | | This allows a lot of operations to drop mut.
* move SyncSession to documenttv11 days1-3/+0
|
* move all automerge references to documenttv11 days1-19/+0
|
* sync messages are bytes outside the sessiontv11 days1-1/+1
| | | | | | | | SyncPayload is now an opaque byte container in transport. SyncSession::generate returns the encoded payload, state::decode_sync(&payload) decodes it off the document lock (as before), and receive takes the decoded message, which is a type only the session can open. transport/mod.rs no longer imports Automerge.
* commits go through the replicatv11 days1-13/+4
|
* rename AutoMerge to Documenttv11 days1-5/+5
|
* detect local clock jumpstv11 days1-2/+2
|
* propagate clock figurestv11 days1-0/+3
|
* add peer clock skew warningtv11 days1-0/+5
|
* centralize call to topology_changetv11 days1-1/+1
|
* unify request_sync logictv11 days1-0/+18
|
* move ChangeSet from swarm to documenttv11 days1-1/+2
|
* unify closing logictv11 days1-2/+9
|
* add links messagestv12 days1-0/+2
| | | | | | | | | Introduce two new wire messages, LINKS and LINKS_REPLY (swarm::links). A member answers with its links: for each peer, the transport, whether it’s relayed, the RTT, and whether it’s dormant. It answers members only, at most every 5 s. This bumps wire::VERSION to 7. Every build answers, with or without the feature, so every node needs this patch before the map shows anything beyond its own node.
* add document lock statstv2026-10-281-2/+3
|
* move keepalive and firewall to pathstv2026-10-281-1/+1
|