From 221f21c474aa5fa598872776a803665e37c2fe0c Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 14:22:06 +0000 Subject: docs: what the review found that stays Review findings 10 and 12, and 3.1/3.3: what stays as it is, said. * Any member can log any user out: the user a logout names is its node's word, and a logout is no deciding path, even under strict. * Used challenges are remembered in memory: after a restart, one captured within its five minutes could be taken once more. * A registry turns strict as it is: whatever it holds then counts, plain values and envelopes, checked or not. Look it over first. * A value that isn't an envelope starts its chain anew (prev empty). * A strict registry whose only manager lost its keys changes no more: keep two managers, or two keys. * The handed-over token stays in the address bar and history where the other dashboard never loads, for its five minutes. --- docs/access.md | 22 ++++++++++++++++++---- docs/dashboard.md | 5 ++++- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/docs/access.md b/docs/access.md index e8108e2..909d915 100644 --- a/docs/access.md +++ b/docs/access.md @@ -107,7 +107,9 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store by the user (`POST /auth/logout`) or by one who may manage users (`DELETE /admin/users/{name}/tokens`), which sets `_continuum/logouts/`: tokens issued before aren't taken any more. A token of a node banned or forgotten by the swarm isn't - taken either. In a swarm without a registry, a token is taken until it expires. + taken either. In a swarm without a registry, a token is taken until it expires. The + user a logout names is its node's word, and a logout no deciding path, even under a + strict policy: any member could log any user out. It ends sessions, nothing more. * **What it means to trust**: any member could sign a token for any user, as it could write anything as anyone ([`trust.md`](trust.md)). A token is a bearer's: whoever holds it is the user until it ends, so it goes over TLS only, as passwords do. @@ -123,7 +125,9 @@ jq -n --arg c "$c" --rawfile s sig '{user: "alice", challenge: $c, signature: $s curl -s -X POST localhost:3000/auth/login/key -H 'Content-Type: application/json' -d @- ``` -A challenge is the node's, signed by it, valid for five minutes, and taken once; +A challenge is the node's, signed by it, valid for five minutes, and taken once (the +node remembers which in memory: after a restart, one captured in its five minutes +could be taken once more; it goes over TLS, as passwords do); the signature must be by one of the user's keys, as the registry the node holds then says, and the user enabled (`401` if not, saying why). A swarm without a registry has no keys (`409`). @@ -361,8 +365,18 @@ A node takes one only from that user, for that path, replacing what is there, by of the user's keys, and if the user may write there ([`api.md`](api.md), Signed values); it writes nothing else there, nor within or above such a value (`409`), and the users API changes nothing (`409`). Values there before the policy stay as they are until -replaced: a registry whose entries hold the users' keys turns strict as it is. Without -the policy, signed values may be written all the same, and plain ones too. +replaced: a registry whose entries hold the users' keys turns strict as it is. As it is +means trusted as it is: whatever entries, policy and bans it holds then count, plain +values and envelopes alike, checked or not, whoever wrote them before (under a policy +that isn't strict, a member may write as any user). Look them over before turning +strict (`continuum-signed verify` on each entry). A value there that isn't an envelope +starts its chain anew: any envelope its user once signed for that path replacing +nothing (`prev` empty) can be put there again. Without the policy, signed values may +be written all the same, and plain ones too. + +Keep two users who may manage users, or two keys each: under a strict policy, a +registry whose only manager lost its keys changes no more (the protocol writers do +everything there again only while nobody may manage users). Every node judges the changes it receives alike (Changes judged on every node, above), as their writer saw the registry: at such a place, only a string that is an envelope diff --git a/docs/dashboard.md b/docs/dashboard.md index db599fb..1a0ae86 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -209,7 +209,10 @@ measured. member list only, for five minutes, enough for the map: where the browser has no session at the other dashboard, its login page begins one with it (log in there to see more), unless its proxy asks for credentials of its own. Whoever publishes the - dashboard (a member writes its own URL) gets that token, no more. It opens as this one was left: the map's nodes where + dashboard (a member writes its own URL) gets that token, no more. It goes in the + address's fragment, which the other page takes out at once; where that page never + loads (an error, a proxy's own login), it stays in the address bar and the history, + for its five minutes. It opens as this one was left: the map's nodes where they were (on a dynamic map they then move to their places among the other node's links, smoothly; new ones are placed among them), the view, the pins, what is in focus, the legend shown or hidden, what is open in the figures and in the document, -- cgit v1.3.1