From 645bae8fb8065a353237d24aff274009f37d694e Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:21 +0100 Subject: access: a node registers before it writes Under a policy, a change by a node that isn't a member is refused with all built on it: a node's registration is written before any write of its own or through the API, not after (the registration itself exempt). Auth plan M6 (fix). --- docs/access.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 0366e26..fa0b47d 100644 --- a/docs/access.md +++ b/docs/access.md @@ -194,7 +194,8 @@ revocation since refuses nothing it allowed then, and every node judges alike. * A user's tokens revoked by that user too (logging out). * Everything else, protocol data or not, by a user the registry lets write there. * A node that isn't a member may only register itself; a banned node nothing (Banning - a node, below). + a node, below). So a node registers before anything else it writes, through the API + or its own: a change refused stays out with every change built on it. With `"signatures": "required"`, a change also needs a signature by the node it names ([`api.md`](api.md), Signed changes): every node then signs every change it makes, and -- cgit v1.3.1