From 8a6ed7cc711e797542a531091b3bdbc73e5f61e4 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 02:24:51 +0000 Subject: dashboard: keys edited, the last removed with a password, failures kept The credentials dialog listed a user's keys whole, to add one or remove one but the last, and any failure replaced the dialog with the error, the form lost. * A key is shown short: its type, the first and last four characters of what tells it apart (an Ed25519 key's base64 after the part all of them share), its comment; the whole line in its tooltip. * A key can be edited, its name and its line: saved under the name, a new name written first and the old one removed. * A user with a password on this node (`--htpasswd`) may remove its last key: it logs in by the password. GET /auth/keys says so (`password`), and DELETE /auth/keys/{id} takes it then; the rules no longer keep the last key on every node (no other node can tell who has a password where; under a strict policy the signed entry keeps one still). * What fails says why beside where it was asked (the add form, the edited row, the removed one), which stays as it was, to be set right and tried again. --- docs/access.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 2df7270..4bb5945 100644 --- a/docs/access.md +++ b/docs/access.md @@ -36,8 +36,10 @@ password hashes: every member reads the document). with the line, `DELETE /auth/keys/`; under a strict policy, by signing its entry with only its keys changed (`continuum-signed key-add laptop ~/.ssh/id_ed25519.pub`, `key-remove laptop`), with a key it holds already. Every - node takes that from the user itself, as from one who may manage users, but never - its last key removed (`409`): one who may manage users may. + node takes that from the user itself, as from one who may manage users. Its last key + it removes only on a node where it has a password (`--htpasswd`), which it logs in + by then (`409` elsewhere); under a strict policy, never (it signs its entry with + one). ## A new swarm -- cgit v1.3.1