From a0c8fcb2693cc017d78e39a6e623d1c53e493a84 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 22:23:52 +0000 Subject: access: a token with a limit changes no credentials A token's limit narrows every endpoint but those under /auth, which any registered user may call. Among them, PUT and DELETE /auth/keys/{id} change the keys the user logs in with, and POST /auth/logout ends every token of the user. With the token a dashboard hands to another member's (the member list, read, five minutes), its holder could add a key of its own and log in by it as the user, with everything the user may do. These now take a password or a token without a limit (Need::Credentials, refused where Caps::limited). A narrowed token still refreshes within its limit, says who it is, lists the user's keys and ends its own session (DELETE /auth/session): a dashboard opened from another member's logs out with it. --- docs/access.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 571034e..5a1e04b 100644 --- a/docs/access.md +++ b/docs/access.md @@ -35,7 +35,8 @@ password hashes: every member reads the document). `authorized_keys` line has it (`"laptop": "ssh-ed25519 AAAA… alice@laptop"`; Ed25519 only; the comment, 256 bytes at most, is kept and checks nothing): what it signs values with (Values signed by their users, below) and logs in with. A user manages its own, whatever else it may do: `GET /auth/keys`, `PUT /auth/keys/` - with the line, `DELETE /auth/keys/`; under a strict policy, by signing its + with the line, `DELETE /auth/keys/` (not with a token that has a `limit`); under a + strict policy, by signing its entry with only its keys changed (`continuum-signed key-add laptop ~/.ssh/id_ed25519.pub`, `key-remove laptop`), with a key it holds already. Every node takes that from the user itself, as from one who may manage users. Its last key @@ -124,10 +125,11 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store refreshes it past its end. A dashboard opening another member's hands it one reading the member list only, for five minutes ([`dashboard.md`](dashboard.md)). * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens, - by the user (`POST /auth/logout`) or by one who may manage users (`DELETE + by the user (`POST /auth/logout`, not with a token that has a `limit`) or by one who may manage users (`DELETE /admin/users/{name}/tokens`), which sets `_continuum/logouts/`: tokens issued before aren't taken any more. One session's (`DELETE /auth/session`, the dashboard's - "log out"): `_continuum/sessions//`, until when the session would have + "log out", with any token of the session, a narrowed one too, as a dashboard opened + from another member's holds): `_continuum/sessions//`, until when the session would have lasted, written by the user or one who manages users; a remake's snapshot leaves it out once that has passed. Without a registry, the node ending it refuses the session's tokens itself, until it restarts; others take them until they expire. -- cgit v1.3.1