From a2056647b6351797880741ea7d845657877587ed Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 19:01:55 +0000 Subject: store: a write inside a list checked where the rules judge it Review 2, N9: the API checked a write's capability on the path asked (servers/list/3/name), the rules on the list it is in (servers/list): a user whose capability lay inside a list had every such write pass the API and refused by the node's own judgement (403, after rolling the document back). inspect::placed places a write's path in the document by the rule the inspector places operations by (Place::child: cut after the first list or text on the way), and the store's writes check capabilities there. One rule for both; a test checks placed against the paths the inspector finds in the change such a write makes. --- docs/access.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index d1f69e1..b853b5a 100644 --- a/docs/access.md +++ b/docs/access.md @@ -59,7 +59,9 @@ Every request is checked against the registry, as the node serving it holds it: change to it counts on a node as soon as it has reached it. * **The store** (`/store`, `/stream`): writing a path (`PUT`, `POST`, `DELETE`) takes - `write` on it; `?prune=true` deletes maps left empty only up to the highest one the + `write` on it, or, inside a list or text, on the list, as every node judges the + change (a list's items have no paths of their own, Changes judged on every node, + below); `?prune=true` deletes maps left empty only up to the highest one the user may write. Reading takes `read`: of a place the user may read only partly, it sees the keys on the way to what it may read, as a directory one may pass through but not list (a capability on `servers/eu` shows `servers` with `eu` alone in it), -- cgit v1.3.1