From f2487f5a1f897bb5499ffd782562f53967f20606 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:09 +0100 Subject: access: keeping the swarm manageable A write that would leave its own writer unable to manage users (deleting, disabling or narrowing its entry, removing the registry) is refused; --protocol-writers can set a registry right that nobody may manage any more. Auth plan M1. --- docs/access.md | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 042e0d5..b9e0296 100644 --- a/docs/access.md +++ b/docs/access.md @@ -88,5 +88,16 @@ curl -u alice --request PUT --header 'Content-Type: application/json' \ ``` From that write on, every node serves only the users the registry has, so the first -entry must be the writer's own, with `["_continuum"]`, or nobody may change the -registry again; add the other users the same way. +entry must be the writer's own, with `["_continuum"]` (a first write that isn't is +refused, `409`); add the other users the same way. + +## Keeping the swarm manageable + +A user may not lock itself out: a write that would keep its writer from managing users +(enabled, with `write` on `_continuum/users`) when it could, deleting, disabling or +narrowing its own entry, is refused (`409`), and nothing of it is written; so is one +that would remove the registry (`_continuum/users`). Others are not kept from removing +the last user who may manage users: each node can only judge what it holds, and two +such writes on two nodes at once would leave nobody once they merge anyway. Then, +while nobody may manage users, the users in a node's `--protocol-writers` may do +everything there again, to set it right. -- cgit v1.3.1