From c82a62186a8e0a46fd41e08345a2fa3e54ddffe2 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:09 +0100 Subject: access: authorization at the API Every request is judged by the registry the node holds: store reads pruned to what the user may read, writes refused where it may not, admin endpoints by protocol capabilities. Without a registry, as before (--protocol-writers for protocol data). Auth plan M1. --- docs/api.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'docs/api.md') diff --git a/docs/api.md b/docs/api.md index cdc722e..5486378 100644 --- a/docs/api.md +++ b/docs/api.md @@ -33,7 +33,11 @@ curl -u alice:secret -X POST 'localhost:3000/store/stats/visits?increment=1' # asks. Numbers in JSON are stored as integers where they fit, as floats otherwise. * Every request needs a user from the node's `--htpasswd` (basic authentication), or named by a reverse proxy in front that authenticated it (`--user-header`; - [`operations.md`](operations.md), Behind a reverse proxy). Users are all alike: each can read and write everything but protocol data (below). + [`operations.md`](operations.md), Behind a reverse proxy). What each may do, the swarm's user + registry says, by path ([`access.md`](access.md)): `403` where it doesn't let the user, and + of a part it may only partly read, a read shows the keys on the way to what it may. + In a swarm without a registry, users are all alike: each can read and write + everything but protocol data (below). * A key with `/` in it, or an empty key, can be written inside a value at its parent, but not named in a path: read it through the parent. @@ -238,8 +242,9 @@ who wrote what, until a remake drops the history ([`remakes.md`](remakes.md)). `_continuum` holds what the nodes coordinate through: the swarm ID, the member registry, remakes and votes ([`architecture.md`](architecture.md), The document). It is part of the store and shows -in `GET /store`, but isn't application data: only users in `--protocol-writers` may -write it, for repairs. Keep application data out of it, and leave it out when reading +in `GET /store`, but isn't application data: only users given it may write it +([`access.md`](access.md); in a swarm without a user registry, those in `--protocol-writers`), for +repairs. Keep application data out of it, and leave it out when reading the whole store if it's in the way. ## Large stores -- cgit v1.3.1