From 4ecb4ee5c0a49fc6d78ae06e21f6bb1571e290cb Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 09:41:05 +0000 Subject: remake: replay from the quarantine where the user may write POST /admin/quarantine/{id}/replay needs write on _continuum, which never covers user data, and replayed every path of the entry as the user who asked: every node refused the user data in it. It now replays only the paths the user may write and keeps the rest in the entry (left), for one who may; 403 if the user may write none. Review finding 3 (quarantine replays). --- docs/remakes.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'docs/remakes.md') diff --git a/docs/remakes.md b/docs/remakes.md index cad429f..8e585c6 100644 --- a/docs/remakes.md +++ b/docs/remakes.md @@ -339,7 +339,9 @@ curl -X DELETE localhost:3000/admin/quarantine/ # discard ``` Replaying writes the values at their old paths as fresh writes (they win over what is -there now), in the name of the user who asked. Quarantine doesn't survive a restart of that node, so look at it soon; the +there now), in the name of the user who asked: only at the paths it may write, as every +node judges the change by them ([`access.md`](access.md)); the rest stay (`left`), for +one who may. Quarantine doesn't survive a restart of that node, so look at it soon; the remake report's `local.quarantine` on that node names the entry. ## Troubleshooting -- cgit v1.3.1