From b08c0bfd3ffcfd39ef2689882fafafbc31f16ffd Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 09:39:52 +0000 Subject: access: forgetting and revoking as the API lets Two writes the API lets a user make were refused by the rules: * DELETE /peers/{pk}, with write on _continuum/forgotten alone, writes the forget record and removes the member's entry in one change; the rules wanted write on the entry. Removing an entry is now also taken in a change forgetting that member, from a user who may forget it. * DELETE /admin/users/{name}/tokens by a user who manages users writes _continuum/logouts/; the rules wanted write there. One who may write _continuum/users may now write anyone's logouts entry. Review finding 3 (DELETE /peers, revoking tokens). --- docs/access.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'docs') diff --git a/docs/access.md b/docs/access.md index d46627a..3bc824b 100644 --- a/docs/access.md +++ b/docs/access.md @@ -220,12 +220,13 @@ written before the policy (at its dependencies) is judged by none: history from stays as it is, wherever it comes from later (a joining node catching up, say). * A member's entry (`_continuum/members/`) and its votes are written by that member - only; removing an entry, also by a user who may write there. + only; removing an entry, also by a user who may write there, or who forgets the + member in the same change (`DELETE /peers/{pk}`, with `_continuum/forgotten`). * Epochs and the swarm ID (`_continuum/epochs`, `_continuum/swarm`) by an epoch's first change only (the genesis change, a remake's snapshot). * A remake's decision by the coordinator its proposal names; the rest of a record by any member. -* A user's tokens revoked by that user too (logging out). +* A user's tokens revoked by that user too (logging out), and by one who manages users. * A member's forget record cancelled by that member too (forgotten while alive). * Everything else, protocol data or not, by a user the registry lets write there. * A map made on the way to what a change writes, where there was none (`servers`, for a -- cgit v1.3.1