From 3a9d9da74f55395ead20f3915ed04639e37b2f03 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:09 +0100
Subject: access: bootstrap users only

The first users come only from --bootstrap-users; the genesis node
warns of htpasswd users that aren't among them.

Auth plan M1.
---
 src/access/registry.rs | 35 +++++++++--------------------------
 1 file changed, 9 insertions(+), 26 deletions(-)

(limited to 'src/access/registry.rs')

diff --git a/src/access/registry.rs b/src/access/registry.rs
index 094e62c..3006b31 100644
--- a/src/access/registry.rs
+++ b/src/access/registry.rs
@@ -146,24 +146,12 @@ pub(crate) fn capability(by: &str, since: u64, path: &[String], rights: &[Right]
 /// included), not only read and write the swarm's data.
 pub(crate) type FirstUsers = Vec<(String, bool)>;
 
-/// The first users of a new swarm, from the genesis node's options: those of
-/// `bootstrap_users` may do everything, and the other users of its htpasswd file
-/// (`htpasswd`) read and write the swarm's data. None without `bootstrap_users`: then
-/// the swarm has no registry, and its users are all alike, as before there were
-/// registries (`access.md`).
-pub(crate) fn first_users(bootstrap_users: &[String], htpasswd: &[String]) -> FirstUsers {
-    if bootstrap_users.is_empty() {
-        return Vec::new();
-    }
-    let mut users: BTreeMap<String, bool> = htpasswd
-        .iter()
-        .filter(|name| valid_name(name))
-        .map(|name| (name.clone(), false))
-        .collect();
-    for name in bootstrap_users {
-        users.insert(name.clone(), true);
-    }
-    users.into_iter().collect()
+/// The first users of a new swarm, from the genesis node's `--bootstrap-users`: each may
+/// do everything. None without: then the swarm has no registry, and its users are all
+/// alike, as before there were registries (`access.md`).
+pub(crate) fn first_users(bootstrap_users: &[String]) -> FirstUsers {
+    let users: std::collections::BTreeSet<&String> = bootstrap_users.iter().collect();
+    users.into_iter().map(|name| (name.clone(), true)).collect()
 }
 
 /// The capabilities of a first user (`first_users`): the swarm's data, and for one who
@@ -261,16 +249,11 @@ mod tests {
     fn the_first_users() {
         let names = |list: &[&str]| list.iter().map(|n| (*n).to_owned()).collect::<Vec<_>>();
         assert_eq!(
-            first_users(&names(&["alice"]), &names(&["alice", "bob"])),
-            vec![("alice".to_owned(), true), ("bob".to_owned(), false)]
-        );
-        // One the proxy names, not in htpasswd.
-        assert_eq!(
-            first_users(&names(&["carol"]), &names(&["bob"])),
-            vec![("bob".to_owned(), false), ("carol".to_owned(), true)]
+            first_users(&names(&["bob", "alice", "bob"])),
+            vec![("alice".to_owned(), true), ("bob".to_owned(), true)]
         );
         // Without bootstrap users, no registry.
-        assert!(first_users(&[], &names(&["alice"])).is_empty());
+        assert!(first_users(&[]).is_empty());
         let admin = Caps::new(
             first_caps(true)
                 .into_iter()
-- 
cgit v1.3.1