From eed8f86912f53f549d9f9068f9bdf2c8e23aa0f7 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:09 +0100 Subject: access: tokens ct1 tokens: who, how they logged in, a session, when they expire, and optionally a narrower limit; signed by the issuing node's key and taken by every member (a node ID is its key). Revocation by the registry as it stands when a request comes. Auth plan M2. --- src/access/registry.rs | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src/access/registry.rs') diff --git a/src/access/registry.rs b/src/access/registry.rs index 9eafc82..e0cbe47 100644 --- a/src/access/registry.rs +++ b/src/access/registry.rs @@ -63,6 +63,9 @@ pub(crate) struct User { pub(crate) by: String, pub(crate) caps: BTreeMap, pub(crate) disabled: bool, + /// Tokens issued before (Unix ms) are no longer taken (`token::verify`): how all + /// of a user's tokens are revoked at once. + pub(crate) tokens_not_before: u64, } impl User { @@ -90,6 +93,11 @@ impl User { disabled: value .get("disabled") .is_some_and(|disabled| disabled != &JsonValue::Bool(false)), + // A damaged one revokes every token. + tokens_not_before: match value.get("tokensNotBefore") { + None => 0, + Some(at) => at.as_u64().unwrap_or(u64::MAX), + }, } } -- cgit v1.3.1