From 98a9180e39742725a61fb1966e342d7d212beee9 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 04:46:19 +0000 Subject: access: what a node holds alone by `_continuum/local//` Setting a node's log filter took `write` on `_continuum`, all of the protocol data: whoever could change one node's logging could change the swarm's members, remakes and users too. Now what a node holds alone has paths of its own for capabilities, under `_continuum/local//`: `log` (`/admin/log`), `config` (`/admin/config`) and `debug` (`/debug`, always `write`), `read` to look and `write` to act (`api::access::needed`, which takes the node's ID). So `_continuum/local/` is everything on one node, `_continuum/local/*/log` the log filter on every node, and holders of `_continuum` keep it all. Nothing is stored there: the store refuses writes under `_continuum/local`, and the rules refuse a change touching it, as for epoch metadata. The quarantine stays with `_continuum`: its entries are everyone's writes, which a node-local capability mustn't show. --- src/access/rules.rs | 2 ++ 1 file changed, 2 insertions(+) (limited to 'src/access/rules.rs') diff --git a/src/access/rules.rs b/src/access/rules.rs index d8162a6..d120961 100644 --- a/src/access/rules.rs +++ b/src/access/rules.rs @@ -265,6 +265,8 @@ pub(crate) fn judge_reading( } // Written by a root only. (Some(meta::EPOCHS | meta::SWARM), _) => false, + // Never stored: named for capabilities only (`api::access::needed`). + (Some(meta::LOCAL), _) => false, // Logging out: a user revokes its own tokens (`POST /auth/logout`); one who // manages users, anyone's (`DELETE /admin/users/{name}/tokens`). (Some(meta::LOGOUTS), Some(owner)) => { -- cgit v1.3.1