From a3e936154e07ba3b95157d26ffeae9364f3d5cef Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:21 +0100 Subject: access: logouts apart from users' entries _continuum/logouts/ holds when a user's tokens were last revoked, written by the user itself or by one who may manage users, so users' entries can be signed by their managers alone. Auth plan M7. --- src/access/rules.rs | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) (limited to 'src/access/rules.rs') diff --git a/src/access/rules.rs b/src/access/rules.rs index c061893..4df0ba8 100644 --- a/src/access/rules.rs +++ b/src/access/rules.rs @@ -125,12 +125,7 @@ pub(crate) fn judge(doc: &Document, epoch: Epoch, change: &Change<'_>) -> Result // Written by a root only. (Some(meta::EPOCHS | meta::SWARM), _) => false, // Logging out: a user revokes its own tokens (`POST /auth/logout`). - (Some(meta::USERS), Some(owner)) - if path.get(3).map(String::as_str) == Some("tokensNotBefore") - && change.user == Some(owner) => - { - true - } + (Some(meta::LOGOUTS), Some(owner)) => change.user == Some(owner) || user_may(path), (Some(meta::REMAKES), Some(id)) => match path.get(3).map(String::as_str) { // Its coordinator's; or a record carried into a new epoch whole, by the // node that coordinated it (`remake::switch`): its proposal written with it. @@ -312,7 +307,7 @@ mod tests { &["_continuum/neighbours"] ))); // Logging out: its own tokens only. - let tokens = "_continuum/users/bob/tokensNotBefore"; + let tokens = "_continuum/logouts/bob"; assert!(judged(&doc, "a", Some("bob"), &[tokens]).is_ok()); assert!(refused(judged(&doc, "a", Some("alice"), &[tokens]))); } -- cgit v1.3.1