From c1e750c5f795d4dd659be99f873ab7f98d5a2e83 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 9 Nov 2026 15:34:54 +0000
Subject: api: a stream opened by password or a proxy's header ends with its
 user

Review 4, F11: only streams answered to a token ended with it (1273); one opened by
password (basic authentication) or a proxy's header went on after its user was
disabled or removed.

`streams_end` now wraps those too, by the user `basic_auth` leaves on the answer: such
a stream ends once the document no longer has its user, enabled
(`token::user_taken`, the part of a token's check about its user, which
`still_taken` uses too), looked at as the stream begins and as protocol data changes.
No expiry: a password has none.
---
 src/access/token.rs | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

(limited to 'src/access/token.rs')

diff --git a/src/access/token.rs b/src/access/token.rs
index a9fc270..153737e 100644
--- a/src/access/token.rs
+++ b/src/access/token.rs
@@ -174,11 +174,8 @@ fn issuer_counts(doc: &impl ReadDoc, claims: &Claims) -> Result<(), Refused> {
 /// In a swarm with a registry: its user registered, enabled, its tokens not revoked
 /// since it was issued, its session not ended.
 fn user_counts(doc: &impl ReadDoc, claims: &Claims) -> Result<(), Refused> {
-    if registry::exists(doc) {
-        let user = registry::user(doc, &claims.user).ok_or(Refused::UnknownUser)?;
-        if user.disabled {
-            return Err(Refused::Disabled);
-        }
+    user_taken(doc, &claims.user)?;
+    if let Some(user) = registry::user(doc, &claims.user) {
         if claims.iat < user.tokens_not_before {
             return Err(Refused::Revoked);
         }
@@ -189,6 +186,19 @@ fn user_counts(doc: &impl ReadDoc, claims: &Claims) -> Result<(), Refused> {
     Ok(())
 }
 
+/// In a swarm with a registry: user `name` registered and enabled. What a stream opened
+/// by password or a proxy's header is judged by as the document changes
+/// (`api::login::streams_end`), as one opened with a token is by `still_taken`.
+pub(crate) fn user_taken(doc: &impl ReadDoc, name: &str) -> Result<(), Refused> {
+    if registry::exists(doc) {
+        let user = registry::user(doc, name).ok_or(Refused::UnknownUser)?;
+        if user.disabled {
+            return Err(Refused::Disabled);
+        }
+    }
+    Ok(())
+}
+
 /// A new session's ID (8 random bytes, hex).
 pub(crate) fn new_session() -> String {
     registry::new_id()
-- 
cgit v1.3.1