From f2487f5a1f897bb5499ffd782562f53967f20606 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:09 +0100 Subject: access: keeping the swarm manageable A write that would leave its own writer unable to manage users (deleting, disabling or narrowing its entry, removing the registry) is refused; --protocol-writers can set a registry right that nobody may manage any more. Auth plan M1. --- src/api/access.rs | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'src/api/access.rs') diff --git a/src/api/access.rs b/src/api/access.rs index 8a3e630..ade6542 100644 --- a/src/api/access.rs +++ b/src/api/access.rs @@ -9,7 +9,7 @@ use axum::{ response::Response, }; use serde_json::Value as JsonValue; -use tracing::debug; +use tracing::{debug, warn}; use super::auth::AuthenticatedUser; use super::error_response; @@ -194,6 +194,13 @@ pub(crate) async fn authorize( let replica = state.doc.read().await; if !registry::exists(&replica.doc) { Access::Everything + } else if state.protocol_writers.contains(&user) + && registry::managers(&replica.doc).is_empty() + { + // Nobody may manage users any more (two removals at once, merged; or an + // entry damaged): this node's protocol writers may set it right. + warn!(user = %user, "The user registry has nobody who may manage users; a protocol writer may do everything until it has"); + Access::Everything } else { match registry::user(&replica.doc, &user) { Some(entry) => Access::Caps(entry.caps()), -- cgit v1.3.1