From ed27acb707d940c5b796b1079d3d74698484aeba Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 15:43:45 +0000 Subject: users: a user manages its own keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only a user who may manage users could change a user's keys: a user couldn't add a new laptop's key, or remove a lost one. A user now manages its own keys, whatever else it may do: * GET /auth/keys: its keys, its entry, and the envelope holding it under a strict policy (`signed`), to sign against. * PUT /auth/keys/{id} with an authorized_keys line, DELETE /auth/keys/{id}: one change, as the user. The rules take a write of _continuum/users//keys/… from the user it names. * Under a strict policy, the user signs its entry with only its keys changed, with a key it holds already (envelope::check takes that from the user itself), PUT to its own entry even without write on the registry; continuum-signed key-add and key-remove do so. --- src/api/mod.rs | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'src/api/mod.rs') diff --git a/src/api/mod.rs b/src/api/mod.rs index 0e7fc21..43d3c20 100644 --- a/src/api/mod.rs +++ b/src/api/mod.rs @@ -74,6 +74,11 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) -> ) .route("/auth/logout", axum::routing::post(login::logout)) .route("/auth/whoami", get(login::whoami)) + .route("/auth/keys", get(users::own_keys)) + .route( + "/auth/keys/{id}", + axum::routing::put(users::put_own_key).delete(users::delete_own_key), + ) .route("/admin/users", get(users::list).post(users::add_several)) .route("/admin/users/{name}/tokens", delete(users::revoke_tokens)) .route( -- cgit v1.3.1