From 42698f42eec18d24a7378fcbe1ede73add902b71 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:21 +0100
Subject: access: values sealed for their readers

cs1.<age file>: a value encrypted with age to its readers' SSH keys,
which no node decrypts. _continuum/access/sealed declares paths whose
values must be sealed, for named readers or anyone; nodes check the
recipients by age's key tags, at the API and on receipt.

Auth plan M8, reworked: sealed values instead of containers, readers
as users only (nodes hold no keys).
---
 src/api/store.rs | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'src/api/store.rs')

diff --git a/src/api/store.rs b/src/api/store.rs
index e61a09d..101957a 100644
--- a/src/api/store.rs
+++ b/src/api/store.rs
@@ -487,6 +487,7 @@ pub(crate) async fn put_store_entry(
             let before = Before::of(&*doc, &writer);
             let retyped = store::write_val_path(doc, &path, &body.value, writing)
                 .map_err(|e| store_status(e, "Failed to write store value"))?;
+            sealed_kept(&*doc, &path)?;
             registry_kept(&*doc, &path, before, &writer)?;
             // What was written, shown back to whoever wrote it.
             let read = read_shown(
@@ -570,6 +571,7 @@ async fn put_signed(
             let writing = store::Writing::new(store::Sticky::No, TimestampFormat::default(), true);
             store::write_val_path(doc, &path, &envelope, writing)
                 .map_err(|e| store_status(e, "Failed to write store value"))?;
+            sealed_kept(&*doc, &path)?;
             registry_kept(&*doc, &path, before, &writer)?;
             read_shown(
                 &*doc,
@@ -588,6 +590,12 @@ async fn put_signed(
     }
 }
 
+/// `409` for a write at `path` that leaves a value not sealed as the swarm declares
+/// (`access::sealed::kept`).
+fn sealed_kept(doc: &impl crate::document::ReadDoc, path: &[String]) -> Result<(), ApiError> {
+    crate::access::sealed::kept(doc, path).map_err(|why| ApiError(StatusCode::CONFLICT, Some(why)))
+}
+
 /// `409` for a write at `path` that its user didn't sign, under a strict policy
 /// (`access::policy`), where it would reach a value its user signs, at, within or above
 /// it (`access::envelope`): there, a signed `PUT` only.
@@ -946,6 +954,7 @@ pub(crate) async fn post_store_entry(
                 let before = Before::of(&*doc, &writer);
                 let value = store::increment_path(doc, &path, by)
                     .map_err(|e| store_status(e, "Failed to increment a counter"))?;
+                sealed_kept(&*doc, &path)?;
                 registry_kept(&*doc, &path, before, &writer)?;
                 Ok::<_, ApiError>(value)
             })
@@ -983,6 +992,7 @@ pub(crate) async fn post_store_entry(
                 let before = Before::of(&*doc, &writer);
                 let retyped = store::cast_path(doc, &path, to, timestamps)
                     .map_err(|e| store_status(e, "Failed to cast a store value"))?;
+                sealed_kept(&*doc, &path)?;
                 registry_kept(&*doc, &path, before, &writer)?;
                 let read = read_shown(
                     &*doc,
@@ -1007,6 +1017,7 @@ pub(crate) async fn post_store_entry(
             let before = Before::of(&*doc, &writer);
             store::insert_val_path(doc, &path, &value.value)
                 .map_err(|e| store_status(e, "Failed to insert into a list"))?;
+            sealed_kept(&*doc, &path)?;
             registry_kept(&*doc, &path, before, &writer)
         })
         .await?;
-- 
cgit v1.3.1