From 98a9180e39742725a61fb1966e342d7d212beee9 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 04:46:19 +0000 Subject: access: what a node holds alone by `_continuum/local//` Setting a node's log filter took `write` on `_continuum`, all of the protocol data: whoever could change one node's logging could change the swarm's members, remakes and users too. Now what a node holds alone has paths of its own for capabilities, under `_continuum/local//`: `log` (`/admin/log`), `config` (`/admin/config`) and `debug` (`/debug`, always `write`), `read` to look and `write` to act (`api::access::needed`, which takes the node's ID). So `_continuum/local/` is everything on one node, `_continuum/local/*/log` the log filter on every node, and holders of `_continuum` keep it all. Nothing is stored there: the store refuses writes under `_continuum/local`, and the rules refuse a change touching it, as for epoch metadata. The quarantine stays with `_continuum`: its entries are everyone's writes, which a node-local capability mustn't show. --- src/api/store.rs | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'src/api/store.rs') diff --git a/src/api/store.rs b/src/api/store.rs index e43d129..00ced48 100644 --- a/src/api/store.rs +++ b/src/api/store.rs @@ -662,7 +662,8 @@ fn parse_key_path(key: &str) -> Result, StatusCode> { /// what every node acts on, so a write there acts on the whole swarm, and each is /// logged. Epoch metadata (and `_continuum` as a whole, which contains it) is never /// writable: the protocol reads it at the snapshot change, so an edit only misleads -/// whoever reads it later; nor is the swarm ID. A path inside a list or text is +/// whoever reads it later; nor is the swarm ID, nor `_continuum/local`, which names +/// what a node holds alone for capabilities and is never stored. A path inside a list or text is /// judged where the rules judge the write (`inspect::placed`): at the list. async fn parse_write_path( state: &AppState, @@ -674,8 +675,12 @@ async fn parse_write_path( let path = parse_key_path(key)?; let placed = crate::document::inspect::placed(&state.doc.read().await.doc, &path); let protocol = meta::is_protocol(&path); - // `_continuum` itself, epoch metadata and the swarm ID: nobody. - let fixed = protocol && (path.len() < 2 || path[1] == meta::EPOCHS || path[1] == meta::SWARM); + // `_continuum` itself, epoch metadata, the swarm ID and what is never stored: nobody. + let fixed = protocol + && (path.len() < 2 + || path[1] == meta::EPOCHS + || path[1] == meta::SWARM + || path[1] == meta::LOCAL); let allowed = match access { Access::Everything => !protocol || state.protocol_writers.contains(&user.0), Access::Caps(caps) => caps.allows(crate::access::Right::Write, &placed), -- cgit v1.3.1