From ed27acb707d940c5b796b1079d3d74698484aeba Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 15:43:45 +0000 Subject: users: a user manages its own keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only a user who may manage users could change a user's keys: a user couldn't add a new laptop's key, or remove a lost one. A user now manages its own keys, whatever else it may do: * GET /auth/keys: its keys, its entry, and the envelope holding it under a strict policy (`signed`), to sign against. * PUT /auth/keys/{id} with an authorized_keys line, DELETE /auth/keys/{id}: one change, as the user. The rules take a write of _continuum/users//keys/… from the user it names. * Under a strict policy, the user signs its entry with only its keys changed, with a key it holds already (envelope::check takes that from the user itself), PUT to its own entry even without write on the registry; continuum-signed key-add and key-remove do so. --- src/api/store.rs | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'src/api/store.rs') diff --git a/src/api/store.rs b/src/api/store.rs index 81d0046..16dd966 100644 --- a/src/api/store.rs +++ b/src/api/store.rs @@ -464,7 +464,16 @@ pub(crate) async fn put_store_entry( return Err(StatusCode::SERVICE_UNAVAILABLE.into()); } - let path = parse_write_path(&state, &user, &access, &key, "PUT")?; + // A user's own entry, signed by it: its keys are its own to change, whatever else it + // may do (`envelope::check` takes nothing else changed). + let own_entry = media_type(&headers) == SIGNED + && parse_key_path(&key) + .is_ok_and(|path| path == crate::access::registry::user_path(&user.0)); + let path = if own_entry { + crate::access::registry::user_path(&user.0) + } else { + parse_write_path(&state, &user, &access, &key, "PUT")? + }; let sign = Sign::Write { path: path.clone(), asked: query.signed, -- cgit v1.3.1