From 925f566990fdd4043df691b3277a2a50b937ec1b Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 22:24:45 +0000 Subject: access: a limit that meets none of the user's capabilities gives nothing to look with Looking at a node (its figures, peers, dashboard: Need::Observe) takes any capability, a token's limit applied. Caps::is_empty is now true where no capability of the user meets one of the limit's (Capability::meet), as well as where there are none: a token limited to the member list, for a user who may only read data/eu, may not look. --- src/api/access.rs | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) (limited to 'src/api') diff --git a/src/api/access.rs b/src/api/access.rs index 6977a0a..ddcaad0 100644 --- a/src/api/access.rs +++ b/src/api/access.rs @@ -419,10 +419,22 @@ mod tests { by: String::new(), since: 0, }]; - let handed = Access::Caps(operator.clone().within(members)); + let handed = Access::Caps(operator.clone().within(members.clone())); let need = |method: &Method, at: &str| needed(method, at, "n1"); assert!(allowed(need(&Method::GET, "/admin/stats"), &handed)); assert!(allowed(need(&Method::GET, "/peers"), &handed)); + // A limit where the user has nothing: nothing to look with. + let elsewhere = Caps::new(vec![Capability { + path: path("data/eu"), + rights: ["read".to_owned()].into(), + by: String::new(), + since: 0, + }]) + .within(members.clone()); + assert!(!allowed( + need(&Method::GET, "/admin/stats"), + &Access::Caps(elsewhere) + )); for (method, at) in [ (Method::POST, "/auth/refresh"), (Method::DELETE, "/auth/session"), -- cgit v1.3.1