From a3e936154e07ba3b95157d26ffeae9364f3d5cef Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:21 +0100 Subject: access: logouts apart from users' entries _continuum/logouts/ holds when a user's tokens were last revoked, written by the user itself or by one who may manage users, so users' entries can be signed by their managers alone. Auth plan M7. --- src/api/login.rs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src/api') diff --git a/src/api/login.rs b/src/api/login.rs index b84a412..72a4d9d 100644 --- a/src/api/login.rs +++ b/src/api/login.rs @@ -8,7 +8,7 @@ //! * `POST /auth/refresh`, with a token: a new one for the same login, signed by this //! node, optionally narrower still (`limit`, within the token's). //! * `POST /auth/logout`: every token of the user, of every login, no longer taken -//! (`tokensNotBefore` in its registry entry). +//! (`_continuum/logouts/`, `registry::logouts_path`). //! * `GET /auth/whoami`: who the request's user is, how it proved it, what it may do. //! //! Every request may bring a token instead of a password: `Authorization: Bearer ct1…` @@ -258,7 +258,8 @@ pub(crate) async fn revoke_tokens(state: &AppState, name: &str, by: &str) -> Res if !state.is_ready().await { return Err(StatusCode::SERVICE_UNAVAILABLE.into()); } - let mut entry = registry::user_path(name); + let entry = registry::user_path(name); + let logouts = registry::logouts_path(name); // Issued in this very millisecond: revoked too. let after = state.clock.now_millis().as_u64() + 1; state @@ -275,8 +276,7 @@ pub(crate) async fn revoke_tokens(state: &AppState, name: &str, by: &str) -> Res if crate::document::store::read_path(&*doc, &entry)?.is_none() { return Err(ApiError(StatusCode::NOT_FOUND, None)); } - entry.push("tokensNotBefore".to_owned()); - crate::document::store::write_path(doc, &entry, &json!(after))?; + crate::document::store::write_path(doc, &logouts, &json!(after))?; Ok(()) }) .await?; -- cgit v1.3.1