From 3d7230d952aa4a71a1aeb64fee9841d16b70ed91 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:21 +0100
Subject: access: signatures required

"signatures": "required": a change counts only once a signature by its
committer vouches for it, and waits until then; every node then signs
every change it makes.

Auth plan M6.
---
 src/document/replica.rs | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

(limited to 'src/document/replica.rs')

diff --git a/src/document/replica.rs b/src/document/replica.rs
index a409969..cdf789c 100644
--- a/src/document/replica.rs
+++ b/src/document/replica.rs
@@ -229,6 +229,19 @@ impl Replica {
     pub(crate) fn logged<T>(
         &mut self,
         f: impl FnOnce(&mut Document, &mut automerge::PatchLog) -> (T, bool),
+    ) -> T {
+        self.logged_signed(|doc, _, log| f(doc, log))
+    }
+
+    /// [`logged`](Self::logged), `f` given the document's signatures too
+    /// (`access::screen`, judging received changes, checks theirs).
+    pub(crate) fn logged_signed<T>(
+        &mut self,
+        f: impl FnOnce(
+            &mut Document,
+            &mut super::signatures::Signatures,
+            &mut automerge::PatchLog,
+        ) -> (T, bool),
     ) -> T {
         use crate::locks::MutexExt;
         let before = sorted_heads(&self.doc);
@@ -238,7 +251,7 @@ impl Replica {
             // lead here.
             *log = Log::at(self.epoch_seq, before);
         }
-        let (out, whole) = f(&mut self.doc, &mut log.patches);
+        let (out, whole) = f(&mut self.doc, &mut self.signatures, &mut log.patches);
         let after = sorted_heads(&self.doc);
         if whole {
             log.to = after;
-- 
cgit v1.3.1