From c82a62186a8e0a46fd41e08345a2fa3e54ddffe2 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:09 +0100 Subject: access: authorization at the API Every request is judged by the registry the node holds: store reads pruned to what the user may read, writes refused where it may not, admin endpoints by protocol capabilities. Without a registry, as before (--protocol-writers for protocol data). Auth plan M1. --- src/document/store.rs | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) (limited to 'src/document') diff --git a/src/document/store.rs b/src/document/store.rs index db5ecbc..b343a2e 100644 --- a/src/document/store.rs +++ b/src/document/store.rs @@ -1250,6 +1250,16 @@ pub(crate) fn delete_path( doc: &mut impl Transactable, path: &[String], prune: bool, +) -> Result<(), StoreError> { + delete_path_pruning(doc, path, prune.then_some(1)) +} + +/// [`delete_path`], pruning maps left empty from the deepest up to the one at depth +/// `prune` (`Some(1)`: a top-level key at most; the root never), if given. +pub(crate) fn delete_path_pruning( + doc: &mut impl Transactable, + path: &[String], + prune: Option, ) -> Result<(), StoreError> { let (leaf, parents) = path.split_last().ok_or(StoreError::NotFound)?; @@ -1279,9 +1289,9 @@ pub(crate) fn delete_path( Resolved::Other(..) => return Err(StoreError::NotFound), } - if prune { + if let Some(floor) = prune { // Never prune the root (depth 0), nor through a list. - for depth in (1..levels.len()).rev() { + for depth in (floor.max(1)..levels.len()).rev() { let (Resolved::Maps(above), Resolved::Maps(maps)) = (&levels[depth - 1], &levels[depth]) else { -- cgit v1.3.1