From 3a9d9da74f55395ead20f3915ed04639e37b2f03 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:09 +0100 Subject: access: bootstrap users only The first users come only from --bootstrap-users; the genesis node warns of htpasswd users that aren't among them. Auth plan M1. --- src/main.rs | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) (limited to 'src/main.rs') diff --git a/src/main.rs b/src/main.rs index 2b8c376..fb3c0ad 100644 --- a/src/main.rs +++ b/src/main.rs @@ -97,16 +97,24 @@ async fn main() -> Result<()> { // A broken htpasswd will abort startup. let auth_state = AuthState::from_settings(&args)?.context("htpasswd or user-header is required")?; - // A new swarm's first users, if it is to have a user registry. - let first_users = if args.genesis && !args.bootstrap_users.is_empty() { - let htpasswd = match args.htpasswd.as_deref() { - Some(path) => api::auth::htpasswd_names(path)?, - None => Vec::new(), - }; - access::registry::first_users(&args.bootstrap_users, &htpasswd) + // A new swarm's first users, if it is to have a user registry; the users of the + // htpasswd file that aren't among them may do nothing until they are added. + let first_users = if args.genesis { + access::registry::first_users(&args.bootstrap_users) } else { Vec::new() }; + if !first_users.is_empty() + && let Some(path) = args.htpasswd.as_deref() + { + let missing: Vec = api::auth::htpasswd_names(path)? + .into_iter() + .filter(|name| !args.bootstrap_users.contains(name)) + .collect(); + if !missing.is_empty() { + warn!(users = ?missing, "Users of htpasswd not among bootstrap-users: the new swarm's registry doesn't have them, so they may do nothing until added (docs/access.md)"); + } + } info!( bind_addr = ?args.bind_addr.iter().map(ToString::to_string).collect::>(), -- cgit v1.3.1