From 046b738c74f62469f7a080415690e2dacd85e1e6 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:21 +0100
Subject: remake: forgetting and releasing name their user

Forget records and released quarantines name the user who made them,
so they are judged by its capabilities.

Auth plan M6.
---
 src/remake/quarantine.rs | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

(limited to 'src/remake/quarantine.rs')

diff --git a/src/remake/quarantine.rs b/src/remake/quarantine.rs
index bb34d73..e7214d6 100644
--- a/src/remake/quarantine.rs
+++ b/src/remake/quarantine.rs
@@ -159,7 +159,13 @@ pub(crate) async fn document<H: Host>(State(host): State<H>, Path(id): Path<Stri
     }
 }
 
-pub(crate) async fn replay<H: Host>(State(host): State<H>, Path(id): Path<String>) -> Response {
+/// `POST /admin/quarantine/{id}/replay`: the entry's paths written as they were,
+/// by the user who asked (`access::rules` judges the change by them).
+pub(crate) async fn replay<H: Host>(
+    State(host): State<H>,
+    user: Option<axum::Extension<crate::api::auth::AuthenticatedUser>>,
+    Path(id): Path<String>,
+) -> Response {
     if !host.is_node_ready().await {
         return error_response(StatusCode::SERVICE_UNAVAILABLE, "node is not ready", None);
     }
@@ -170,7 +176,8 @@ pub(crate) async fn replay<H: Host>(State(host): State<H>, Path(id): Path<String
     let entry = Arc::new(entry);
     let replayed = {
         let entry = Arc::clone(&entry);
-        host.commit_doc(move |doc| {
+        let user = user.map(|axum::Extension(user)| user.0);
+        host.commit_doc_for(user, move |doc| {
             // As they are: the operator decided they belong at their old paths.
             Ok::<_, StoreError>(delta::replay_paths(
                 &entry.document,
-- 
cgit v1.3.1