From ed27acb707d940c5b796b1079d3d74698484aeba Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 15:43:45 +0000 Subject: users: a user manages its own keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only a user who may manage users could change a user's keys: a user couldn't add a new laptop's key, or remove a lost one. A user now manages its own keys, whatever else it may do: * GET /auth/keys: its keys, its entry, and the envelope holding it under a strict policy (`signed`), to sign against. * PUT /auth/keys/{id} with an authorized_keys line, DELETE /auth/keys/{id}: one change, as the user. The rules take a write of _continuum/users//keys/… from the user it names. * Under a strict policy, the user signs its entry with only its keys changed, with a key it holds already (envelope::check takes that from the user itself), PUT to its own entry even without write on the registry; continuum-signed key-add and key-remove do so. --- src/swarm/refusals.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/swarm/refusals.rs') diff --git a/src/swarm/refusals.rs b/src/swarm/refusals.rs index 2ba7908..c1949eb 100644 --- a/src/swarm/refusals.rs +++ b/src/swarm/refusals.rs @@ -18,8 +18,8 @@ use std::time::Duration; use tracing::{debug, warn}; -use crate::document::replica::Epoch; use crate::document::ChangeHash; +use crate::document::replica::Epoch; use crate::state::AppState; use crate::transport::{ParsedMessage, RefusalsMessage}; -- cgit v1.3.1