From d773aac637a2e6dd516d4414c5e58ba3599df1b7 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 18:13:54 +0000 Subject: access: a change judged by the policy it was written under, locally too Review 2, N10: the judgement before a change leaves (1140) and a replay's (1141) skipped changes when the document *with* the change had no policy it enforces. A write removing the policy, or setting one the node doesn't know, then left unjudged, while receivers judge it at its dependencies, where the policy was enforced. Both now read the policy at the heads before the change, as receivers do. --- src/remake/delta.rs | 5 ++++- src/state/mod.rs | 6 +++++- 2 files changed, 9 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/remake/delta.rs b/src/remake/delta.rs index dd5df4f..a152861 100644 --- a/src/remake/delta.rs +++ b/src/remake/delta.rs @@ -203,7 +203,10 @@ fn judged( epoch: crate::document::replica::Epoch, before: &[ChangeHash], ) -> Result<(), String> { - if !crate::access::policy::of(doc).enforced() { + // By the policy it was written under, as receivers judge it. + let enforced = crate::document::at::At::new(doc, before) + .is_some_and(|at| crate::access::policy::of(&at).enforced()); + if !enforced { return Ok(()); } match doc.get_heads()[..] { diff --git a/src/state/mod.rs b/src/state/mod.rs index ed93fda..441cdaf 100644 --- a/src/state/mod.rs +++ b/src/state/mod.rs @@ -250,7 +250,11 @@ fn judged_here( replica: &crate::document::replica::Replica, before: &[crate::document::ChangeHash], ) -> Result<(), String> { - if !crate::access::policy::of(&replica.doc).enforced() { + // By the policy it was written under, as receivers judge it: one removing or + // changing the policy is judged too. + let enforced = crate::document::at::At::new(&replica.doc, before) + .is_some_and(|at| crate::access::policy::of(&at).enforced()); + if !enforced { return Ok(()); } let after = replica.doc.get_heads(); -- cgit v1.3.1