diff options
Diffstat (limited to 'docs/meshbay-draft-v5.md')
| -rw-r--r-- | docs/meshbay-draft-v5.md | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/docs/meshbay-draft-v5.md b/docs/meshbay-draft-v5.md index a8b7e4b..b03328b 100644 --- a/docs/meshbay-draft-v5.md +++ b/docs/meshbay-draft-v5.md @@ -250,6 +250,25 @@ version accepted a client-chosen path and overwrote whatever was there, which de deletion authorization as well: overwriting a file made the attacker its recorded uploader, and therefore the party allowed to delete it (C5a). +### 5.2b Removing a directory + +Creating a directory is not privileged (§5.2); removing one is, and it is refused +unless the directory is empty. The emptiness rule is the safety property: whatever +the caller intended, and whatever the browser sent, this operation cannot destroy +content. It is checked twice — once before the challenge is issued, and again +after the signature comes back, because a file can land during the round trip to +the operator's browser. + +Authorized by `_verify_admin_sig` alone. A file also accepts its uploader's key, +since the node recorded who put it there; a directory has no uploader, so there is +no second key to accept. + +Archives are not the node's business: a member downloading a folder as a zip +fetches the same encrypted chunks as any other download and assembles the archive +in the browser. The node serves no bundles, holds no temporary files, and cannot +be asked to compress anything — one fewer place where a request turns into work +on someone else's disk. + ### 5.3 Operator interface Two personas, and they need different tools: |