Team Cloud
Protected sets and reviews
Since 0.7.0 Requires Cloak Proxy 0.7.0 or later.
Protect a team rule or mock set so editors' changes become proposals that a manager reviews and approves, with self-approval refused and every Mac checking the approval.
A protected rule or mock set changes only through review. Editors propose changes, a manager approves them, and every member’s Mac checks the approval before it applies the change. Use it for sets that affect everyone’s traffic, such as shared staging mocks.
Protect a set
Section titled “Protect a set”A manager of the set opens its Info sheet and turns on Protected. From then on:
- Editors’ saves become proposals. The Save button reads Propose Change…, which opens a sheet with a title, a note and the diff.
- Managers get a review requested notification.
- Managers may change it without review (bypass) is off by default. A manager can turn it on for the set, unless the policy below forbids it.
The sidebar marks a protected set with a shield.
Review a proposal
Section titled “Review a proposal”-
Open Reviews in the sidebar under Team: Acme, or from the Team menu. The count shows how many are open.
-
Choose a proposal on the left: its title, author, set and age. The diff is on the right.
-
Choose Approve, Request Changes (which adds a comment) or Decline.
An approved change is written with a reference to the approval, and applies on every member’s Mac that has the set switched on. Because a manager approved it, it applies even when it runs code or reads files on the Mac, such as a script.
What’s checked
Section titled “What’s checked”- No self-approval. A manager can’t approve their own proposal. The server refuses it, and every Mac skips it.
- The approval must match. Each Mac checks that the approval was signed by a manager of the set and covers exactly the change it’s attached to. A forged or reused approval is skipped.
- Direct writes are refused. An editor’s direct change to a protected set is refused by the server, and a Mac skips any unapproved version that gets through.
Because the check runs on every Mac with the team’s signatures, Subcloak’s server can’t approve a change, and neither can a member who isn’t a manager of the set.
Require review for everyone
Section titled “Require review for everyone”The policy Require review for protected sets (no bypass for anyone) stops anyone, admins included, from turning on bypass. It’s enforced by Subcloak’s server, which refuses access lists with bypass on, and by each Mac, which refuses them while the policy is on. The review rule itself is enforced by signatures, whatever the policy says.