Sharing

Share a folder with a key, choose a role and remove access when you need to.

Share a folder

Sharing takes a path, a key and a role. The other machine starts syncing that folder immediately, and nothing else on your machine is visible to it.

Bob can edit team. The agent can read it. Neither sees Alice's private folder.

$ rift share team bob✓ shared team with bob · write$ rift share team agent --read✓ shared team with agent · read$ rift members teamalice    admin   youbob      writeagent    read

bob and agent are aliases Alice saved with rift peer add. Aliases exist only on her machine. A full public key works in place of an alias.

Roles

write is the default. Every machine rejects an edit signed by a read key.

Share a subfolder

Share team/docs with Carol, a contractor, and her machine syncs that subfolder only. Nothing else in team reaches her machine, including file names.

Bob has the whole folder. Carol has one subfolder of it.

$ rift share team/docs carol✓ shared team/docs with carol · write$ rift members team/docsalice    admin   youbob      write   from teamcarol    write

Everyone with access to team keeps access to team/docs. A subfolder share only adds members.

Restrict a path

--exclusive limits a path to the keys you name. Members of the parent folder lose access to it. Here Alice shares .env with her agent, and Bob can no longer read it. Bob keeps any copy his machine already downloaded, so replace the secrets in it.

Bob sees that .env exists. New versions are encrypted with a key he was never sent.

$ rift share project-a/.env agent --read --exclusive✓ shared project-a/.env with agent · read! bob no longer has access to project-a/.env# bob$ rift cat project-a/.env✗ permission denied  project-a/.env is restricted to 2 keys

Remove access

Bob stops receiving changes. Files he already downloaded stay on his disk.

$ rift unshare team bob✓ removed bob from team · new key$ rift members teamalice    admin   youagent    read

After rift unshare, Bob cannot read anything new in team, and the other machines reject any change he sends. The folder gets a new key, and the remaining members receive it.

Removing access does not delete files Bob already downloaded. If one held a secret, replace that secret.

Moving a file to a folder with different members changes who can read it. See Move.