meshbay.git/packages/meshbay-hub/src/meshbay_hub/api, branch 0.17MeshBay — read-only public mirrorhttps://git.meshbay.org/meshbay.git/atom?h=0.172026-10-01T11:37:38Zfix(hub): a username is unique whatever its case2026-10-01T11:37:38ZChristophe Bessoncbesson@gmail.com2026-10-01T11:37:38Zurn:sha1:7ca80a47dd8ff529951f59ef586c511e4debb057
Registration refuses a name that differs from an existing one only by case;
accounts that already do keep their names, and a pending retry needs the exact
name (F-26).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(hub): what an offer or a node message costs the hub is bounded2026-10-01T11:37:38ZChristophe Bessoncbesson@gmail.com2026-10-01T11:37:38Zurn:sha1:aeec8ee7c9e39704433d93c82fafc0f5721d6fbf
An offer's IP-log row (kept a year) was written before any check, for any
string named as a node; it is written once the offer goes to a node. The ICE
list is capped (64 candidates, 32 KiB). A node's update_groups, a database read
each, is budgeted like chat_notify and claims at most 1000 groups (F-22).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(hub): a stranger who knows your name locks only browsers you never used2026-10-01T09:47:39ZChristophe Bessoncbesson@gmail.com2026-10-01T09:47:39Zurn:sha1:752b160c7c5e671e0db8f402a52fac27bb85ab06
A sign-in from a browser that presented no token is answered with one
(known_browser, kept hashed, twenty per account); a later sign-in presenting it
counts failures on its own row, which nobody else can spend. Passphrase checks
inside an open session (change, e-mail, deletion, device, pepper) count on the
account's own row, so a locked name no longer stops its owner there either; /me
reports that row. Reset and erasure forget the browsers (F-15).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(hub): a group name fits its column and carries no control characters2026-10-01T08:06:26ZChristophe Bessoncbesson@gmail.com2026-10-01T08:06:26Zurn:sha1:cf4fdda3523015248b3ff1f3e928ce9e69cc5a12
Over 128 characters was a 500 on PostgreSQL; line breaks, C0/C1 controls and
bidi overrides are refused (joiners stay, for emoji). The creation form caps
the field at 128 (F-13, what remains of it).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(hub): the pepper and a device key take the passphrase, not a token2026-09-30T19:04:39ZChristophe Bessoncbesson@gmail.com2026-09-30T19:04:39Zurn:sha1:0ed56d3a1b4f71cf622d3e27edc87a15ef33c185
POST /me/bundle-pepper (was GET) and POST /users/devices require auth_key.
A refreshed or lifted token could otherwise fetch the pepper, or register a
device whose every sign-in carries it. Both callers have just been given the
passphrase.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat: browser access, decided in the desktop application2026-09-30T15:13:40ZChristophe Bessoncbesson@gmail.com2026-09-30T15:13:40Zurn:sha1:b1ebcdeb9082457972c41a47e77494902335d262
Off for an account made there: its identities stay on the device and nothing is
left on nodes. Turned on from the Profile page behind a native confirmation;
each node is settled when its group next opens. The hub keeps a mirror a
browser reads to say why a group will not open; it grants nothing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore: bump version to 0.17.0, and the client minimum with it2026-09-30T13:16:25ZChristophe Bessoncbesson@gmail.com2026-09-30T13:16:25Zurn:sha1:8d96cf2314b45e0737f932998b5422c27a2ae72e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat: bundles sealed per node under the passphrase and the hub's pepper2026-09-30T13:06:14ZChristophe Bessoncbesson@gmail.com2026-09-30T13:06:14Zurn:sha1:91297944791a36f30302ef8c86dd69ebeb177671
The session key is M = HKDF(Argon2(passphrase) || pepper, account id); each
node's bundle key and the playlist key derive from it. Bundles are MBK3, bound
to account and node; MBK1/MBK2 are refused by name, never replaced silently.
Playlists move to key v2 and are re-sealed over unreadable node copies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(hub): a bundle pepper per account, handed only to a proven session2026-09-30T11:55:59ZChristophe Bessoncbesson@gmail.com2026-09-30T11:55:59Zurn:sha1:a55d40b74bda77dff6ec565abdd551607fc665d6
Sealed at rest and bound to the account; returned by sign-in, device sign-in,
a passphrase change and GET /me/bundle-pepper, never by a refresh, to a node
token, in a token or in a log. Erasure clears it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: the page connects to its own origin and reCAPTCHA, nowhere else2026-09-30T11:09:54ZChristophe Bessoncbesson@gmail.com2026-09-30T11:09:47Zurn:sha1:87725dc7a2da27c2ca3b9e58af751f0e6f8c9de7
connect-src drops https: and wss: in both policies. Checked against Google's
reCAPTCHA test keys: in Chrome widget, token and registration unchanged; in
Firefox the widget loads; no violation reported in either.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>