Merge branch 'fix/third-review-h1-h2-m1-m6'

Third security review (docs/third-review.md) plus its remediation.

Fixed and verified:
- H1  moderator could grant admin / hard-revoke  → handler split by field
- H2  unauthenticated 2-report global blocklist  → auth + distinct reporters
      + rate limit + refused when public groups are off
- M1  registration reCAPTCHA was inert           → gate unconditional; the
      desktop client's CSP allows the widget
- M2  QUIC chat/stream handlers lagged WebRTC    → brought to parity; the QUIC
      listener is now off by default ([node] quic_enabled)
- M3  link-preview SSRF gaps                      → rate limit + port allowlist
      + connect-address re-check + decompression-bomb guard
- M4  federated peer over-trust                   → source bound to the signer,
      push capped, revocation prunes the peer's own entries, replay rejected
- M5  no CSP / security headers on the SPA        → middleware; verified against
      the live app with no violations

Withdrawn:
- M6  add_group_member accepting node tokens is deliberate (commit 0443cf8,
      the CLI invite flow). The "fix" broke that flow on the deployed hub and
      was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

1 files changed, 20 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/admin.py b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
index ab6fa07..4960674 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/admin.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
@@ -14,7 +14,7 @@ from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub.auth import decrypt_email
-from meshbay_hub.api.deps import require_admin, require_moderator
+from meshbay_hub.api.deps import require_admin, require_moderator, user_is_admin
 from meshbay_hub.api.revocation import get_connected_node_count, is_node_connected
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import Group, GroupMember, IPLog, Node, User
@@ -196,6 +196,25 @@ async def admin_patch_user(
     if user.id == current_user.id:
         raise HTTPException(status_code=400, detail="Cannot modify your own account")
 
+    # A moderator suspends and restores accounts — reversible content moderation.
+    # Changing what someone *is* (their role), and the one irreversible status
+    # (`revoked`, which is signed and broadcast to every node), are administrative.
+    # Without this split a moderator could promote an accomplice to admin, or
+    # revoke every admin, entirely from the moderation role. `admin_delete_user`
+    # already draws this exact line for the same reason.
+    privileged = body.role is not None or body.status == "revoked"
+    if privileged and not user_is_admin(current_user):
+        raise HTTPException(
+            status_code=403,
+            detail="Changing a role, or revoking an account, requires admin rights")
+
+    # An admin's account is not a moderator's to touch at all — not their role,
+    # not their status.
+    if user_is_admin(user) and not user_is_admin(current_user):
+        raise HTTPException(
+            status_code=403,
+            detail="Only an admin can change another admin's account")
+
     from meshbay_hub.api.notifications import create_notification
 
     if body.role is not None: