feat: nodes apply the content blocklist in their public groups

A node hosting a public group syncs the hub's blocklist on every
connection (paged, node token only) and applies pushed changes. A
blocked file leaves the index and is refused (content_blocked); private
groups are untouched. The unused per-hash check route is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 32 insertions, 36 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/moderation.py b/packages/meshbay-hub/src/meshbay_hub/api/moderation.py
index 35c688c..c4e6af5 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/moderation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/moderation.py
@@ -18,8 +18,9 @@ Admin endpoints:
   DELETE /v1/admin/blocklist/{hash} — remove a hash
 
 Node integration:
-  GET  /v1/blocklist/check?hash=<blake3> — check if a hash is blocked
-  GET  /v1/blocklist                     — full blocklist (for node sync)
+  GET  /v1/blocklist?after=<hash>  — the list, paged, for a node's own token
+  WebSocket `blocklist_update`      — additions and removals, pushed to nodes
+                                      hosting a public group
 """
 
 import logging
@@ -30,9 +31,10 @@ from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from meshbay_hub import hub_settings
-from meshbay_hub.api.deps import get_current_user, require_admin
+from meshbay_hub.api.deps import get_current_user, require_admin, require_node_scope
 from meshbay_hub.api.middleware import limiter
 from meshbay_hub.api.netutil import client_ip
+from meshbay_hub.api.revocation import broadcast_blocklist_update
 from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import ContentBlocklist, ContentReport, User
 
@@ -47,6 +49,10 @@ router = APIRouter(tags=["moderation"])
 AUTO_BLOCK_THRESHOLD = 3
 
 
+def _is_hash(value: str) -> bool:
+    return len(value) == 64 and all(c in "0123456789abcdef" for c in value)
+
+
 # ── Models ────────────────────────────────────────────────────────────────────
 
 class ReportRequest(BaseModel):
@@ -89,7 +95,7 @@ async def report_content(
             status_code=403,
             detail="This hub does not broker public content, so there is nothing to report here.")
 
-    if len(body.content_hash) != 64 or not all(c in "0123456789abcdef" for c in body.content_hash):
+    if not _is_hash(body.content_hash):
         raise HTTPException(status_code=422, detail="content_hash must be 64 hex chars (blake3)")
 
     # One vote per account per hash — a single reporter must not be able to walk
@@ -115,6 +121,7 @@ async def report_content(
         .where(ContentReport.content_hash == body.content_hash)) or 0
 
     action = "already_reported" if already else "logged"
+    auto_blocked = False
     if distinct_reporters >= AUTO_BLOCK_THRESHOLD:
         existing = await db.get(ContentBlocklist, body.content_hash)
         if not existing:
@@ -124,10 +131,13 @@ async def report_content(
                 added_by="auto",
             ))
             action = "auto_blocked"
+            auto_blocked = True
             log.warning("Content auto-blocked after %d distinct reporters: %s",
                         distinct_reporters, body.content_hash[:16])
 
     await db.commit()
+    if auto_blocked:
+        await broadcast_blocklist_update(db, add=[body.content_hash])
     return {
         "status":       action,
         "content_hash": body.content_hash,
@@ -136,49 +146,31 @@ async def report_content(
     }
 
 
-@router.get("/v1/blocklist/check")
-@limiter.limit("120/minute")
-async def check_blocklist(
-    hash: str,
-    request: Request,
-    db: AsyncSession = Depends(get_db),
-):
-    """Check if a single hash is blocked. Used by nodes before serving public content.
-
-    Unauthenticated, because a node consults it before serving public content
-    and does so on its own behalf. That makes the shape check worth having:
-    without it any string of any length became a primary-key lookup.
-    """
-    if len(hash) != 64 or not all(c in "0123456789abcdef" for c in hash):
-        raise HTTPException(status_code=422, detail="hash must be 64 hex chars (blake3)")
-    blocked = await db.get(ContentBlocklist, hash)
-    return {
-        "blocked": blocked is not None,
-        "hash":    hash,
-        "reason":  blocked.reason if blocked else None,
-    }
-
-
 @router.get("/v1/blocklist")
 async def get_blocklist(
+    current_node: User = Depends(require_node_scope),
     db: AsyncSession = Depends(get_db),
-    # Bounded, like every other list. This one takes no authentication — a
-    # node syncs it at startup — and had no ceiling at all, so any stranger
-    # could ask for the table in one query, repeatedly. 10 000 is what a node
-    # asks for, so it is the default and also the most anyone may have.
+    after: str = Query(default="", max_length=64),
     limit: int = Query(default=10000, ge=1, le=10000),
 ):
     """
-    Return the full blocklist. Nodes sync this on startup.
-    Returns hashes only (not reasons) to minimize data exposure.
+    The content blocklist, a page at a time, for a node hosting a public group.
+
+    Hashes only, never the reasons. Ordered by hash so `after` (the last hash of
+    the previous page) is a stable cursor: a list longer than one page used to
+    be cut at 10 000 with no way to ask for the rest, and the node applying it
+    silently served everything past the cut. A node's own token, because this
+    is what a node fetches on its own behalf and nothing else asks for it.
     """
     result = await db.execute(
         select(ContentBlocklist.content_hash)
-        .order_by(ContentBlocklist.added_at.desc())
+        .where(ContentBlocklist.content_hash > after)
+        .order_by(ContentBlocklist.content_hash)
         .limit(limit)
     )
     hashes = [row[0] for row in result.fetchall()]
-    return {"count": len(hashes), "hashes": hashes}
+    return {"hashes": hashes,
+            "next": hashes[-1] if len(hashes) == limit else None}
 
 
 # ── Admin endpoints ───────────────────────────────────────────────────────────
@@ -214,16 +206,19 @@ async def admin_add_blocklist(
     current_user: User = Depends(require_admin),
     db: AsyncSession = Depends(get_db),
 ):
+    if not _is_hash(body.content_hash):
+        raise HTTPException(status_code=422, detail="content_hash must be 64 hex chars (blake3)")
     existing = await db.get(ContentBlocklist, body.content_hash)
     if existing:
         raise HTTPException(status_code=409, detail="Hash already blocked")
 
     db.add(ContentBlocklist(
         content_hash=body.content_hash,
-        reason=body.reason,
+        reason=body.reason[:64],
         added_by=current_user.username,
     ))
     await db.commit()
+    await broadcast_blocklist_update(db, add=[body.content_hash])
     return {"status": "blocked", "hash": body.content_hash}
 
 
@@ -238,5 +233,6 @@ async def admin_remove_blocklist(
         raise HTTPException(status_code=404, detail="Hash not in blocklist")
     await db.delete(entry)
     await db.commit()
+    await broadcast_blocklist_update(db, remove=[content_hash])
     return {"status": "unblocked", "hash": content_hash}