fix: only the owner decides who hosts a group, and nobody is made a member unasked

- hub: a node may host a group only if its account owns it or the owner
  approved that node (new `group_hosts`). Membership was the ceiling, and
  every member holds the group key, so any member's node could register as a
  host and be the one clients kept. A node claiming a group it may not host
  is recorded as a request; the owner is notified once and approves or
  refuses it (GET/POST/DELETE /v1/groups/{id}/hosts[/{node_id}]), which
  takes effect on a connected node at once.
- hub: an owner adding a username creates an invitation (new
  `group_invitations`), accepted or declined by the invitee
  (/v1/groups/invitations, /{id}/invitation/accept|decline). Until then the
  group is not listed, not dialled, not searched and not in any token.
  Invitation links, open joins and group creation still make members
  directly: they are the account's own act.
- hub: the MNP token names only the group it is minted for (group_id is now
  required), so a node operator no longer learns a member's other groups.
- SPA: invitations on the home page; invited people and host requests in
  the group's settings; the transport sends group_id. Ten catalogues.
- Browser probes for both screens, run in Chrome and Firefox.
- Design §5.2, §7.2, §7.3, AV32, AV33; protocol §6.3; user guide.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 13 insertions, 4 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
index 403f450..decd20e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py
@@ -26,6 +26,10 @@ class MnpTokenRequest(BaseModel):
     # to it (E10), so it cannot be replayed to another node. The client knows it
     # from `/v1/groups/{id}/nodes` before it connects.
     node_pk: str = ""
+    # The one group this connection is for. The token names that group and no
+    # other: it is handed to the node's operator, who has no business learning
+    # every other group the member belongs to.
+    group_id: str = ""
 
 
 @router.post("/mnp-token")
@@ -50,11 +54,16 @@ async def mnp_token(
     only *restricts* the token to whatever node holds that key, which is the one
     the client is connecting to; a wrong key yields a token no node will accept.
     """
-    rows = await db.execute(
-        select(GroupMember.group_id).where(GroupMember.user_id == current_user.id))
-    group_ids = [gid for (gid,) in rows.all()]
+    group_id = (body.group_id if body else "").strip()
+    if not group_id:
+        raise HTTPException(status_code=422,
+                            detail="Name the group this connection is for (group_id)")
+    member = await db.get(GroupMember, (group_id, current_user.id))
     return {
-        "mnp_token": issue_mnp_token(current_user.id, groups=group_ids,
+        # Empty when the account is not a member: the node then refuses with
+        # `not_a_member`, which is the answer that case has always had.
+        "mnp_token": issue_mnp_token(current_user.id,
+                                     groups=[group_id] if member else [],
                                      node_pk=(body.node_pk if body else "")),
         "expires_in": 900,
     }