feat: nodes apply the content blocklist in their public groups

A node hosting a public group syncs the hub's blocklist on every
connection (paged, node token only) and applies pushed changes. A
blocked file leaves the index and is refused (content_blocked); private
groups are untouched. The unused per-hash check route is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 29 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
index 2c0b8db..fe9edf3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
@@ -165,6 +165,35 @@ async def broadcast_revocation(token: str) -> int:
     return sent
 
 
+async def broadcast_blocklist_update(db: AsyncSession, *, add: list[str] = (),
+                                     remove: list[str] = ()) -> int:
+    """
+    Tell every connected node that hosts a public group what changed on the
+    content blocklist. Returns how many were told.
+
+    Only those nodes: the list names public content, and a node hosting only
+    private groups has nothing to apply it to. A node that is offline now syncs
+    the whole list when it next connects (`GET /v1/blocklist`), so a missed push
+    is only late, never lost.
+    """
+    if not add and not remove:
+        return 0
+    public = set((await db.execute(
+        select(Group.id).where(Group.visibility == "public"))).scalars().all())
+    payload = json.dumps({"type": "blocklist_update",
+                          "add": list(add), "remove": list(remove)})
+    sent = 0
+    for node_id, ws in list(_connected_nodes.items()):
+        if not public.intersection(_node_groups.get(node_id, [])):
+            continue
+        try:
+            await ws.send_text(payload)
+            sent += 1
+        except Exception:
+            _connected_nodes.pop(node_id, None)
+    return sent
+
+
 def _sign_revocation(target: str, target_id: str, reason: str) -> str:
     """Issue a signed revocation token (JWT EdDSA)."""
     from meshbay_hub.auth import _hub_id, _hub_sk_pem