Merge feat/unified-group-management: wizard, public groups, activity sidebar

1 files changed, 16 insertions, 7 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
index cb00a67..84c1167 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
@@ -90,7 +90,9 @@ async def webrtc_offer(
     if not ws:
         raise HTTPException(status_code=404, detail="Node not connected")
 
-    # The caller must share at least one active group with the target node.
+    # The caller must share at least one active group with the target node,
+    # OR the node must host at least one open-join group (public groups admit
+    # anyone — the node's MNP handshake handles authorization).
     node_group_ids = set(_node_groups.get(node_id, []))
     if node_group_ids:
         result = await db.execute(
@@ -100,12 +102,19 @@ async def webrtc_offer(
             ))
         shared = [gid for (gid,) in result.all()]
         if not shared:
-            raise HTTPException(status_code=403, detail="Not a member of any group on this node")
-
-        active = await db.execute(
-            select(Group.id).where(Group.id.in_(shared), Group.status == "active"))
-        if not active.first():
-            raise HTTPException(status_code=403, detail="Group is not active")
+            has_open = await db.execute(
+                select(Group.id).where(
+                    Group.id.in_(node_group_ids),
+                    Group.join_policy == "open",
+                    Group.status == "active",
+                ))
+            if not has_open.first():
+                raise HTTPException(status_code=403, detail="Not a member of any group on this node")
+        else:
+            active = await db.execute(
+                select(Group.id).where(Group.id.in_(shared), Group.status == "active"))
+            if not active.first():
+                raise HTTPException(status_code=403, detail="Group is not active")
 
     if _pending_per_user.get(current_user.id, 0) >= MAX_PENDING_PER_USER:
         raise HTTPException(status_code=429, detail="Too many pending connections")