feat(hub): Phase 8 — Hub v2 security hardening + production readiness

8.1  Config-based admin authz (require_admin on all admin endpoints)
8.2  Email encrypted at rest (AES-256-GCM, HKDF from hub Ed25519 key)
8.3  Refresh token rotation with family-based reuse detection
8.4  Federation persistence (HubPeer model replaces in-memory dict)
8.5  Federation token verification now async (DB-backed)
8.6  CSAM hash check wired into swarm registration flow
8.7  Rate limiting on auth endpoints (5/10/20 per minute)
8.8  Healthcheck endpoint (GET /v1/health, no auth)
8.9  IP log cleanup background task (365-day retention)
8.10 Argon2id params bumped to 256 MB (pw_version, rehash on login)

Deployed to meshbay.org — schema migrated, existing emails encrypted.
117 tests pass (29 hub, 88 common+node).

Resolves security review items S1, S2, S5.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 18 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/app.py b/packages/meshbay-hub/src/meshbay_hub/app.py
index 1c494fa..c80da28 100644
--- a/packages/meshbay-hub/src/meshbay_hub/app.py
+++ b/packages/meshbay-hub/src/meshbay_hub/app.py
@@ -9,6 +9,7 @@ Usage:
     app = create_app(cfg)
 """
 
+import asyncio
 from contextlib import asynccontextmanager
 from pathlib import Path
 
@@ -22,12 +23,14 @@ from meshbay_hub.config import HubConfig
 from meshbay_hub.db.engine import close_db, init_db
 from meshbay_hub.api.hub        import router as hub_router
 from meshbay_hub.api.users      import router as users_router, set_config as users_set_config
+from meshbay_hub.api.deps       import set_admin_usernames
 from meshbay_hub.api.nodes      import router as nodes_router
 from meshbay_hub.api.groups     import router as groups_router
 from meshbay_hub.api.revocation  import router as revocation_router
 from meshbay_hub.api.moderation  import router as moderation_router
 from meshbay_hub.api.federation  import router as federation_router
 from meshbay_hub.csam            import csam_router
+from meshbay_hub.api.health      import router as health_router
 from meshbay_hub.api.relay       import router as relay_router
 from meshbay_hub.api.webapp     import router as webapp_router
 from meshbay_hub.api.middleware import limiter
@@ -48,9 +51,23 @@ def create_app(cfg: HubConfig | None = None) -> FastAPI:
             generate_hub_keypair(kp)
         load_hub_keypair(kp, cfg.identity.id)
         users_set_config(cfg)
+        set_admin_usernames(cfg.identity.admin_usernames)
+
+        from meshbay_hub.csam import get_csam_checker
+        get_csam_checker().load()
+
+        from meshbay_hub.tasks.cleanup import cleanup_loop
+        from meshbay_hub.db.engine import get_session_factory
+        cleanup_task = asyncio.create_task(cleanup_loop(get_session_factory()))
 
         yield
 
+        cleanup_task.cancel()
+        try:
+            await cleanup_task
+        except asyncio.CancelledError:
+            pass
+
         # Shutdown
         await close_db()
 
@@ -74,6 +91,7 @@ def create_app(cfg: HubConfig | None = None) -> FastAPI:
     app.include_router(moderation_router)
     app.include_router(federation_router)
     app.include_router(csam_router)
+    app.include_router(health_router)
     app.include_router(relay_router)
     app.include_router(webapp_router)