feat(hub): Phase 8 — Hub v2 security hardening + production readiness

8.1  Config-based admin authz (require_admin on all admin endpoints)
8.2  Email encrypted at rest (AES-256-GCM, HKDF from hub Ed25519 key)
8.3  Refresh token rotation with family-based reuse detection
8.4  Federation persistence (HubPeer model replaces in-memory dict)
8.5  Federation token verification now async (DB-backed)
8.6  CSAM hash check wired into swarm registration flow
8.7  Rate limiting on auth endpoints (5/10/20 per minute)
8.8  Healthcheck endpoint (GET /v1/health, no auth)
8.9  IP log cleanup background task (365-day retention)
8.10 Argon2id params bumped to 256 MB (pw_version, rehash on login)

Deployed to meshbay.org — schema migrated, existing emails encrypted.
117 tests pass (29 hub, 88 common+node).

Resolves security review items S1, S2, S5.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/config.py b/packages/meshbay-hub/src/meshbay_hub/config.py
index 297ace7..31912d1 100644
--- a/packages/meshbay-hub/src/meshbay_hub/config.py
+++ b/packages/meshbay-hub/src/meshbay_hub/config.py
@@ -41,6 +41,7 @@ class HubIdentityConfig:
     id:               str  = "meshbay.org"
     private_key_path: Path = field(default_factory=lambda:
         Path.home() / ".config" / "meshbay" / "hub_private.pem")
+    admin_usernames: list[str] = field(default_factory=list)
 
 
 @dataclass
@@ -75,6 +76,8 @@ def load_config(path: Path | None = None) -> HubConfig:
                 cfg.identity.id = idn.get("id", cfg.identity.id)
                 if kp := idn.get("private_key_path"):
                     cfg.identity.private_key_path = Path(kp).expanduser()
+                if admins := idn.get("admin_usernames"):
+                    cfg.identity.admin_usernames = list(admins)
             if jwt := raw.get("jwt", {}):
                 cfg.jwt.access_token_ttl  = jwt.get("access_token_ttl",  cfg.jwt.access_token_ttl)
                 cfg.jwt.refresh_token_ttl = jwt.get("refresh_token_ttl", cfg.jwt.refresh_token_ttl)
@@ -91,5 +94,7 @@ def load_config(path: Path | None = None) -> HubConfig:
         cfg.identity.id = hub_id
     if kp := os.environ.get("MESHBAY_HUB_KEY"):
         cfg.identity.private_key_path = Path(kp).expanduser()
+    if admin_users := os.environ.get("MESHBAY_ADMIN_USERS"):
+        cfg.identity.admin_usernames = [u.strip() for u in admin_users.split(",") if u.strip()]
 
     return cfg