feat(hub): Phase 8 — Hub v2 security hardening + production readiness

8.1  Config-based admin authz (require_admin on all admin endpoints)
8.2  Email encrypted at rest (AES-256-GCM, HKDF from hub Ed25519 key)
8.3  Refresh token rotation with family-based reuse detection
8.4  Federation persistence (HubPeer model replaces in-memory dict)
8.5  Federation token verification now async (DB-backed)
8.6  CSAM hash check wired into swarm registration flow
8.7  Rate limiting on auth endpoints (5/10/20 per minute)
8.8  Healthcheck endpoint (GET /v1/health, no auth)
8.9  IP log cleanup background task (365-day retention)
8.10 Argon2id params bumped to 256 MB (pw_version, rehash on login)

Deployed to meshbay.org — schema migrated, existing emails encrypted.
117 tests pass (29 hub, 88 common+node).

Resolves security review items S1, S2, S5.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 3 insertions, 3 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/csam.py b/packages/meshbay-hub/src/meshbay_hub/csam.py
index 4dd0aed..2a0ce25 100644
--- a/packages/meshbay-hub/src/meshbay_hub/csam.py
+++ b/packages/meshbay-hub/src/meshbay_hub/csam.py
@@ -124,14 +124,14 @@ def check_content_hash(blake3_hex: str) -> bool:
 # ── Hub API integration ───────────────────────────────────────────────────────
 
 from fastapi import APIRouter, Depends, HTTPException, UploadFile, File
-from meshbay_hub.api.deps import get_current_user
+from meshbay_hub.api.deps import require_admin
 from meshbay_hub.db.models import User
 
 csam_router = APIRouter(prefix="/v1/admin/csam", tags=["csam"])
 
 
 @csam_router.get("/status")
-async def csam_status(current_user: User = Depends(get_current_user)):
+async def csam_status(current_user: User = Depends(require_admin)):
     """Return CSAM checker status (hash count, database path)."""
     return {
         "hash_count": _checker.hash_count,
@@ -144,7 +144,7 @@ async def csam_status(current_user: User = Depends(get_current_user)):
 @csam_router.post("/check")
 async def check_hash(
     body: dict,
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_admin),
 ):
     """
     Check a single hash. Admin use only.