feat: browser access, decided in the desktop application

Off for an account made there: its identities stay on the device and nothing is
left on nodes. Turned on from the Profile page behind a native confirmation;
each node is settled when its group next opens. The hub keeps a mirror a
browser reads to say why a group will not open; it grants nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 9 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index a12fea4..c101ec9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -17,6 +17,7 @@ import {
   _storeBundleKey, _loadBundleKey, _clearKeyDB,
   loadAuth, saveAuth, setAuth, setAuthChangeListener, ensureFreshToken, hubFetch,
   refreshAccessToken, logoutOnHub,
+  mirrorBrowserAccess,
 } from './hub-client.js';
 import { startIdleWatch, markActive } from './idle.js';
 import { GroupPage } from './group-page.js';
@@ -1010,9 +1011,16 @@ function App() {
       .then(data => setGroups(data.groups || []))
       .catch(() => setGroups([]));
     hubFetch('/v1/users/me/preferences', { token: user.token })
-      .then(prefs => {
+      .then(async (prefs) => {
         setUserPrefs(prefs || {});
         if (prefs.notifications_disabled === 'true') setNotifDisabled(true);
+        // The desktop application keeps the hub's mirror of browser access
+        // current, at every start and sign-in.
+        const mirrored = await mirrorBrowserAccess(
+          user.token, user.userId, (prefs || {}).browser_access);
+        if (mirrored && mirrored !== (prefs || {}).browser_access) {
+          setUserPrefs((p) => ({ ...p, browser_access: mirrored }));
+        }
       })
       .catch(() => {});
     refreshNodeKey();