feat: browser access, decided in the desktop application

Off for an account made there: its identities stay on the device and nothing is
left on nodes. Turned on from the Profile page behind a native confirmation;
each node is settled when its group next opens. The hub keeps a mirror a
browser reads to say why a group will not open; it grants nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 21 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/hub-client.js b/packages/meshbay-hub/src/meshbay_hub/static/hub-client.js
index 18db1ba..8ad091f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/hub-client.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/hub-client.js
@@ -382,8 +382,28 @@ async function hubFetch(path, { method = 'GET', body, token, _retried } = {}) {
 
 // `openDB` and `IDB_PLAYLISTS` are exported so playlists.js reads and writes
 // its own store without owning the database's version.
+/**
+ * Write to the hub what the desktop application holds for this account's
+ * browser access, so a browser can say why it cannot open a group. The
+ * application is the source; the hub's copy grants nothing. Returns the value
+ * written ('on' / 'off'), or null outside the application or on failure.
+ */
+async function mirrorBrowserAccess(token, userId, known) {
+  if (!await platform.nativeKeys()) return null;
+  try {
+    const want = await platform.keys.browserAccess(userId) ? 'on' : 'off';
+    if (known !== want) {
+      await hubFetch('/v1/users/me/preferences/browser_access',
+                     { method: 'PUT', token, body: { value: want } });
+    }
+    return want;
+  } catch {
+    return null;
+  }
+}
+
 export {
-  HUB, navigate, session,
+  HUB, navigate, session, mirrorBrowserAccess,
   openDB, IDB_PLAYLISTS,
   purgeGroupIndexCache,
   _storeBundleKey, _loadBundleKey, _storeRecoveryKey, _loadRecoveryKey, _clearKeyDB,