fix(hub): a per-account sign-in lockout, and a reviewed unauthenticated surface

Passphrase sign-in locks per username: after `login.max_failures` wrong
passphrases (default 4) the name is refused with `429 account_locked` and a
`Retry-After` for `login.lockout_minutes` (default 60), without the passphrase
being checked. Both numbers are instance policy an admin sets from the panel;
zero failures turns it off. The per-IP limit bounds one address, and IPv6
gives every subscriber a /64 of them — an online guess targets an account, so
the account is what is counted.

- Counted by the name as typed, existing or not, so `login` stays uniform (M1).
  The key is a hash: people type passphrases into the username field.
- The attempt is taken before the check in one `INSERT … ON CONFLICT DO UPDATE
  … WHERE … RETURNING`, so a concurrent burst gets no more than the limit.
- Sign-in, passphrase change and account deletion count on the same row; the
  last had no rate limit at all.
- A lockout refuses passphrase sign-in and nothing else: sessions, renewal and
  device sign-in continue, and a reset code clears it (AV26). A session learns
  its own lockout from `/v1/users/me`, and the passphrase change checks it
  before re-wrapping any node's bundle — the hub accepts the new passphrase
  only after the nodes have it.

The SPA now shows what the hub said. `loginAndRecover` threw "Login failed:
{json}", so `email_verification_required` never matched and was never shown;
the passphrase-change form rendered no error at all in its first phase.

The unauthenticated surface, reviewed route by route:

- No `/docs`, `/redoc` or `/openapi.json`, in the code. The Caddyfile hid them
  on meshbay.org only; a packaged hub behind any other proxy published all three.
- The node socket's first message must arrive within ten seconds. It is
  accepted before anyone is known, and an unbounded read is a connection any
  stranger holds for free.
- `/v1/relays` answers 503 behind `relay.RELAYS_ENABLED`, as federation does:
  nothing in the tree calls it and two of its routes take no account.
- `test_unauthenticated_surface.py` walks every route and fails on one without
  an authentication dependency that is not listed with its reason.

Verified in Chrome against a local hub: the lockout and wrong-passphrase
messages, the admin section saving both lockout and mail limits, and the
passphrase change refused while locked. Not verified in Firefox (a running
instance blocks the headless one), nor the upsert's concurrency on PostgreSQL.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LcF3QKWii7uQ2kSyXErzCt

1 files changed, 7 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index 06aa011..b58ba64 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -87,6 +87,8 @@ export default {
   'register.resend_sent': '新验证码已发送。',
   'login.pending_verification': '您的邮箱尚未验证。请查看收件箱中的验证码。',
   'login.verify_link': '验证邮箱',
+  'login.invalid': "用户名或密码短语错误。",
+  'login.locked': "此账户输错密码短语的次数过多。请在 {minutes} 分钟后重试，或重置密码短语。",
   // Sign-in page: what MeshBay is (browser only)
   'welcome.title': '互联网本该有的样子。',
   'welcome.lead': 'MeshBay 是一款开源软件，让您远程访问个人文件，并在您自己电脑的存储之上运行应用：',
@@ -483,6 +485,11 @@ export default {
   'admin.mail_email_change_cooldown': "账号可再次申请其他地址前的秒数",
   'admin.mail_save': "保存邮件限制",
   'admin.mail_reset_defaults': "恢复默认值",
+  'admin.login_heading': "登录",
+  'admin.login_hint': "同一用户名输错密码短语达到此次数后，将在设定时长内拒绝使用密码短语登录。已打开的会话和已注册的设备不受影响，重置密码短语即可解除锁定。设为 0 则关闭。",
+  'admin.login_max_failures': "锁定前允许的错误次数",
+  'admin.login_lockout_minutes': "锁定时长（分钟）",
+  'admin.login_save': "保存登录限制",
   'admin.mail_state_is_in_stats': "本小时的用量显示在「统计」中。",
   'admin.mail_state_hint': "重置与邀请可动用全部额度；注册与更换地址不得占用为前者保留的份额。任一上限达到时，每小时通知管理员一次。",
   'admin.mail_left_signups': "注册剩余",