fix: bound pending admin challenges and sign every value an op acts on

Any member could make a node hold unbounded challenge requests; a
connection now keeps at most 8, 64 KiB each. root_add, group_attach,
invite_create and tmdb_config signed less than they did; their subjects
are now canonical JSON of every value (the TMDB token by SHA-256).
MNP 5.0, floor kept at 4.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 12 insertions, 4 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-admin.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-admin.js
index 03a0f33..c7c3f47 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-admin.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-admin.js
@@ -263,7 +263,10 @@ extendTransport(class {
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      return this._authorizeAdminOp(msg, 'root_add', path, signFn);
+      // Everything the node will act on is in the subject, `writable` included.
+      const subject = window.MeshBayCrypto.rootAddSubject(
+        path, name || '', kind || 'generic', !!writable, !!removable);
+      return this._authorizeAdminOp(msg, 'root_add', subject, signFn);
     }
     return msg;
   }
@@ -369,11 +372,13 @@ extendTransport(class {
   async attachGroup(name, sharedDir, uploadDir, signFn) {
     const msg = await this._sendAndWait({
       type: 'group_attach', v: '0.1',
-      name, shared_dir: sharedDir, upload_dir: uploadDir || '',
+      name, shared_dir: sharedDir, upload_dir: uploadDir || '', writable: true,
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      return this._authorizeAdminOp(msg, 'group_attach', name, signFn);
+      // The directory being exposed is signed, not only the group's name.
+      const subject = window.MeshBayCrypto.groupAttachSubject(name, sharedDir, true);
+      return this._authorizeAdminOp(msg, 'group_attach', subject, signFn);
     }
     return msg;
   }
@@ -416,7 +421,10 @@ extendTransport(class {
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      return this._authorizeAdminOp(msg, 'invite_create', userId, signFn);
+      // The node keeps the first 64 code points of the name, as Python slices.
+      const name = Array.from(username || '').slice(0, 64).join('');
+      const subject = window.MeshBayCrypto.inviteCreateSubject(userId, name);
+      return this._authorizeAdminOp(msg, 'invite_create', subject, signFn);
     }
     return msg;
   }