fix: bound pending admin challenges and sign every value an op acts on

Any member could make a node hold unbounded challenge requests; a
connection now keeps at most 8, 64 KiB each. root_add, group_attach,
invite_create and tmdb_config signed less than they did; their subjects
are now canonical JSON of every value (the TMDB token by SHA-256).
MNP 5.0, floor kept at 4.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 7 insertions, 8 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
index f94eb40..cf53c08 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
@@ -106,18 +106,17 @@ extendTransport(class {
    * `language`, to leave whatever is stored unchanged.
    */
   async setTmdbConfig(token, language, signFn) {
+    const tok = token === undefined ? null : token;
+    const lang = language === undefined ? null : language;
     const msg = await this._sendAndWait({
-      type: 'tmdb_config', v: '0.7',
-      token: token === undefined ? null : token,
-      language: language === undefined ? null : language,
+      type: 'tmdb_config', v: '0.7', token: tok, language: lang,
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      // Must match the node's subject byte-for-byte (apps/video_meta.py
-      // _do_tmdb_config) — the token itself is never part of the subject
-      // (it would end up in the audit log in plaintext), only whether one
-      // was supplied. The language is not a secret, so it appears as-is.
-      const subject = `custom_token=${token ? 'yes' : 'no'},language=${language || 'default'}`;
+      // Must match the node's subject byte for byte (apps/video_meta.py
+      // _do_tmdb_config). The token is named by its SHA-256, never written:
+      // the subject ends up in the audit log.
+      const subject = await window.MeshBayCrypto.tmdbConfigSubject(tok, lang);
       return this._authorizeAdminOp(msg, 'tmdb_config', subject, signFn);
     }
     return msg;