fix: bound pending admin challenges and sign every value an op acts on

Any member could make a node hold unbounded challenge requests; a
connection now keeps at most 8, 64 KiB each. root_add, group_attach,
invite_create and tmdb_config signed less than they did; their subjects
are now canonical JSON of every value (the TMDB token by SHA-256).
MNP 5.0, floor kept at 4.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

4 files changed, 62 insertions, 15 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
index b74732c..0ca8ee5 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
@@ -307,6 +307,43 @@ function b64encode(bytes) {
   return btoa(String.fromCharCode(...bytes));
 }
 
+// ── Admin operation subjects ────────────────────────────────────────────────
+// Mirrors meshbay_common/adminop.py. The subject is what the signature covers of
+// a request, so an operation whose effect is several values names them all.
+// Canonical JSON — sorted keys, no whitespace — so both sides build the same
+// bytes, and `null`, `""` and a value stay distinct.
+
+function adminSubject(fields) {
+  const sorted = {};
+  for (const k of Object.keys(fields).sort()) sorted[k] = fields[k];
+  return JSON.stringify(sorted);
+}
+
+// A secret named without being written: null (unchanged) and '' (clear) as
+// themselves, anything else as its SHA-256.
+async function secretDigest(value) {
+  if (!value) return value;
+  const d = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
+  return 'sha256:' + Array.from(new Uint8Array(d))
+    .map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+
+function rootAddSubject(path, name, kind, writable, removable) {
+  return adminSubject({ path, name, kind, writable, removable });
+}
+
+function groupAttachSubject(name, sharedDir, writable) {
+  return adminSubject({ name, shared_dir: sharedDir, writable });
+}
+
+function inviteCreateSubject(userId, username) {
+  return adminSubject({ user_id: userId, username });
+}
+
+async function tmdbConfigSubject(token, language) {
+  return adminSubject({ token: await secretDigest(token), language });
+}
+
 // ── Admin operation transcript ───────────────────────────────────────────────
 // Mirrors meshbay_common/adminop.py::admin_transcript(). Both sides build these
 // bytes independently; they are never taken off the wire.
@@ -535,7 +572,8 @@ window.MeshBayCrypto = {
   importGEK, deriveChunkKey, decryptChunkBin,
   openGroup, sealGroup,
   unwrapGEK, b64encode, b64decode,
-  adminTranscript, handshakeTranscript, handshakeProof, webrtcBinding,
+  adminTranscript, adminSubject, rootAddSubject, groupAttachSubject,
+  inviteCreateSubject, tmdbConfigSubject, handshakeTranscript, handshakeProof, webrtcBinding,
   challengeTranscript, joinTranscript, verifyNodeSignature, constantTimeEqual,
   deviceRequestTranscript, deviceAddTranscript, deviceHelloTranscript,
   deviceCodeHash,
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-admin.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-admin.js
index 03a0f33..c7c3f47 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-admin.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-admin.js
@@ -263,7 +263,10 @@ extendTransport(class {
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      return this._authorizeAdminOp(msg, 'root_add', path, signFn);
+      // Everything the node will act on is in the subject, `writable` included.
+      const subject = window.MeshBayCrypto.rootAddSubject(
+        path, name || '', kind || 'generic', !!writable, !!removable);
+      return this._authorizeAdminOp(msg, 'root_add', subject, signFn);
     }
     return msg;
   }
@@ -369,11 +372,13 @@ extendTransport(class {
   async attachGroup(name, sharedDir, uploadDir, signFn) {
     const msg = await this._sendAndWait({
       type: 'group_attach', v: '0.1',
-      name, shared_dir: sharedDir, upload_dir: uploadDir || '',
+      name, shared_dir: sharedDir, upload_dir: uploadDir || '', writable: true,
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      return this._authorizeAdminOp(msg, 'group_attach', name, signFn);
+      // The directory being exposed is signed, not only the group's name.
+      const subject = window.MeshBayCrypto.groupAttachSubject(name, sharedDir, true);
+      return this._authorizeAdminOp(msg, 'group_attach', subject, signFn);
     }
     return msg;
   }
@@ -416,7 +421,10 @@ extendTransport(class {
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      return this._authorizeAdminOp(msg, 'invite_create', userId, signFn);
+      // The node keeps the first 64 code points of the name, as Python slices.
+      const name = Array.from(username || '').slice(0, 64).join('');
+      const subject = window.MeshBayCrypto.inviteCreateSubject(userId, name);
+      return this._authorizeAdminOp(msg, 'invite_create', subject, signFn);
     }
     return msg;
   }
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
index f94eb40..cf53c08 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
@@ -106,18 +106,17 @@ extendTransport(class {
    * `language`, to leave whatever is stored unchanged.
    */
   async setTmdbConfig(token, language, signFn) {
+    const tok = token === undefined ? null : token;
+    const lang = language === undefined ? null : language;
     const msg = await this._sendAndWait({
-      type: 'tmdb_config', v: '0.7',
-      token: token === undefined ? null : token,
-      language: language === undefined ? null : language,
+      type: 'tmdb_config', v: '0.7', token: tok, language: lang,
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      // Must match the node's subject byte-for-byte (apps/video_meta.py
-      // _do_tmdb_config) — the token itself is never part of the subject
-      // (it would end up in the audit log in plaintext), only whether one
-      // was supplied. The language is not a secret, so it appears as-is.
-      const subject = `custom_token=${token ? 'yes' : 'no'},language=${language || 'default'}`;
+      // Must match the node's subject byte for byte (apps/video_meta.py
+      // _do_tmdb_config). The token is named by its SHA-256, never written:
+      // the subject ends up in the audit log.
+      const subject = await window.MeshBayCrypto.tmdbConfigSubject(tok, lang);
       return this._authorizeAdminOp(msg, 'tmdb_config', subject, signFn);
     }
     return msg;
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index 0f3f3b8..7f1b232 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -305,8 +305,10 @@ window.addEventListener('hashchange', () => {
 // The `v: '0.1'` on every other message in this file is the historical value
 // and is read by nothing; it is left alone deliberately. The range is
 // negotiated once, at the start, not restated per message.
-const MNP_V = '4.0';
-// Raised with it: 4.0 is a flag day. A member now presents a short-lived
+const MNP_V = '5.0';
+// Not raised with 5.0 (see meshbay_common/__init__.py): the break is confined to
+// four signed operations, which a peer on the other side of it refuses to sign.
+// Set at 4.0, a flag day. A member now presents a short-lived
 // MNP-audience token in the handshake, not its hub session token — a node
 // older than 4.0 expected the session token, and one newer refuses it, so the
 // two cannot authenticate across the break. This is the C6 rule: no