fix(hub): a per-account sign-in lockout, and a reviewed unauthenticated surface

Passphrase sign-in locks per username: after `login.max_failures` wrong
passphrases (default 4) the name is refused with `429 account_locked` and a
`Retry-After` for `login.lockout_minutes` (default 60), without the passphrase
being checked. Both numbers are instance policy an admin sets from the panel;
zero failures turns it off. The per-IP limit bounds one address, and IPv6
gives every subscriber a /64 of them — an online guess targets an account, so
the account is what is counted.

- Counted by the name as typed, existing or not, so `login` stays uniform (M1).
  The key is a hash: people type passphrases into the username field.
- The attempt is taken before the check in one `INSERT … ON CONFLICT DO UPDATE
  … WHERE … RETURNING`, so a concurrent burst gets no more than the limit.
- Sign-in, passphrase change and account deletion count on the same row; the
  last had no rate limit at all.
- A lockout refuses passphrase sign-in and nothing else: sessions, renewal and
  device sign-in continue, and a reset code clears it (AV26). A session learns
  its own lockout from `/v1/users/me`, and the passphrase change checks it
  before re-wrapping any node's bundle — the hub accepts the new passphrase
  only after the nodes have it.

The SPA now shows what the hub said. `loginAndRecover` threw "Login failed:
{json}", so `email_verification_required` never matched and was never shown;
the passphrase-change form rendered no error at all in its first phase.

The unauthenticated surface, reviewed route by route:

- No `/docs`, `/redoc` or `/openapi.json`, in the code. The Caddyfile hid them
  on meshbay.org only; a packaged hub behind any other proxy published all three.
- The node socket's first message must arrive within ten seconds. It is
  accepted before anyone is known, and an unbounded read is a connection any
  stranger holds for free.
- `/v1/relays` answers 503 behind `relay.RELAYS_ENABLED`, as federation does:
  nothing in the tree calls it and two of its routes take no account.
- `test_unauthenticated_surface.py` walks every route and fails on one without
  an authentication dependency that is not listed with its reason.

Verified in Chrome against a local hub: the lockout and wrong-passphrase
messages, the admin section saving both lockout and mail limits, and the
passphrase change refused while locked. Not verified in Firefox (a running
instance blocks the headless one), nor the upsert's concurrency on PostgreSQL.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LcF3QKWii7uQ2kSyXErzCt

1 files changed, 78 insertions, 1 deletions

diff --git a/packages/meshbay-hub/tests/test_availability_between_members.py b/packages/meshbay-hub/tests/test_availability_between_members.py
index bfbfcc0..d1a4dcb 100644
--- a/packages/meshbay-hub/tests/test_availability_between_members.py
+++ b/packages/meshbay-hub/tests/test_availability_between_members.py
@@ -338,6 +338,9 @@ async def test_a_relay_must_prove_it_holds_the_approved_key(client, monkeypatch)
     """
     from meshbay_hub.api import relay as relay_mod
 
+    # The registry ships closed (`relay.RELAYS_ENABLED`); the proof it demands
+    # is still what will be wanted the day it opens.
+    monkeypatch.setattr(relay_mod, "RELAYS_ENABLED", True)
     sk = Ed25519PrivateKey.generate()
     pk = pk_to_b64(sk.public_key())
     relay_mod._relays["r1"] = {"pk": pk, "active": False}
@@ -370,10 +373,84 @@ async def test_a_relay_must_prove_it_holds_the_approved_key(client, monkeypatch)
 
 
 @pytest.mark.asyncio
-async def test_a_captured_relay_registration_is_not_replayable(client):
+async def test_every_relay_route_is_closed_as_the_hub_ships(client):
+    """Nothing in the tree uses the registry, and two of its routes take no account.
+
+    A dependency on the router, so a route added later is closed too. The flag
+    is read as shipped, not set here — a test that closes the gate itself
+    would keep passing the day somebody opens it.
+    """
+    admin = await _make_user(client, "relayadmin")
+    from meshbay_hub.api.deps import set_admin_usernames
+    set_admin_usernames(["relayadmin"])
+    auth = {"Authorization": f"Bearer {admin['token']}"}
+
+    for method, path in (("get", "/v1/relays"),
+                         ("post", "/v1/relays/register"),
+                         ("post", "/v1/relays/approve")):
+        kwargs = {"headers": auth} if method == "get" else {"json": {}, "headers": auth}
+        r = await getattr(client, method)(path, **kwargs)
+        assert r.status_code == 503, (path, r.status_code, r.text)
+
+
+@pytest.mark.asyncio
+async def test_a_stranger_who_locks_your_name_does_not_sign_you_out(client, db_session):
+    """AV26. The sign-in lockout is keyed by username, and usernames are public.
+
+    So anyone can spend your attempts, and the design has to make that cost as
+    little as possible: a lockout refuses *passphrase* sign-in and nothing else.
+    The session you already have keeps working and keeps renewing, and a reset
+    code sent to your own address ends the lockout at once.
+    """
+    victim_key = base64.b64encode(b"k" * 32).decode()
+    r = await client.post("/v1/users/register", json={
+        "username": "victim26", "email": "victim26@example.test", "auth_key": victim_key})
+    assert r.status_code == 201, r.text
+    session = (await client.post("/v1/users/login", json={
+        "username": "victim26", "auth_key": victim_key})).json()
+
+    # The stranger needs no account at all — only the name.
+    for _ in range(4):
+        r = await client.post("/v1/users/login", json={
+            "username": "victim26", "auth_key": "guess" + "x" * 39})
+        assert r.status_code == 401
+    r = await client.post("/v1/users/login", json={
+        "username": "victim26", "auth_key": victim_key})
+    assert r.status_code == 429, r.text
+
+    # Still signed in, and still able to stay signed in.
+    auth = {"Authorization": f"Bearer {session['access_token']}"}
+    assert (await client.get("/v1/users/me", headers=auth)).status_code == 200
+    r = await client.post("/v1/users/token/refresh",
+                          json={"refresh_token": session["refresh_token"]})
+    assert r.status_code == 200, r.text
+
+    # The way out that needs nobody's help: a code to the address on file.
+    from meshbay_hub.db.models import EmailVerification, User
+    from sqlalchemy import select
+    r = await client.post("/v1/users/password/reset-request", json={
+        "username": "victim26", "email": "victim26@example.test"})
+    assert r.status_code == 200, r.text
+    uid = (await db_session.execute(
+        select(User.id).where(User.username == "victim26"))).scalar_one()
+    code = (await db_session.execute(select(EmailVerification.code).where(
+        EmailVerification.user_id == uid,
+        EmailVerification.purpose == "password_reset"))).scalar_one()
+    new_key = base64.b64encode(b"n" * 32).decode()
+    r = await client.post("/v1/users/password/reset", json={
+        "username": "victim26", "code": code, "new_auth_key": new_key})
+    assert r.status_code == 200, r.text
+    r = await client.post("/v1/users/login", json={
+        "username": "victim26", "auth_key": new_key})
+    assert r.status_code == 200, r.text
+
+
+@pytest.mark.asyncio
+async def test_a_captured_relay_registration_is_not_replayable(client, monkeypatch):
     """Same reason /v1/nodes/announce bounds its timestamp."""
     from meshbay_hub.api import relay as relay_mod
 
+    monkeypatch.setattr(relay_mod, "RELAYS_ENABLED", True)
     sk = Ed25519PrivateKey.generate()
     pk = pk_to_b64(sk.public_key())
     relay_mod._relays["r2"] = {"pk": pk, "active": False}