Merge branch 'fix/third-review-h1-h2-m1-m6'

Third security review (docs/third-review.md) plus its remediation.

Fixed and verified:
- H1  moderator could grant admin / hard-revoke  → handler split by field
- H2  unauthenticated 2-report global blocklist  → auth + distinct reporters
      + rate limit + refused when public groups are off
- M1  registration reCAPTCHA was inert           → gate unconditional; the
      desktop client's CSP allows the widget
- M2  QUIC chat/stream handlers lagged WebRTC    → brought to parity; the QUIC
      listener is now off by default ([node] quic_enabled)
- M3  link-preview SSRF gaps                      → rate limit + port allowlist
      + connect-address re-check + decompression-bomb guard
- M4  federated peer over-trust                   → source bound to the signer,
      push capped, revocation prunes the peer's own entries, replay rejected
- M5  no CSP / security headers on the SPA        → middleware; verified against
      the live app with no violations

Withdrawn:
- M6  add_group_member accepting node tokens is deliberate (commit 0443cf8,
      the CLI invite flow). The "fix" broke that flow on the deployed hub and
      was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

1 files changed, 38 insertions, 4 deletions

diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py
index 36b261e..b82804e 100644
--- a/packages/meshbay-hub/tests/test_desktop_shell.py
+++ b/packages/meshbay-hub/tests/test_desktop_shell.py
@@ -175,11 +175,17 @@ def _policy() -> str:
     """
     import re
     source = _main()
+    # The array mixes plain strings and one `${RECAPTCHA_SRC}` template literal;
+    # resolve the constant so every directive reads as plain text.
+    rec = re.search(r"const RECAPTCHA_SRC = '([^']*)'", source)
     match = re.search(r"const CSP = \[(.*?)\]\.join", source, re.S)
     assert match, "no CSP constant in the main process"
+    body = match.group(1)
+    if rec:
+        body = body.replace("${RECAPTCHA_SRC}", rec.group(1))
     return "; ".join(
-        line.strip().strip('",').strip('"')
-        for line in match.group(1).splitlines() if line.strip())
+        line.strip().strip('`",').strip('`"')
+        for line in body.splitlines() if line.strip())
 
 
 def _directive(name: str) -> str:
@@ -193,18 +199,46 @@ def _directive(name: str) -> str:
 def test_the_hub_is_reachable_but_never_executable():
     """
     connect-src allows the hub's API and its signaling socket. script-src does
-    not include it: nothing the hub returns is ever executed.
+    not: nothing the hub returns is ever executed. The only script sources are
+    'self', the wasm eval token, and the two reCAPTCHA hosts (see the next
+    test) — never a bare `https:` scheme, which would let the hub's own origin
+    serve script.
     """
     connect = _directive("connect-src")
     assert "https:" in connect and "wss:" in connect
 
     script = _directive("script-src")
     assert script, "no script-src directive"
-    assert "https:" not in script, "the hub can serve script under this policy"
+    sources = script.split()[1:]  # drop the "script-src" keyword itself
+    allowed = {
+        "'self'", "'wasm-unsafe-eval'",
+        "https://www.google.com", "https://www.gstatic.com",
+    }
+    assert set(sources) <= allowed, \
+        f"unexpected script-src source: {set(sources) - allowed}"
+    assert "https:" not in sources, "a bare https: scheme lets the hub serve script"
     assert "'unsafe-eval'" not in script.replace("'wasm-unsafe-eval'", "")
     assert "default-src 'none'" in _policy()
 
 
+def test_recaptcha_is_the_only_third_party_and_stays_scoped_to_it():
+    """
+    reCAPTCHA gates sign-up in the app the same way it does in the browser.
+    www.google.com and www.gstatic.com are allowed under script-src, frame-src
+    and img-src for that — and no other external origin appears anywhere in the
+    policy. Remove this expectation only alongside the reCAPTCHA widget.
+    """
+    hosts = {"https://www.google.com", "https://www.gstatic.com"}
+    for directive in ("script-src", "frame-src", "img-src"):
+        srcs = set(_directive(directive).split()[1:])
+        assert hosts <= srcs, f"{directive} is missing a reCAPTCHA host"
+
+    for part in _policy().split(";"):
+        for tok in part.strip().split()[1:]:
+            if tok.startswith(("http://", "https://")):
+                assert tok in hosts, f"unexpected external origin in CSP: {tok}"
+
+
 # ── The bridge ──────────────────────────────────────────────────────────────
 
 def test_the_bridge_is_the_only_way_in():