feat: browser access, decided in the desktop application

Off for an account made there: its identities stay on the device and nothing is
left on nodes. Turned on from the Profile page behind a native confirmation;
each node is settled when its group next opens. The hub keeps a mirror a
browser reads to say why a group will not open; it grants nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 21 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py
index 6e1c634..4426dd7 100644
--- a/packages/meshbay-hub/tests/test_desktop_shell.py
+++ b/packages/meshbay-hub/tests/test_desktop_shell.py
@@ -446,6 +446,17 @@ def test_the_native_dialogs_are_worded_in_every_language():
         assert not missing, f"{catalogue.name} lacks {missing}"
 
 
+def test_browser_access_is_widened_only_by_the_person_natively():
+    """Turning it on puts every identity of the account on every node, for a
+    browser to open: the application asks, in a dialog the page cannot
+    answer. What the page may say unasked only narrows it."""
+    source = _main()
+    widen = source.split("handle('keys:set-browser-access'", 1)[1].split("\n  handle(", 1)[0]
+    assert "confirmOrRefuse('native.browser_access_confirm')" in widen
+    here = source.split("handle('keys:created-here'", 1)[1].split("\n", 1)[0]
+    assert "setBrowserAccess(uid(u), false)" in here
+
+
 def test_the_node_is_never_pointed_at_a_hub_the_page_names():
     """`node:start` writes the hub this application is signed in to, and a
     username that cannot break out of a TOML string."""
@@ -680,3 +691,13 @@ def test_hardware_decoding_can_be_turned_off_without_a_rebuild():
     catch needs an answer that is not "reinstall": config.json, the same file
     every other client setting lives in."""
     assert "config.videoAcceleration" in _main()
+
+
+def test_an_account_made_in_the_application_starts_without_browser_access():
+    """Registration tells the application, which then leaves nothing of the
+    account's identities on any node until the person turns it on."""
+    auth = (STATIC / "auth-page.js").read_text(encoding="utf-8")
+    register = auth.split("const reg = await window.MeshBayKeys.registerUser(", 1)[1][:900]
+    assert "platform.keys.createdHere(reg.userId)" in register
+    assert "userId" in (STATIC / "keyderive.js").read_text(encoding="utf-8").split(
+        "async function registerUser", 1)[1].split("\n}\n", 1)[0]