Merge branch 'fix/third-review-h1-h2-m1-m6'

Third security review (docs/third-review.md) plus its remediation.

Fixed and verified:
- H1  moderator could grant admin / hard-revoke  → handler split by field
- H2  unauthenticated 2-report global blocklist  → auth + distinct reporters
      + rate limit + refused when public groups are off
- M1  registration reCAPTCHA was inert           → gate unconditional; the
      desktop client's CSP allows the widget
- M2  QUIC chat/stream handlers lagged WebRTC    → brought to parity; the QUIC
      listener is now off by default ([node] quic_enabled)
- M3  link-preview SSRF gaps                      → rate limit + port allowlist
      + connect-address re-check + decompression-bomb guard
- M4  federated peer over-trust                   → source bound to the signer,
      push capped, revocation prunes the peer's own entries, replay rejected
- M5  no CSP / security headers on the SPA        → middleware; verified against
      the live app with no violations

Withdrawn:
- M6  add_group_member accepting node tokens is deliberate (commit 0443cf8,
      the CLI invite flow). The "fix" broke that flow on the deployed hub and
      was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

1 files changed, 58 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_register_captcha.py b/packages/meshbay-hub/tests/test_register_captcha.py
new file mode 100644
index 0000000..befc1e2
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_register_captcha.py
@@ -0,0 +1,58 @@
+"""Registration CAPTCHA is enforced for every fresh account when configured.
+
+The gate used to be skipped whenever the request carried an `auth_key` — which
+every real client sends (the password split) — so it protected nobody and a bot
+skipped it by including the field. It now runs on `captcha.enabled` alone; the
+desktop client is Chromium and renders the same widget.
+"""
+
+import pytest
+
+
+@pytest.fixture
+def captcha_on(client, monkeypatch):
+    """Turn on a fake captcha: any config with both keys is `enabled`, and
+    verification succeeds only for the token 'good-token'."""
+    from meshbay_hub.api.users import _cfg
+    monkeypatch.setattr(_cfg.captcha, "site_key", "test-site")
+    monkeypatch.setattr(_cfg.captcha, "secret_key", "test-secret")
+
+    async def fake_verify(secret, token, remote_ip=None):
+        return token == "good-token"
+
+    monkeypatch.setattr("meshbay_hub.captcha.verify_captcha", fake_verify)
+
+
+def _body(**over):
+    b = {"username": "newbie", "email": "newbie@t.com", "auth_key": "a" * 44}
+    b.update(over)
+    return b
+
+
+@pytest.mark.asyncio
+async def test_missing_captcha_rejected_even_with_auth_key(client, captcha_on):
+    r = await client.post("/v1/users/register", json=_body())
+    assert r.status_code == 400
+    assert r.json()["detail"] == "captcha_required"
+
+
+@pytest.mark.asyncio
+async def test_bad_captcha_rejected(client, captcha_on):
+    r = await client.post("/v1/users/register",
+                          json=_body(captcha_token="wrong"))
+    assert r.status_code == 400
+    assert r.json()["detail"] == "captcha_failed"
+
+
+@pytest.mark.asyncio
+async def test_good_captcha_accepted(client, captcha_on):
+    r = await client.post("/v1/users/register",
+                          json=_body(captcha_token="good-token"))
+    assert r.status_code == 201
+
+
+@pytest.mark.asyncio
+async def test_no_captcha_configured_still_registers(client):
+    # Default test config has no captcha keys — registration proceeds without one.
+    r = await client.post("/v1/users/register", json=_body())
+    assert r.status_code == 201