diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-08-10 03:57:55 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-08-10 03:57:55 +0200 |
| commit | 1a53eb4cc404ec94658fde0ae04cfe2ccf1810dc (patch) | |
| tree | 04a23f81d3eea49de7414bf973600d33913795f9 /packages/meshbay-hub/tests/test_revocation.py | |
| parent | 4b3e8c3b8b9d10c8ac333dd8db614a7569052472 (diff) | |
| download | meshbay-1a53eb4cc404ec94658fde0ae04cfe2ccf1810dc.tar.gz | |
feat(hub): Phase 8 — Hub v2 security hardening + production readiness
8.1 Config-based admin authz (require_admin on all admin endpoints)
8.2 Email encrypted at rest (AES-256-GCM, HKDF from hub Ed25519 key)
8.3 Refresh token rotation with family-based reuse detection
8.4 Federation persistence (HubPeer model replaces in-memory dict)
8.5 Federation token verification now async (DB-backed)
8.6 CSAM hash check wired into swarm registration flow
8.7 Rate limiting on auth endpoints (5/10/20 per minute)
8.8 Healthcheck endpoint (GET /v1/health, no auth)
8.9 IP log cleanup background task (365-day retention)
8.10 Argon2id params bumped to 256 MB (pw_version, rehash on login)
Deployed to meshbay.org — schema migrated, existing emails encrypted.
117 tests pass (29 hub, 88 common+node).
Resolves security review items S1, S2, S5.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Diffstat (limited to 'packages/meshbay-hub/tests/test_revocation.py')
| -rw-r--r-- | packages/meshbay-hub/tests/test_revocation.py | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/packages/meshbay-hub/tests/test_revocation.py b/packages/meshbay-hub/tests/test_revocation.py index f5d6050..494d77d 100644 --- a/packages/meshbay-hub/tests/test_revocation.py +++ b/packages/meshbay-hub/tests/test_revocation.py @@ -7,6 +7,7 @@ from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey from meshbay_common.crypto import pk_to_b64 +from meshbay_hub.api.deps import set_admin_usernames async def _register_and_login(client, username, pk_ed, pk_x): @@ -45,6 +46,7 @@ async def test_revoke_user_marks_db(client): pk_to_b64(sk_admin_ed.public_key()), pk_to_b64(sk_admin_x.public_key()), ) + set_admin_usernames(["admin1"]) r = await client.post("/v1/admin/revoke", json={ "target": "user", "target_id": victim_id, "reason": "spam", @@ -80,6 +82,7 @@ async def test_revocation_token_verifiable_offline(client): pk_to_b64(sk_admin_ed.public_key()), pk_to_b64(sk_admin_x.public_key()), ) + set_admin_usernames(["admin2"]) r = await client.post("/v1/admin/revoke", json={ "target": "user", "target_id": victim_id, "reason": "test", @@ -107,6 +110,7 @@ async def test_revoke_group(client): pk_to_b64(sk_ed.public_key()), pk_to_b64(sk_x.public_key()), ) + set_admin_usernames(["admin3"]) hdrs = {"Authorization": f"Bearer {admin_token}"} r = await client.post("/v1/groups", json={"name": "grp-to-revoke"}, headers=hdrs) |