Merge branch 'main' of meshbay.org:meshbayHEADmain

3 files changed, 52 insertions, 11 deletions

diff --git a/packages/meshbay-hub/tests/test_desktop_keyring.py b/packages/meshbay-hub/tests/test_desktop_keyring.py
index e55e6d0..af7cc37 100644
--- a/packages/meshbay-hub/tests/test_desktop_keyring.py
+++ b/packages/meshbay-hub/tests/test_desktop_keyring.py
@@ -13,6 +13,7 @@ page, and a reference written from the specification in Python.
 import base64
 import hashlib
 import json
+import re
 import shutil
 import subprocess
 from pathlib import Path
@@ -93,6 +94,9 @@ const v = JSON.parse(fs.readFileSync(input, 'utf8'));
     other_node: await refusal('join', { ...F.join, nodePk: 'T3RoZXJOb2Rl' }),
     other_account: await refusal('join', { ...F.join, userId: 'someone-else' }),
     stale: await refusal('join', { ...F.join, ts: ts - 3600 }),
+    root_add: await refusal('admin', { ...F.admin, op: 'root_add' }),
+    root_update: await refusal('admin', { ...F.admin, op: 'root_update' }),
+    group_attach: await refusal('admin', { ...F.admin, op: 'group_attach' }),
   };
 
   const eph = require('crypto').generateKeyPairSync('x25519');
@@ -268,6 +272,24 @@ def test_the_page_names_a_kind_and_never_the_bytes(out):
     assert "not now" in r["stale"]
 
 
+def test_what_widens_a_nodes_sharing_is_never_signed(out):
+    """Gone from MNP 6.0, and refused here as well: a node older than that
+    still accepts them, and a script in the page must not be able to get one
+    signed for it."""
+    for op in ("root_add", "root_update", "group_attach"):
+        assert "not an operation" in out["refused"][op], op
+
+
+def test_the_application_signs_exactly_the_nodes_operations():
+    from meshbay_common import adminop
+    src = (Path(__file__).resolve().parents[2] / "meshbay-client" / "src"
+           / "transcripts.js").read_text(encoding="utf-8")
+    listed = set(re.findall(r"'([a-z_]+)'",
+                            src.split("const ADMIN_OPS = new Set([")[1].split("]);")[0]))
+    catalogue = {v for k, v in vars(adminop).items() if k.startswith("OP_")}
+    assert listed == catalogue
+
+
 def test_nothing_is_sealed_for_a_browser_while_browser_access_is_off(out):
     for what, err in out["sealing_while_access_off"].items():
         assert err and "browser access is off" in err, what
diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py
index e80933c..c2ea4ca 100644
--- a/packages/meshbay-hub/tests/test_desktop_shell.py
+++ b/packages/meshbay-hub/tests/test_desktop_shell.py
@@ -425,13 +425,10 @@ def test_the_page_names_node_operations_not_routes():
     assert defined <= used, f"defined but never called: {defined - used}"
 
 
-@pytest.mark.parametrize("op", ["attachGroup", "addRoot", "clearDenylist"])
-def test_what_widens_the_node_is_confirmed_natively(op):
-    """Sharing a folder, hosting a group, re-admitting a revoked subject: asked
-    by a dialog the main process draws, which a script in the page cannot
-    answer. A folder chosen in the native picker is its own confirmation."""
-    body = _node_ops()[op]
-    assert "confirmOrRefuse(" in body or "confirmFolder(" in body
+def test_readmitting_a_revoked_subject_is_confirmed_natively():
+    """Asked by a dialog the main process draws, which a script in the page
+    cannot answer."""
+    assert "confirmOrRefuse(" in _node_ops()["clearDenylist"]
 
 
 def test_the_native_dialogs_are_worded_in_every_language():
diff --git a/packages/meshbay-hub/tests/test_upload_controls_hidden.py b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
index 6316e44..947ba75 100644
--- a/packages/meshbay-hub/tests/test_upload_controls_hidden.py
+++ b/packages/meshbay-hub/tests/test_upload_controls_hidden.py
@@ -231,7 +231,7 @@ def test_the_notice_also_answers_the_operators_own_request():
 
 def test_changing_a_root_is_signed():
     transport = transport_source()
-    for method in ("updateRoot", "ejectRoot", "plugRoot"):
+    for method in ("ejectRoot", "plugRoot", "removeRoot"):
         body = transport[transport.index(f"async {method}("):]
         body = body[:body.index("\n  async ", 1)]
         assert "admin_challenge" in body and "_authorizeAdminOp" in body, (
@@ -261,12 +261,34 @@ def test_the_operator_is_offered_it_on_the_web_too():
         "the shared directories section still requires a local node")
 
     table = _component(source, "SharedDirectoriesTable")
-    for call in ("transport.updateRoot", "transport.ejectRoot",
-                 "transport.plugRoot", "transport.removeRoot",
-                 "transport.addRoot"):
+    for call in ("transport.ejectRoot", "transport.plugRoot", "transport.removeRoot"):
         assert call in table, f"{call} has no MNP route from the table"
 
 
+def test_what_widens_the_sharing_never_crosses_mnp():
+    """
+    Adding a directory and switching `writable` or `removable` are done on the
+    node's own machine (MNP 6.0). Over MNP they were signed ops, and a signature
+    proves that the operator's key signed: in a browser that key is driven by
+    code the hub serves. The list stays visible from anywhere; those controls
+    are read-only there.
+    """
+    transport = transport_source()
+    for method in ("addRoot", "updateRoot", "attachGroup"):
+        assert f"async {method}(" not in transport, f"{method} is an MNP call again"
+    for mtype in ("'root_add'", "'root_update'", "'group_attach'"):
+        assert mtype not in transport, f"{mtype} is sent or expected again"
+
+    table = _component(GROUP_SETTINGS.read_text(encoding="utf-8"),
+                       "SharedDirectoriesTable")
+    assert "platform.node.op('addRoot'" in table
+    assert "platform.node.op('updateRoot'" in table
+    assert "const canWiden = isLocal || onNodeMachine;" in table
+    assert table.count("!canWiden") >= 3, (
+        "a writable or removable switch is live where it cannot be honoured")
+    assert "settings_node.roots_local_only_hint" in table
+
+
 def test_the_roots_shown_come_from_the_live_connection_when_there_is_one():
     """
     The loopback list is a second source, and the two drift: it is read once on