feat: nodes apply the content blocklist in their public groups

A node hosting a public group syncs the hub's blocklist on every
connection (paged, node token only) and applies pushed changes. A
blocked file leaves the index and is refused (content_blocked); private
groups are untouched. The unused per-hash check route is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 11 insertions, 1 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/files.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/files.py
index e76e23e..f629563 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/files.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/files.py
@@ -179,7 +179,7 @@ class FilesMixin:
 
     def _do_index_sync(self) -> None:
         ctx = self._group_ctx()
-        self._send(index_sync_message(ctx["index"], ctx.get("roots")))
+        self._send(index_sync_message(ctx["index"], ctx.get("roots"), self._hidden_ids()))
 
     async def _try_serve_thumbnail(
         self, thumb_hash: str, chunk_index: int, gek: bytes | None,
@@ -236,8 +236,18 @@ class FilesMixin:
                 self._note_unleased(tr)
         file_id = msg["file_id"]
         chunk_index = msg["chunk_index"]
+        if self._refuse_blocked(file_id):
+            return
         entry = ctx["index"].get_entry(file_id)
         if not entry:
+            # A blocked file's own thumbnail is a preview of it.
+            hidden = self._hidden_ids()
+            if hidden and file_id in {
+                    e.thumb_hash for e in map(ctx["index"].get_entry, hidden)
+                    if e is not None and e.thumb_hash}:
+                self._send({"type": "error", "detail": "This file is not available here.",
+                            "code": "content_blocked", "file_id": file_id})
+                return
             thumb = await self._try_serve_thumbnail(file_id, chunk_index, ctx.get("gek"))
             if thumb is not None:
                 log.debug("file_req file_id=%s chunk=%s: served as thumbnail",