fix: bound pending admin challenges and sign every value an op acts on

Any member could make a node hold unbounded challenge requests; a
connection now keeps at most 8, 64 KiB each. root_add, group_attach,
invite_create and tmdb_config signed less than they did; their subjects
are now canonical JSON of every value (the TMDB token by SHA-256).
MNP 5.0, floor kept at 4.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 19 insertions, 12 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/node_ops.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/node_ops.py
index 9d58d8c..f7bbbfa 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/node_ops.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/node_ops.py
@@ -14,6 +14,8 @@ from meshbay_common.adminop import (
     OP_ROOT_UPDATE,
     OP_SET_SCAN_SETTINGS,
     OP_TRANSFER_LIMITS,
+    group_attach_subject,
+    root_add_subject,
 )
 from meshbay_common.protocol import MNP
 
@@ -246,10 +248,11 @@ class NodeOpsMixin:
         # is ignored rather than obeyed: on load it forces every other root
         # read-only, which is the model the RO/RW one replaced. A second
         # writable directory is `root_add` with `writable`.
+        writable = bool(msg.get("writable", True))
+        # The directory being exposed is signed, not only the group's name.
         self._issue_admin_challenge(
-            OP_GROUP_ATTACH, name,
-            payload={"name": name, "shared_dir": shared_dir,
-                     "writable": bool(msg.get("writable", True))},
+            OP_GROUP_ATTACH, group_attach_subject(name, shared_dir, writable),
+            payload={"name": name, "shared_dir": shared_dir, "writable": writable},
             group_id="")
 
     async def _admin_exec_group_attach(
@@ -342,16 +345,20 @@ class NodeOpsMixin:
         if not self._has_admin_authority():
             self._send({"type": "error", "detail": "No authorized key for this"})
             return
+        payload = {
+            "group_id": target_group, "path": path,
+            "name": str(msg.get("name", ""))[:128],
+            "kind": str(msg.get("kind", "generic"))[:16],
+            "writable": bool(msg.get("writable", msg.get("upload", False))),
+            "removable": bool(msg.get("removable", False)),
+        }
+        # Everything the executor acts on is signed — `writable` decides whether
+        # every member may write there. The group is in the transcript itself.
         self._issue_admin_challenge(
-            OP_ROOT_ADD, path,
-            payload={
-                "group_id": target_group, "path": path,
-                "name": str(msg.get("name", ""))[:128],
-                "kind": str(msg.get("kind", "generic"))[:16],
-                "writable": bool(msg.get("writable", msg.get("upload", False))),
-                "removable": bool(msg.get("removable", False)),
-            },
-            group_id=target_group)
+            OP_ROOT_ADD,
+            root_add_subject(path, payload["name"], payload["kind"],
+                             payload["writable"], payload["removable"]),
+            payload=payload, group_id=target_group)
 
     async def _admin_exec_root_add(
         self, pending: dict, transcript: bytes, sig: bytes,