feat: nodes apply the content blocklist in their public groups

A node hosting a public group syncs the hub's blocklist on every
connection (paged, node token only) and applies pushed changes. A
blocked file leaves the index and is refused (content_blocked); private
groups are untouched. The unused per-hash check route is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

5 files changed, 36 insertions, 1 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/music.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/music.py
index f2b6fa5..857db33 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/music.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/music.py
@@ -64,6 +64,8 @@ class MusicMixin:
         """
         ctx = self._group_ctx()
         file_id = msg.get("file_id", "")
+        if self._refuse_blocked(file_id):
+            return
         entry = ctx["index"].get_entry(file_id)
         if not entry:
             self._send({"type": "error", "detail": "File not found"})
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/streaming.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/streaming.py
index a425c65..4337e24 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/streaming.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/streaming.py
@@ -228,6 +228,8 @@ class StreamingMixin:
     async def _stream_video_inner(self, msg: dict) -> None:
         ctx = self._group_ctx()
         file_id = msg.get("file_id", "")
+        if self._refuse_blocked(file_id):
+            return
         entry = ctx["index"].get_entry(file_id)
         if not entry:
             self._send({"type": "error", "detail": "File not found"})
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/subtitles.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/subtitles.py
index bd2ab52..70781eb 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/subtitles.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/subtitles.py
@@ -39,6 +39,8 @@ class SubtitlesMixin:
         """
         ctx = self._group_ctx()
         file_id = msg.get("file_id", "")
+        if self._refuse_blocked(file_id):
+            return
         entry = ctx["index"].get_entry(file_id)
         if not entry:
             self._send({"type": "error", "detail": "File not found"})
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/core.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/core.py
index c3fb623..882ddbc 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/core.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/core.py
@@ -246,6 +246,25 @@ class SessionCore:
             return self._ctx["groups"].get(self._group_id) or {}
         return self._ctx
 
+    def _hidden_ids(self):
+        """The content blocklist, in a public group; nothing anywhere else.
+
+        A private group's content never reaches the hub, so nothing in it can have
+        been blocked there (docs/MESHBAY_DESIGN.md §7.5, `meshbay_node.blocklist`).
+        """
+        if self._group_ctx().get("visibility") != "public":
+            return ()
+        return self._ctx.get("blocklist") or ()
+
+    def _refuse_blocked(self, file_id) -> bool:
+        """Refuse a file the blocklist names, in a public group. True if refused."""
+        if not isinstance(file_id, str) or file_id not in self._hidden_ids():
+            return False
+        self._send({"type": "error", "detail": "This file is not available here.",
+                    "code": "content_blocked", "file_id": file_id})
+        self._audit("content_blocked", file_id[:16])
+        return True
+
     def _register_peer(self) -> None:
         """Add this connection to its group's peer set.
 
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/files.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/files.py
index e76e23e..f629563 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/files.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/files.py
@@ -179,7 +179,7 @@ class FilesMixin:
 
     def _do_index_sync(self) -> None:
         ctx = self._group_ctx()
-        self._send(index_sync_message(ctx["index"], ctx.get("roots")))
+        self._send(index_sync_message(ctx["index"], ctx.get("roots"), self._hidden_ids()))
 
     async def _try_serve_thumbnail(
         self, thumb_hash: str, chunk_index: int, gek: bytes | None,
@@ -236,8 +236,18 @@ class FilesMixin:
                 self._note_unleased(tr)
         file_id = msg["file_id"]
         chunk_index = msg["chunk_index"]
+        if self._refuse_blocked(file_id):
+            return
         entry = ctx["index"].get_entry(file_id)
         if not entry:
+            # A blocked file's own thumbnail is a preview of it.
+            hidden = self._hidden_ids()
+            if hidden and file_id in {
+                    e.thumb_hash for e in map(ctx["index"].get_entry, hidden)
+                    if e is not None and e.thumb_hash}:
+                self._send({"type": "error", "detail": "This file is not available here.",
+                            "code": "content_blocked", "file_id": file_id})
+                return
             thumb = await self._try_serve_thumbnail(file_id, chunk_index, ctx.get("gek"))
             if thumb is not None:
                 log.debug("file_req file_id=%s chunk=%s: served as thumbnail",