fix: bound pending admin challenges and sign every value an op acts on

Any member could make a node hold unbounded challenge requests; a
connection now keeps at most 8, 64 KiB each. root_add, group_attach,
invite_create and tmdb_config signed less than they did; their subjects
are now canonical JSON of every value (the TMDB token by SHA-256).
MNP 5.0, floor kept at 4.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

4 files changed, 65 insertions, 25 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/admin.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/admin.py
index f42d8e8..daaee62 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/admin.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/admin.py
@@ -5,6 +5,7 @@ import base64
 import os
 import time
 
+import msgpack
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
 from meshbay_common import MNP_VERSION
 from meshbay_common.adminop import (
@@ -42,6 +43,16 @@ from meshbay_common.adminop import (
 from meshbay_common.crypto import pk_to_b64
 from meshbay_common.protocol import MNP
 
+# What one connection may have waiting for a signature. Anyone authenticated can
+# ask for a challenge — the signature is what is checked, and it comes later — so
+# without a bound a member who never answers makes the node keep every request,
+# payload and all, for the life of the connection (§13.5b). A person signs one
+# operation at a time; a handful covers a settings page saving several at once.
+MAX_PENDING_ADMIN_OPS = 8
+# The subject and payload of one pending operation, packed. A path is at most a
+# few KiB, and the largest field a legitimate request carries is a directory list.
+MAX_ADMIN_OP_BYTES = 64 * 1024
+
 # Which executor runs each signed operation once its signature has been
 # checked. Every one runs as a task of the session.
 _ADMIN_EXECUTORS = {
@@ -98,8 +109,22 @@ class AdminMixin:
         (e.g. root management from a NodePage connection).
         """
         gid = group_id if group_id is not None else (self._group_id or "")
+        now = time.time()
+        for op_id, pending in list(self._admin_ops.items()):
+            if now - pending["ts"] > ADMIN_CHALLENGE_TTL:
+                del self._admin_ops[op_id]
+        if len(self._admin_ops) >= MAX_PENDING_ADMIN_OPS:
+            self._send({"type": "error", "detail": "Too many operations waiting for a "
+                        "signature", "code": "too_many_pending"})
+            self._audit("admin_pending_flood", op)
+            return
+        if len(msgpack.packb([subject, payload or {}], use_bin_type=True)) \
+                > MAX_ADMIN_OP_BYTES:
+            self._send({"type": "error", "detail": "Request too large",
+                        "code": "too_large"})
+            return
         nonce = os.urandom(32)
-        ts = int(time.time())
+        ts = int(now)
         op_id = base64.b64encode(os.urandom(16)).decode()
         self._admin_ops[op_id] = {
             "op": op, "subject": subject, "nonce": nonce, "ts": ts,
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/admission.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/admission.py
index b02e59a..e678a13 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/admission.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/admission.py
@@ -8,7 +8,12 @@ import time
 
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
 from meshbay_common import MNP_VERSION
-from meshbay_common.adminop import OP_INVITE_CANCEL, OP_INVITE_CREATE, OP_INVITE_LINK_CREATE
+from meshbay_common.adminop import (
+    OP_INVITE_CANCEL,
+    OP_INVITE_CREATE,
+    OP_INVITE_LINK_CREATE,
+    invite_create_subject,
+)
 from meshbay_common.crypto import wrap_gek_aes
 from meshbay_common.device import (
     DEVICE_TTL,
@@ -71,11 +76,13 @@ class AdmissionMixin:
             })
             return
 
-        self._issue_admin_challenge(OP_INVITE_CREATE, invitee_id, {
-            "group_id": group_id,
-            "user_id": invitee_id,
-            "username": str(msg.get("username", ""))[:64],
-        })
+        username = str(msg.get("username", ""))[:64]
+        self._issue_admin_challenge(
+            OP_INVITE_CREATE, invite_create_subject(invitee_id, username), {
+                "group_id": group_id,
+                "user_id": invitee_id,
+                "username": username,
+            })
 
     def _do_invite_link_create(self, msg: dict) -> None:
         """
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/video_meta.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/video_meta.py
index 834bac4..a9b35dc 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/video_meta.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/apps/video_meta.py
@@ -11,6 +11,7 @@ from meshbay_common.adminop import (
     OP_TMDB_ENABLED,
     OP_TMDB_OVERRIDE,
     OP_TMDB_REMATCH,
+    tmdb_config_subject,
 )
 from meshbay_common.protocol import MNP
 
@@ -60,12 +61,12 @@ class VideoMetaMixin:
         if not self._has_admin_authority():
             self._send({"type": "error", "detail": "No authorized key for this"})
             return
-        # The subject is the signed, audited, human-shown string — it must
-        # never contain the token itself (it would end up in the audit log
-        # in plaintext). The actual token travels only in `payload`, which
-        # is node-side context, never re-sent or re-verified from the wire.
-        # The language is not a secret, so it travels in the subject itself.
-        subject = f"custom_token={'yes' if token else 'no'},language={language or 'default'}"
+        # The subject is the signed, audited string, so it must never contain
+        # the token itself (it would end up in the audit log in plaintext); it
+        # carries the token's SHA-256 instead, which binds the signature to this
+        # token without writing it down. `None` (unchanged) and `""` (clear)
+        # stay distinct, for the token and the language alike.
+        subject = tmdb_config_subject(token, language)
         self._issue_admin_challenge(
             OP_TMDB_CONFIG, subject,
             payload={"token": token, "language": language},
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/node_ops.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/node_ops.py
index 9d58d8c..f7bbbfa 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/node_ops.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/node_ops.py
@@ -14,6 +14,8 @@ from meshbay_common.adminop import (
     OP_ROOT_UPDATE,
     OP_SET_SCAN_SETTINGS,
     OP_TRANSFER_LIMITS,
+    group_attach_subject,
+    root_add_subject,
 )
 from meshbay_common.protocol import MNP
 
@@ -246,10 +248,11 @@ class NodeOpsMixin:
         # is ignored rather than obeyed: on load it forces every other root
         # read-only, which is the model the RO/RW one replaced. A second
         # writable directory is `root_add` with `writable`.
+        writable = bool(msg.get("writable", True))
+        # The directory being exposed is signed, not only the group's name.
         self._issue_admin_challenge(
-            OP_GROUP_ATTACH, name,
-            payload={"name": name, "shared_dir": shared_dir,
-                     "writable": bool(msg.get("writable", True))},
+            OP_GROUP_ATTACH, group_attach_subject(name, shared_dir, writable),
+            payload={"name": name, "shared_dir": shared_dir, "writable": writable},
             group_id="")
 
     async def _admin_exec_group_attach(
@@ -342,16 +345,20 @@ class NodeOpsMixin:
         if not self._has_admin_authority():
             self._send({"type": "error", "detail": "No authorized key for this"})
             return
+        payload = {
+            "group_id": target_group, "path": path,
+            "name": str(msg.get("name", ""))[:128],
+            "kind": str(msg.get("kind", "generic"))[:16],
+            "writable": bool(msg.get("writable", msg.get("upload", False))),
+            "removable": bool(msg.get("removable", False)),
+        }
+        # Everything the executor acts on is signed — `writable` decides whether
+        # every member may write there. The group is in the transcript itself.
         self._issue_admin_challenge(
-            OP_ROOT_ADD, path,
-            payload={
-                "group_id": target_group, "path": path,
-                "name": str(msg.get("name", ""))[:128],
-                "kind": str(msg.get("kind", "generic"))[:16],
-                "writable": bool(msg.get("writable", msg.get("upload", False))),
-                "removable": bool(msg.get("removable", False)),
-            },
-            group_id=target_group)
+            OP_ROOT_ADD,
+            root_add_subject(path, payload["name"], payload["kind"],
+                             payload["writable"], payload["removable"]),
+            payload=payload, group_id=target_group)
 
     async def _admin_exec_root_add(
         self, pending: dict, transcript: bytes, sig: bytes,