Merge branch 'fix/third-review-h1-h2-m1-m6'

Third security review (docs/third-review.md) plus its remediation.

Fixed and verified:
- H1  moderator could grant admin / hard-revoke  → handler split by field
- H2  unauthenticated 2-report global blocklist  → auth + distinct reporters
      + rate limit + refused when public groups are off
- M1  registration reCAPTCHA was inert           → gate unconditional; the
      desktop client's CSP allows the widget
- M2  QUIC chat/stream handlers lagged WebRTC    → brought to parity; the QUIC
      listener is now off by default ([node] quic_enabled)
- M3  link-preview SSRF gaps                      → rate limit + port allowlist
      + connect-address re-check + decompression-bomb guard
- M4  federated peer over-trust                   → source bound to the signer,
      push capped, revocation prunes the peer's own entries, replay rejected
- M5  no CSP / security headers on the SPA        → middleware; verified against
      the live app with no violations

Withdrawn:
- M6  add_group_member accepting node tokens is deliberate (commit 0443cf8,
      the CLI invite flow). The "fix" broke that flow on the deployed hub and
      was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

1 files changed, 40 insertions, 0 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 003cd23..64ba75c 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -143,6 +143,16 @@ def _link_preview_cache_put(url: str, value: dict) -> None:
         _link_preview_cache.pop(oldest, None)
     _link_preview_cache[url] = (time.time(), value)
 
+
+# A member pasting a link is normal; a member — or a hub minting tokens for many
+# accounts — firing hundreds is amplification/DoS and a way to make the node
+# reach arbitrary hosts on demand (finding M3). Only a real outbound fetch is
+# counted (a cache hit costs nothing), and the ceilings are generous enough that
+# ordinary chat never meets them.
+_LINK_PREVIEW_RATE_WINDOW = 60.0
+_LINK_PREVIEW_RATE_PER_CONN = 15
+_LINK_PREVIEW_RATE_NODE = 60
+
 # Upload limits (finding C5a). Uploads used to land directly in the shared root under
 # a name the client chose, overwriting whatever was already there — which both violated
 # node sovereignty and defeated the delete authorization (overwrite a file, become its
@@ -3588,6 +3598,27 @@ class WebRTCPeerSession:
             ],
         })
 
+    def _link_preview_rate_ok(self) -> bool:
+        """
+        True when this preview fetch is within both the per-connection and the
+        node-wide window; records it when so, and both counts are trimmed to the
+        window on every call so the lists cannot grow without bound.
+        """
+        now = time.monotonic()
+        w = _LINK_PREVIEW_RATE_WINDOW
+        mine = [t for t in getattr(self, "_link_preview_hits", []) if now - t < w]
+        node = [t for t in self._ctx.get("link_preview_hits", []) if now - t < w]
+        if (len(mine) >= _LINK_PREVIEW_RATE_PER_CONN
+                or len(node) >= _LINK_PREVIEW_RATE_NODE):
+            self._link_preview_hits = mine
+            self._ctx["link_preview_hits"] = node
+            return False
+        mine.append(now)
+        node.append(now)
+        self._link_preview_hits = mine
+        self._ctx["link_preview_hits"] = node
+        return True
+
     async def _do_link_preview_request(self, msg: dict) -> None:
         """
         Unfurl a URL a member pasted into chat (draft-v6 §2.7 enrichment rule:
@@ -3608,6 +3639,15 @@ class WebRTCPeerSession:
             self._send({**cached, "type": MNP.LINK_PREVIEW_RESP, "v": MNP_VERSION})
             return
 
+        if not self._link_preview_rate_ok():
+            # Same shape as any other miss — the client shows the bare link. A
+            # rate-limited result is not cached, so it is retried once the
+            # window clears rather than pinned as "no preview".
+            log.debug("link_preview_req: rate-limited (peer=%s)", self._peer_id)
+            self._send({"type": MNP.LINK_PREVIEW_RESP, "v": MNP_VERSION,
+                        "url": key, "ok": False})
+            return
+
         resp: dict = {"type": MNP.LINK_PREVIEW_RESP, "v": MNP_VERSION,
                       "url": key, "ok": False}
         try: