Merge branch 'fix/known-device-join-new-invite-group'

1 files changed, 37 insertions, 4 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 4958b92..dfa775e 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -1039,10 +1039,11 @@ class WebRTCPeerSession:
                 f"paired with this node")
             return
         if known:
-            # An operator's row is node-wide (empty group), so a lookup for the
-            # group they happen to be opening finds nothing. Fall back to it, or
-            # the client is told it has no role on a node it administers.
-            member = (await roster.get_member(group_id, user_id)
+            # This group's own row first; then the join message's group_id (empty
+            # on the node-wide first connect); then the operator's node-wide row,
+            # which is where an operator opening any group finds their authority.
+            member = (await roster.get_member(session_group, user_id)
+                      or await roster.get_member(group_id, user_id)
                       or await roster.get_member("", user_id))
             if not member and self._group_join_policy(session_group) == "open":
                 await roster.set_member(
@@ -1050,6 +1051,38 @@ class WebRTCPeerSession:
                     status="active", approved_by="open-join",
                 )
                 member = await roster.get_member(session_group, user_id)
+            if not member:
+                # A device this node already pinned — for another group, or an
+                # operator pairing — opening an invite-only group it has no row
+                # for. The device-linking `known` fast-path used to drop straight
+                # into `_join_ok`, which answered `not_authorized_for_group` and
+                # left a real invitee with no way to redeem the code they were
+                # sent. Tell them to enter it *only* when one is actually
+                # waiting for them here; a bare hub-invented pin, with nothing
+                # inviting it, still gets the flat refusal H3 relies on.
+                if not code:
+                    invited = any(
+                        i["user_id"] == user_id
+                        and i["group_id"] in (session_group, "")
+                        for i in await roster.list_invites())
+                    self._join_refuse(
+                        "code_required" if invited else "not_authorized_for_group")
+                    return
+                invite = await roster.consume_invite(code, user_id)
+                if not invite:
+                    self._join_refuse("code_invalid")
+                    return
+                await roster.set_member(
+                    group_id=invite["group_id"], user_id=user_id,
+                    role=invite["role"], status="active",
+                    approved_by=invite["created_by"],
+                )
+                self._audit_join(
+                    "join_pinned",
+                    f"group={invite['group_id'][:8]} role={invite['role']} "
+                    "via=code (device already known)")
+                member = (await roster.get_member(session_group, user_id)
+                          or await roster.get_member(invite["group_id"], user_id))
             await self._join_ok(
                 user_id, pk_x_raw, session_group,
                 role=member["role"] if member else "",