diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-30 21:04:39 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-30 21:04:39 +0200 |
| commit | 0378e8e0912a1a7e6cea4424e69d524e7afecbf8 (patch) | |
| tree | 4ae94e32d6638b4c2cc1ae4f74cbe5d00c940636 /packages/meshbay-node/tests/test_group_roster.py | |
| parent | 0ed56d3a1b4f71cf622d3e27edc87a15ef33c185 (diff) | |
| download | meshbay-0378e8e0912a1a7e6cea4424e69d524e7afecbf8.tar.gz | |
fix: an identity signs a named kind, and a device approval answers a request
The desktop main process builds every transcript itself from fields
(transcripts.js) and signs no raw bytes; the page's identity has the same
contract (crypto.js transcriptFor). The keyring seals no bundle while browser
access is off. On the node, device_add must redeem a pending request filed by
the same keys, and device_revoke is signed under its own prefix
(meshbay:device_revoke:v1), so a retirement signature admits nothing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'packages/meshbay-node/tests/test_group_roster.py')
| -rw-r--r-- | packages/meshbay-node/tests/test_group_roster.py | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/packages/meshbay-node/tests/test_group_roster.py b/packages/meshbay-node/tests/test_group_roster.py index 74908e7..8028bed 100644 --- a/packages/meshbay-node/tests/test_group_roster.py +++ b/packages/meshbay-node/tests/test_group_roster.py @@ -81,8 +81,13 @@ async def _add_device(session, roster, approver_sk, approver_pk, new_pk, new_px, node_pk_b64=session._node_pk_b64(), user_id=user_id, pk_ed25519_b64=new_pk, pk_x25519_b64=new_px, nonce_node=NONCE, ts=ts) session._user_id = user_id + # The request the new device files first; an approval answers one. + code_hash = "c" * 64 + await roster.file_device_request(user_id=user_id, username=user_id, + pk_ed25519=new_pk, pk_x25519=new_px, + code_hash=code_hash, ttl=600) await session._do_device_add({ - "pk_ed25519": new_pk, "pk_x25519": new_px, "ts": ts, + "pk_ed25519": new_pk, "pk_x25519": new_px, "ts": ts, "code_hash": code_hash, "sig": base64.b64encode(approver_sk.sign(transcript)).decode(), }) return ts |