Merge branch 'fix/third-review-h1-h2-m1-m6'

Third security review (docs/third-review.md) plus its remediation.

Fixed and verified:
- H1  moderator could grant admin / hard-revoke  → handler split by field
- H2  unauthenticated 2-report global blocklist  → auth + distinct reporters
      + rate limit + refused when public groups are off
- M1  registration reCAPTCHA was inert           → gate unconditional; the
      desktop client's CSP allows the widget
- M2  QUIC chat/stream handlers lagged WebRTC    → brought to parity; the QUIC
      listener is now off by default ([node] quic_enabled)
- M3  link-preview SSRF gaps                      → rate limit + port allowlist
      + connect-address re-check + decompression-bomb guard
- M4  federated peer over-trust                   → source bound to the signer,
      push capped, revocation prunes the peer's own entries, replay rejected
- M5  no CSP / security headers on the SPA        → middleware; verified against
      the live app with no violations

Withdrawn:
- M6  add_group_member accepting node tokens is deliberate (commit 0443cf8,
      the CLI invite flow). The "fix" broke that flow on the deployed hub and
      was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

1 files changed, 48 insertions, 2 deletions

diff --git a/packages/meshbay-node/tests/test_link_preview_request.py b/packages/meshbay-node/tests/test_link_preview_request.py
index d975f91..fe7dec6 100644
--- a/packages/meshbay-node/tests/test_link_preview_request.py
+++ b/packages/meshbay-node/tests/test_link_preview_request.py
@@ -34,9 +34,10 @@ def _clear_cache():
     webrtc_server._link_preview_cache.clear()
 
 
-def _session(media_cache):
+def _session(media_cache, ctx=None):
     s = WebRTCPeerSession.__new__(WebRTCPeerSession)
-    s._ctx = {"media_cache": media_cache}
+    s._ctx = ctx if ctx is not None else {"media_cache": media_cache}
+    s._peer_id = "t"
     s.sent = []
     s._send = s.sent.append
     return s
@@ -79,6 +80,51 @@ async def test_unfurlable_failure_is_ok_false(media_cache, monkeypatch):
     assert "image_thumb_hash" not in resp
 
 
+async def test_rate_limit_per_connection(media_cache, monkeypatch):
+    """A member firing many previews is bounded; over the ceiling the reply is
+    a plain `ok: false` (bare link) and no outbound fetch is made."""
+    monkeypatch.setattr(webrtc_server, "_LINK_PREVIEW_RATE_PER_CONN", 3)
+    calls = {"n": 0}
+
+    async def counting_preview(url, **k):
+        calls["n"] += 1
+        return {"url": url, "title": "x", "description": None,
+                "site_name": None, "image_url": None}
+    monkeypatch.setattr(linkpreview, "fetch_preview", counting_preview)
+
+    s = _session(media_cache)
+    for i in range(3):
+        await s._do_link_preview_request({"url": f"https://example.com/{i}"})
+    assert calls["n"] == 3
+    assert all(r["ok"] for r in s.sent)
+
+    await s._do_link_preview_request({"url": "https://example.com/over"})
+    assert calls["n"] == 3                 # not fetched
+    assert s.sent[-1]["ok"] is False
+
+
+async def test_rate_limit_is_node_wide(media_cache, monkeypatch):
+    """Two connections share the node-wide ceiling."""
+    monkeypatch.setattr(webrtc_server, "_LINK_PREVIEW_RATE_PER_CONN", 100)
+    monkeypatch.setattr(webrtc_server, "_LINK_PREVIEW_RATE_NODE", 2)
+    calls = {"n": 0}
+
+    async def counting_preview(url, **k):
+        calls["n"] += 1
+        return {"url": url, "title": "x", "description": None,
+                "site_name": None, "image_url": None}
+    monkeypatch.setattr(linkpreview, "fetch_preview", counting_preview)
+
+    ctx = {"media_cache": media_cache}
+    a, b = _session(media_cache, ctx), _session(media_cache, ctx)
+    await a._do_link_preview_request({"url": "https://example.com/a"})
+    await b._do_link_preview_request({"url": "https://example.com/b"})
+    await b._do_link_preview_request({"url": "https://example.com/c"})
+
+    assert calls["n"] == 2
+    assert b.sent[-1]["ok"] is False
+
+
 async def test_second_request_for_the_same_url_is_served_from_cache(media_cache, monkeypatch):
     calls = {"n": 0}