feat(chat): link previews for pasted URLs

Paste an http(s) link in a group's chat and it unfurls into an OpenGraph
card — title, description, site name, and image — the way WhatsApp/Signal/
Slack do it.

The fetch is the node's, never the browser's or the hub's. The browser
cannot: a strict img-src/connect-src and CORS block it, and a direct fetch
would leak every reader's IP to the linked host on each render. The hub must
not touch group content (draft-v6 §2.5). The node already fetches third-party
metadata for the Videos and Music apps, over the same authorised path.

Flow mirrors media_meta_req: the client sends `link_preview_req {url}`, the
node replies `link_preview_resp` with the card fields (or `ok: false`), and
any OG image is stored under its blake3 in the existing media_cache thumb
store — the client then fetches it via the normal file_req path, exactly like
a poster. Nothing durable is added: the card text lives in a bounded in-memory
TTL cache on the node (draft-v6 §2.7 — enrichment on demand, the asking device
caches), and MNP goes 0.11 → 0.12 (additive: an older node logs "unknown type"
and the client shows the bare link).

Because the URL is chosen by a *member* and triggers an outbound request from
the operator's machine, `linkpreview.safe_url` is an SSRF gate: http(s) only,
no credentials, and every resolved address must be globally routable — no
loopback, private, link-local, multicast or reserved range, cloud-metadata
included. Redirects are followed by hand so each hop is re-checked. Residual,
documented in the module: DNS rebinding between the check and connect, closed
properly by pinning the checked IP — a follow-up.

Also fixes a long-standing chat annoyance the preview cards made worse:
opening the Chat tab landed a screen or two above the newest message because
the scroll-to-bottom ran before attachment thumbnails and (now) preview cards
had loaded and grown the content. A ResizeObserver keeps the view pinned to
the bottom through late content growth, and does nothing once the reader
scrolls up.

Tests: test_linkpreview.py (the SSRF gate and the OpenGraph parse, incl.
redirect re-validation and image downscaling) and test_link_preview_request.py
(reply shape, the media_cache image round-trip, the result cache).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gKJ85aZyvEwarXMFzFEwi

1 files changed, 155 insertions, 0 deletions

diff --git a/packages/meshbay-node/tests/test_linkpreview.py b/packages/meshbay-node/tests/test_linkpreview.py
new file mode 100644
index 0000000..0dd951a
--- /dev/null
+++ b/packages/meshbay-node/tests/test_linkpreview.py
@@ -0,0 +1,155 @@
+"""
+`linkpreview` — the SSRF gate and the OpenGraph parse.
+
+The gate is the part with teeth: the URL is chosen by a *member*, and it
+decides an outbound request from the operator's machine. Anything that is not
+a public http(s) address must be refused before a socket opens.
+"""
+
+import socket
+
+import httpx
+import pytest
+from meshbay_node import linkpreview
+from meshbay_node.linkpreview import UnsafeURL, safe_url
+
+PUBLIC_IP = "93.184.216.34"       # example.com, historically
+
+
+@pytest.fixture
+def resolves_public(monkeypatch):
+    """Every hostname resolves to one public address."""
+    def fake_getaddrinfo(host, port, *a, **k):
+        return [(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP, "",
+                 (PUBLIC_IP, port or 80))]
+    monkeypatch.setattr(linkpreview.socket, "getaddrinfo", fake_getaddrinfo)
+
+
+# ── safe_url ────────────────────────────────────────────────────────────────
+
+@pytest.mark.parametrize("url", [
+    "http://127.0.0.1/x",
+    "http://localhost/x",            # resolves to loopback on any box
+    "http://169.254.169.254/latest/meta-data/",   # cloud metadata
+    "http://[::1]/x",
+    "http://10.1.2.3/x",
+    "http://192.168.0.1/x",
+    "http://172.16.0.1/x",
+    "http://0.0.0.0/x",
+    "http://[::ffff:127.0.0.1]/x",   # v4-mapped loopback
+    "ftp://example.com/x",
+    "file:///etc/passwd",
+    "http://user:pass@example.com/x",
+    "javascript:alert(1)",
+    "not a url",
+])
+def test_safe_url_refuses(url):
+    with pytest.raises(UnsafeURL):
+        safe_url(url)
+
+
+def test_safe_url_accepts_a_public_host(resolves_public):
+    assert safe_url("https://example.com/some/page") == "https://example.com/some/page"
+
+
+def test_safe_url_refuses_a_host_with_any_private_record(monkeypatch):
+    def mixed(host, port, *a, **k):
+        return [
+            (socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP, "", (PUBLIC_IP, port)),
+            (socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP, "", ("127.0.0.1", port)),
+        ]
+    monkeypatch.setattr(linkpreview.socket, "getaddrinfo", mixed)
+    with pytest.raises(UnsafeURL):
+        safe_url("https://sneaky.example/x")
+
+
+# ── fetch_preview ──────────────────────────────────────────────────────────
+
+_HTML = """
+<!doctype html><html><head>
+  <title>Fallback Title</title>
+  <meta property="og:title" content="The Real Title">
+  <meta property="og:description" content="A short summary of the page.">
+  <meta property="og:site_name" content="Example">
+  <meta property="og:image" content="/card.png">
+  <meta name="description" content="ignored, og wins">
+</head><body>...body we should not need...</body></html>
+"""
+
+
+def _client(handler):
+    return httpx.AsyncClient(transport=httpx.MockTransport(handler),
+                             timeout=5.0, max_redirects=0)
+
+
+async def test_fetch_preview_reads_opengraph(resolves_public):
+    def handler(request):
+        return httpx.Response(200, headers={"content-type": "text/html; charset=utf-8"},
+                              text=_HTML)
+    async with _client(handler) as c:
+        meta = await linkpreview.fetch_preview("https://example.com/article", client=c)
+    assert meta["title"] == "The Real Title"
+    assert meta["description"] == "A short summary of the page."
+    assert meta["site_name"] == "Example"
+    assert meta["image_url"] == "https://example.com/card.png"   # absolutised
+
+
+async def test_fetch_preview_falls_back_to_title_tag(resolves_public):
+    def handler(request):
+        return httpx.Response(200, headers={"content-type": "text/html"},
+                              text="<html><head><title>Just A Title</title></head></html>")
+    async with _client(handler) as c:
+        meta = await linkpreview.fetch_preview("https://example.com/", client=c)
+    assert meta["title"] == "Just A Title"
+    assert meta["description"] is None
+
+
+async def test_fetch_preview_gives_up_on_non_html(resolves_public):
+    def handler(request):
+        return httpx.Response(200, headers={"content-type": "application/pdf"},
+                              content=b"%PDF-1.4")
+    async with _client(handler) as c:
+        assert await linkpreview.fetch_preview("https://example.com/x.pdf", client=c) is None
+
+
+async def test_fetch_preview_gives_up_when_nothing_worth_showing(resolves_public):
+    def handler(request):
+        return httpx.Response(200, headers={"content-type": "text/html"},
+                              text="<html><head></head><body>hi</body></html>")
+    async with _client(handler) as c:
+        assert await linkpreview.fetch_preview("https://example.com/", client=c) is None
+
+
+async def test_fetch_preview_revalidates_redirects(monkeypatch):
+    # First host is public; it 302s to a loopback address.
+    calls = {"n": 0}
+
+    def resolve(host, port, *a, **k):
+        ip = PUBLIC_IP if host == "ok.example" else "127.0.0.1"
+        return [(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP, "", (ip, port or 80))]
+    monkeypatch.setattr(linkpreview.socket, "getaddrinfo", resolve)
+
+    def handler(request):
+        calls["n"] += 1
+        return httpx.Response(302, headers={"location": "http://internal.example/secret"})
+    async with _client(handler) as c:
+        meta = await linkpreview.fetch_preview("https://ok.example/start", client=c)
+    assert meta is None
+    assert calls["n"] == 1          # stopped at the redirect, never fetched internal
+
+
+async def test_fetch_image_downscales(resolves_public):
+    from io import BytesIO
+
+    from PIL import Image
+    buf = BytesIO()
+    Image.new("RGB", (2000, 1500), (10, 20, 30)).save(buf, format="PNG")
+    big_png = buf.getvalue()
+
+    def handler(request):
+        return httpx.Response(200, headers={"content-type": "image/png"}, content=big_png)
+    async with _client(handler) as c:
+        jpeg = await linkpreview.fetch_image("https://example.com/card.png", client=c)
+    assert jpeg and jpeg[:2] == b"\xff\xd8"        # JPEG SOI
+    with Image.open(BytesIO(jpeg)) as im:
+        assert max(im.size) <= linkpreview._IMAGE_MAX_DIM