Merge branch 'fix/third-review-h1-h2-m1-m6'

Third security review (docs/third-review.md) plus its remediation.

Fixed and verified:
- H1  moderator could grant admin / hard-revoke  → handler split by field
- H2  unauthenticated 2-report global blocklist  → auth + distinct reporters
      + rate limit + refused when public groups are off
- M1  registration reCAPTCHA was inert           → gate unconditional; the
      desktop client's CSP allows the widget
- M2  QUIC chat/stream handlers lagged WebRTC    → brought to parity; the QUIC
      listener is now off by default ([node] quic_enabled)
- M3  link-preview SSRF gaps                      → rate limit + port allowlist
      + connect-address re-check + decompression-bomb guard
- M4  federated peer over-trust                   → source bound to the signer,
      push capped, revocation prunes the peer's own entries, replay rejected
- M5  no CSP / security headers on the SPA        → middleware; verified against
      the live app with no violations

Withdrawn:
- M6  add_group_member accepting node tokens is deliberate (commit 0443cf8,
      the CLI invite flow). The "fix" broke that flow on the deployed hub and
      was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

1 files changed, 53 insertions, 0 deletions

diff --git a/packages/meshbay-node/tests/test_quic_enabled.py b/packages/meshbay-node/tests/test_quic_enabled.py
new file mode 100644
index 0000000..c0c1568
--- /dev/null
+++ b/packages/meshbay-node/tests/test_quic_enabled.py
@@ -0,0 +1,53 @@
+"""
+The QUIC MNP listener is off unless the operator turns it on.
+
+No shipping client speaks QUIC (browser and desktop use WebRTC; the hub-less
+`group://` sidecar is unbuilt), so a node that started it by default would only
+be exposing a UDP port. `daemon.py` gates `QuicChunkServer` on
+`self._config.node.quic_enabled`; these follow the value down the config path.
+"""
+
+import textwrap
+from pathlib import Path
+
+from meshbay_node.config import load_config
+
+
+def _cfg(tmp_path: Path, body: str):
+    p = tmp_path / "node.toml"
+    p.write_text(textwrap.dedent(body))
+    return load_config(p)
+
+
+def test_off_by_default(tmp_path):
+    cfg = _cfg(tmp_path, """
+        [node]
+        quic_port = 19010
+    """)
+    assert cfg.node.quic_enabled is False
+
+
+def test_the_operator_turns_it_on(tmp_path):
+    cfg = _cfg(tmp_path, """
+        [node]
+        quic_enabled = true
+    """)
+    assert cfg.node.quic_enabled is True
+
+
+def test_the_environment_can_force_it_on(tmp_path, monkeypatch):
+    monkeypatch.setenv("MESHBAY_QUIC_ENABLED", "1")
+    cfg = _cfg(tmp_path, """
+        [node]
+        quic_enabled = false
+    """)
+    assert cfg.node.quic_enabled is True
+
+
+def test_the_environment_can_force_it_off(tmp_path, monkeypatch):
+    monkeypatch.setenv("MESHBAY_QUIC_ENABLED", "false")
+    cfg = _cfg(tmp_path, """
+        [node]
+        quic_enabled = true
+    """)
+    assert cfg.node.quic_enabled is False