fix: a member can no longer lock a node, crash it with a link, or stop hub cleanup

- node: only a wrong code counts towards the join lock, now per account
  (5) as well as node-wide (20), and it is consulted only when a code is
  tried. Every member reconnecting gets the group key through join_request,
  so a lock checked before recognition let one member refuse it to everyone.
- node: link previews read the body as a stream and stop at the cap,
  counted on decoded bytes; a declared oversized image is not read; 15 s
  total deadline; image decoding off the loop. `client.get` had buffered
  the whole (decompressed) response before the caps looked at it.
- hub: the daily purge of never-verified accounts detaches their IP-log
  rows (keeping the name) and clears every other reference first, and each
  cleanup step runs on its own. On PostgreSQL the bare DELETE violated the
  ip_logs foreign key and stopped every purge behind it for good.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 74 insertions, 0 deletions

diff --git a/packages/meshbay-node/tests/test_roster_pairing.py b/packages/meshbay-node/tests/test_roster_pairing.py
index 5c94855..585a909 100644
--- a/packages/meshbay-node/tests/test_roster_pairing.py
+++ b/packages/meshbay-node/tests/test_roster_pairing.py
@@ -339,6 +339,80 @@ async def test_failures_are_counted_across_connections(tmp_path, roster):
         "reconnecting must not reset the pairing budget")
 
 
+async def _grind_wrong_codes(tmp_path, roster, ctx, accounts, per_account):
+    """Wrong codes from several accounts, each on connections of its own."""
+    for n in range(accounts):
+        uid = f"guesser{n}"
+        for _ in range(per_account):
+            session = _session(tmp_path, roster, user_id=uid)
+            session._ctx = ctx
+            sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+            await session._do_join_request(
+                _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64,
+                          code="AAAA-AAAA", user_id=uid))
+
+
+async def test_a_full_code_lock_never_refuses_a_known_member(tmp_path, roster):
+    """
+    Every member reconnecting gets the group key through join_request, so a
+    lock on wrong codes that also refused *recognised* devices let one member
+    take the node away from everybody.
+    """
+    GROUP = "b" * 32
+    gek = generate_gek()
+    sk_ed, pk_ed_b64, pk_x_b64, sk_x = _keypair_full()
+    await roster.pin_identity("grenet", "grenet", pk_ed_b64, pk_x_b64, "code")
+    await roster.set_member(GROUP, "grenet", ROLE_MEMBER, "active", "cbesson")
+
+    member = _session(tmp_path, roster, user_id="grenet", group_id=GROUP,
+                      gek=gek, join_policy="invite")
+    await _grind_wrong_codes(tmp_path, roster, member._ctx, accounts=6,
+                             per_account=5)
+    assert len(member._ctx["join_failures"]) >= 20
+
+    await member._do_join_request(
+        _join_msg(member, sk_ed, pk_ed_b64, pk_x_b64, user_id="grenet"))
+    reply = _last(member)
+    assert reply.get("ok") is True and reply.get("gek") is True, reply
+    assert unwrap_gek_aes(reply, *_x_raw(sk_x, pk_x_b64)) == gek
+
+
+async def test_ordinary_refusals_do_not_feed_the_code_lock(tmp_path, roster):
+    """`code_required` is what every first contact without a code hears."""
+    ctx = None
+    for n in range(30):
+        session = _session(tmp_path, roster, user_id=f"newcomer{n}")
+        if ctx is None:
+            ctx = session._ctx
+        session._ctx = ctx
+        sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+        await session._do_join_request(
+            _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, user_id=f"newcomer{n}"))
+        assert _last(session).get("reason") == "code_required"
+    assert not ctx.get("join_failures")
+
+
+async def test_one_account_guessing_locks_itself_not_the_others(tmp_path, roster):
+    session = _session(tmp_path, roster)
+    ctx = session._ctx
+    await _grind_wrong_codes(tmp_path, roster, ctx, accounts=1, per_account=6)
+    guesser = _session(tmp_path, roster, user_id="guesser0")
+    guesser._ctx = ctx
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    await guesser._do_join_request(
+        _join_msg(guesser, sk_ed, pk_ed_b64, pk_x_b64, code="AAAA-AAAA",
+                  user_id="guesser0"))
+    assert _last(guesser).get("detail") == "Pairing temporarily locked"
+
+    code = await roster.create_invite("", "grenet", ROLE_OPERATOR, "local-cli")
+    honest = _session(tmp_path, roster, user_id="grenet")
+    honest._ctx = ctx
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    await honest._do_join_request(
+        _join_msg(honest, sk_ed, pk_ed_b64, pk_x_b64, code=code))
+    assert await roster.find_device("grenet", pk_ed_b64) is not None
+
+
 async def test_group_id_cannot_name_another_group(tmp_path, roster):
     session = _session(tmp_path, roster)
     session._group_id = "a" * 32