fix: bound pending admin challenges and sign every value an op acts on

Any member could make a node hold unbounded challenge requests; a
connection now keeps at most 8, 64 KiB each. root_add, group_attach,
invite_create and tmdb_config signed less than they did; their subjects
are now canonical JSON of every value (the TMDB token by SHA-256).
MNP 5.0, floor kept at 4.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 9 insertions, 4 deletions

diff --git a/packages/meshbay-node/tests/test_tmdb_config_policy.py b/packages/meshbay-node/tests/test_tmdb_config_policy.py
index 6a51eb0..c671ac8 100644
--- a/packages/meshbay-node/tests/test_tmdb_config_policy.py
+++ b/packages/meshbay-node/tests/test_tmdb_config_policy.py
@@ -22,7 +22,7 @@ from pathlib import Path
 
 import pytest
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-from meshbay_common.adminop import OP_TMDB_CONFIG
+from meshbay_common.adminop import OP_TMDB_CONFIG, tmdb_config_subject
 from meshbay_node.indexer.group_index import GroupIndex
 from meshbay_node.roster import Roster
 from meshbay_node.transport.webrtc_server import WebRTCPeerSession
@@ -134,7 +134,9 @@ async def test_subject_reflects_whether_a_token_was_supplied(tmp_path):
     session._do_tmdb_config({"token": "x"})
 
     _, subject, _, _ = issued[0]
-    assert subject == "custom_token=yes,language=default"
+    # The token is bound by its digest and never written into the subject.
+    assert subject == tmdb_config_subject("x", None)
+    assert "sha256:" in subject and tmdb_config_subject("y", None) != subject
 
 
 async def test_subject_says_no_custom_token_when_none_given(tmp_path):
@@ -146,7 +148,10 @@ async def test_subject_says_no_custom_token_when_none_given(tmp_path):
     session._do_tmdb_config({})
 
     _, subject, _, _ = issued[0]
-    assert subject == "custom_token=no,language=default"
+    # Nothing given means both unchanged — distinct from clearing either.
+    assert subject == tmdb_config_subject(None, None)
+    assert subject != tmdb_config_subject("", None)
+    assert subject != tmdb_config_subject(None, "")
 
 
 async def test_subject_reflects_a_configured_language(tmp_path):
@@ -158,7 +163,7 @@ async def test_subject_reflects_a_configured_language(tmp_path):
     session._do_tmdb_config({"language": "fr-FR"})
 
     _, subject, payload, _ = issued[0]
-    assert subject == "custom_token=no,language=fr-FR"
+    assert subject == tmdb_config_subject(None, "fr-FR")
     assert payload["language"] == "fr-FR"