fix(node): a pinned device can be invited to a further invite-only group

Regression from device linking (Stage C, 2026-08-18). Once a device is
pinned on a node — as a member of one group, or an operator pairing — the
`known` fast-path in `_do_join_request` dropped straight into `_join_ok`.
For any *other* invite-only group it had no roster row for, that answered
`not_authorized_for_group` and stopped there: the client never got
`code_required`, so the pairing-code form never appeared and a legitimately
invited member could not join.

The `known` branch now, when there is no membership for the group being
opened:
  - with a valid code → consumes the invite and admits (as the unknown-
    device path already does);
  - with no code but an invite waiting for this user here → `code_required`,
    so the client prompts;
  - with no code and nothing inviting them → `not_authorized_for_group`,
    unchanged, so the H3 guarantee (a hub-invented pin gets no key) holds.

Also fixed: the group's own roster row is now consulted first, so an
existing member opening their group is never mistaken for a stranger.

Tests in test_roster_pairing.py cover all three branches plus the H3 guard.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gKJ85aZyvEwarXMFzFEwi

2 files changed, 123 insertions, 6 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 4958b92..dfa775e 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -1039,10 +1039,11 @@ class WebRTCPeerSession:
                 f"paired with this node")
             return
         if known:
-            # An operator's row is node-wide (empty group), so a lookup for the
-            # group they happen to be opening finds nothing. Fall back to it, or
-            # the client is told it has no role on a node it administers.
-            member = (await roster.get_member(group_id, user_id)
+            # This group's own row first; then the join message's group_id (empty
+            # on the node-wide first connect); then the operator's node-wide row,
+            # which is where an operator opening any group finds their authority.
+            member = (await roster.get_member(session_group, user_id)
+                      or await roster.get_member(group_id, user_id)
                       or await roster.get_member("", user_id))
             if not member and self._group_join_policy(session_group) == "open":
                 await roster.set_member(
@@ -1050,6 +1051,38 @@ class WebRTCPeerSession:
                     status="active", approved_by="open-join",
                 )
                 member = await roster.get_member(session_group, user_id)
+            if not member:
+                # A device this node already pinned — for another group, or an
+                # operator pairing — opening an invite-only group it has no row
+                # for. The device-linking `known` fast-path used to drop straight
+                # into `_join_ok`, which answered `not_authorized_for_group` and
+                # left a real invitee with no way to redeem the code they were
+                # sent. Tell them to enter it *only* when one is actually
+                # waiting for them here; a bare hub-invented pin, with nothing
+                # inviting it, still gets the flat refusal H3 relies on.
+                if not code:
+                    invited = any(
+                        i["user_id"] == user_id
+                        and i["group_id"] in (session_group, "")
+                        for i in await roster.list_invites())
+                    self._join_refuse(
+                        "code_required" if invited else "not_authorized_for_group")
+                    return
+                invite = await roster.consume_invite(code, user_id)
+                if not invite:
+                    self._join_refuse("code_invalid")
+                    return
+                await roster.set_member(
+                    group_id=invite["group_id"], user_id=user_id,
+                    role=invite["role"], status="active",
+                    approved_by=invite["created_by"],
+                )
+                self._audit_join(
+                    "join_pinned",
+                    f"group={invite['group_id'][:8]} role={invite['role']} "
+                    "via=code (device already known)")
+                member = (await roster.get_member(session_group, user_id)
+                          or await roster.get_member(invite["group_id"], user_id))
             await self._join_ok(
                 user_id, pk_x_raw, session_group,
                 role=member["role"] if member else "",
diff --git a/packages/meshbay-node/tests/test_roster_pairing.py b/packages/meshbay-node/tests/test_roster_pairing.py
index 7eb436c..e1b8a38 100644
--- a/packages/meshbay-node/tests/test_roster_pairing.py
+++ b/packages/meshbay-node/tests/test_roster_pairing.py
@@ -56,6 +56,14 @@ def _keypair():
     return sk_ed, pk_ed_b64, pk_x_b64
 
 
+def _x_raw(sk_x, pk_x_b64):
+    """(sk_x_raw, pk_x_raw) — what unwrap_gek_aes wants."""
+    return (sk_x.private_bytes(serialization.Encoding.Raw,
+                               serialization.PrivateFormat.Raw,
+                               serialization.NoEncryption()),
+            base64.b64decode(pk_x_b64))
+
+
 def _session(tmp_path: Path, roster, user_id: str = "grenet",
              group_id: str | None = None, gek: bytes | None = None,
              join_policy: str = "invite") -> WebRTCPeerSession:
@@ -383,7 +391,8 @@ async def test_hub_membership_alone_yields_no_key(tmp_path, roster):
     session = _session(tmp_path, roster, user_id="eve", group_id=GROUP, gek=gek)
     sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
 
-    # Pinned on this node (say, for another group) but never admitted to this one.
+    # Pinned on this node (say, for another group) but never admitted to this
+    # one, and with no invite waiting for it here.
     await roster.pin_identity("eve", "eve", pk_ed_b64, pk_x_b64, "code")
 
     await session._do_join_request(
@@ -391,7 +400,8 @@ async def test_hub_membership_alone_yields_no_key(tmp_path, roster):
                   user_id="eve", group_id=GROUP))
 
     reply = _last(session)
-    assert reply.get("gek") is False
+    assert reply.get("ok") is False
+    assert not reply.get("gek")
     assert reply.get("reason") == "not_authorized_for_group"
     assert "wrapped_b64" not in reply
 
@@ -428,6 +438,80 @@ async def test_invite_only_group_still_demands_a_code(tmp_path, roster):
     assert await roster.get_identity("newcomer") is None
 
 
+async def test_known_device_can_still_be_invited_to_another_group(tmp_path, roster):
+    """
+    The regression: grenet's device is pinned here as a member of group A. cbesson
+    invites grenet to invite-only group B; grenet opens B. This used to answer
+    `not_authorized_for_group` with no way back — the device-linking `known`
+    fast-path dropped straight into `_join_ok` and never looked at a code. With a
+    real invite waiting it must ask for the code, and a valid one must admit.
+    """
+    GROUP_A = "a" * 32
+    GROUP_B = "b" * 32
+    gek_b = generate_gek()
+    sk_ed, pk_ed_b64, pk_x_b64, sk_x = _keypair_full()
+
+    await roster.pin_identity("grenet", "grenet", pk_ed_b64, pk_x_b64, "code")
+    await roster.set_member(GROUP_A, "grenet", ROLE_MEMBER, "active", "cbesson")
+    code = await roster.create_invite(GROUP_B, "grenet", ROLE_MEMBER, "cbesson")
+
+    session = _session(tmp_path, roster, user_id="grenet", group_id=GROUP_B,
+                       gek=gek_b, join_policy="invite")
+
+    # First connect (node-wide group_id=""), no code: prompt for it, do not refuse.
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64,
+                  user_id="grenet", group_id=""))
+    assert _last(session).get("reason") == "code_required"
+    assert await roster.get_member(GROUP_B, "grenet") is None
+
+    # grenet enters the code cbesson sent through another channel.
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64,
+                  code=code, user_id="grenet", group_id=GROUP_B))
+
+    reply = _last(session)
+    assert reply["ok"] is True and reply["gek"] is True
+    assert unwrap_gek_aes(reply, *_x_raw(sk_x, pk_x_b64)) == gek_b
+    member = await roster.get_member(GROUP_B, "grenet")
+    assert member and member["role"] == ROLE_MEMBER and member["status"] == "active"
+
+
+async def test_known_pin_with_no_invite_still_gets_the_flat_refusal(tmp_path, roster):
+    """H3 guard: a pinned identity with no membership and no invite waiting for
+    it here gets `not_authorized_for_group`, not a code prompt."""
+    GROUP_B = "b" * 32
+    sk_ed, pk_ed_b64, pk_x_b64 = _keypair()
+    await roster.pin_identity("eve", "eve", pk_ed_b64, pk_x_b64, "code")
+    await roster.set_member("a" * 32, "eve", ROLE_MEMBER, "active", "cbesson")
+
+    session = _session(tmp_path, roster, user_id="eve", group_id=GROUP_B,
+                       gek=generate_gek(), join_policy="invite")
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64,
+                  user_id="eve", group_id=""))
+    assert _last(session).get("reason") == "not_authorized_for_group"
+
+
+async def test_known_device_already_a_member_still_needs_no_code(tmp_path, roster):
+    """Guard for the fix above: an existing member of B joins B with no code."""
+    GROUP_B = "b" * 32
+    gek_b = generate_gek()
+    sk_ed, pk_ed_b64, pk_x_b64, sk_x = _keypair_full()
+    await roster.pin_identity("grenet", "grenet", pk_ed_b64, pk_x_b64, "code")
+    await roster.set_member(GROUP_B, "grenet", ROLE_MEMBER, "active", "cbesson")
+
+    session = _session(tmp_path, roster, user_id="grenet", group_id=GROUP_B,
+                       gek=gek_b, join_policy="invite")
+    await session._do_join_request(
+        _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64,
+                  user_id="grenet", group_id=""))
+
+    reply = _last(session)
+    assert reply["ok"] is True and reply["gek"] is True
+    assert unwrap_gek_aes(reply, *_x_raw(sk_x, pk_x_b64)) == gek_b
+
+
 async def test_unknown_group_is_invite_only(tmp_path, roster):
     """
     Fail closed: a group whose policy the node cannot read is treated as