diff options
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py | 41 | ||||
| -rw-r--r-- | packages/meshbay-node/tests/test_roster_pairing.py | 88 |
2 files changed, 123 insertions, 6 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py index 4958b92..dfa775e 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py +++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py @@ -1039,10 +1039,11 @@ class WebRTCPeerSession: f"paired with this node") return if known: - # An operator's row is node-wide (empty group), so a lookup for the - # group they happen to be opening finds nothing. Fall back to it, or - # the client is told it has no role on a node it administers. - member = (await roster.get_member(group_id, user_id) + # This group's own row first; then the join message's group_id (empty + # on the node-wide first connect); then the operator's node-wide row, + # which is where an operator opening any group finds their authority. + member = (await roster.get_member(session_group, user_id) + or await roster.get_member(group_id, user_id) or await roster.get_member("", user_id)) if not member and self._group_join_policy(session_group) == "open": await roster.set_member( @@ -1050,6 +1051,38 @@ class WebRTCPeerSession: status="active", approved_by="open-join", ) member = await roster.get_member(session_group, user_id) + if not member: + # A device this node already pinned — for another group, or an + # operator pairing — opening an invite-only group it has no row + # for. The device-linking `known` fast-path used to drop straight + # into `_join_ok`, which answered `not_authorized_for_group` and + # left a real invitee with no way to redeem the code they were + # sent. Tell them to enter it *only* when one is actually + # waiting for them here; a bare hub-invented pin, with nothing + # inviting it, still gets the flat refusal H3 relies on. + if not code: + invited = any( + i["user_id"] == user_id + and i["group_id"] in (session_group, "") + for i in await roster.list_invites()) + self._join_refuse( + "code_required" if invited else "not_authorized_for_group") + return + invite = await roster.consume_invite(code, user_id) + if not invite: + self._join_refuse("code_invalid") + return + await roster.set_member( + group_id=invite["group_id"], user_id=user_id, + role=invite["role"], status="active", + approved_by=invite["created_by"], + ) + self._audit_join( + "join_pinned", + f"group={invite['group_id'][:8]} role={invite['role']} " + "via=code (device already known)") + member = (await roster.get_member(session_group, user_id) + or await roster.get_member(invite["group_id"], user_id)) await self._join_ok( user_id, pk_x_raw, session_group, role=member["role"] if member else "", diff --git a/packages/meshbay-node/tests/test_roster_pairing.py b/packages/meshbay-node/tests/test_roster_pairing.py index 7eb436c..e1b8a38 100644 --- a/packages/meshbay-node/tests/test_roster_pairing.py +++ b/packages/meshbay-node/tests/test_roster_pairing.py @@ -56,6 +56,14 @@ def _keypair(): return sk_ed, pk_ed_b64, pk_x_b64 +def _x_raw(sk_x, pk_x_b64): + """(sk_x_raw, pk_x_raw) — what unwrap_gek_aes wants.""" + return (sk_x.private_bytes(serialization.Encoding.Raw, + serialization.PrivateFormat.Raw, + serialization.NoEncryption()), + base64.b64decode(pk_x_b64)) + + def _session(tmp_path: Path, roster, user_id: str = "grenet", group_id: str | None = None, gek: bytes | None = None, join_policy: str = "invite") -> WebRTCPeerSession: @@ -383,7 +391,8 @@ async def test_hub_membership_alone_yields_no_key(tmp_path, roster): session = _session(tmp_path, roster, user_id="eve", group_id=GROUP, gek=gek) sk_ed, pk_ed_b64, pk_x_b64 = _keypair() - # Pinned on this node (say, for another group) but never admitted to this one. + # Pinned on this node (say, for another group) but never admitted to this + # one, and with no invite waiting for it here. await roster.pin_identity("eve", "eve", pk_ed_b64, pk_x_b64, "code") await session._do_join_request( @@ -391,7 +400,8 @@ async def test_hub_membership_alone_yields_no_key(tmp_path, roster): user_id="eve", group_id=GROUP)) reply = _last(session) - assert reply.get("gek") is False + assert reply.get("ok") is False + assert not reply.get("gek") assert reply.get("reason") == "not_authorized_for_group" assert "wrapped_b64" not in reply @@ -428,6 +438,80 @@ async def test_invite_only_group_still_demands_a_code(tmp_path, roster): assert await roster.get_identity("newcomer") is None +async def test_known_device_can_still_be_invited_to_another_group(tmp_path, roster): + """ + The regression: grenet's device is pinned here as a member of group A. cbesson + invites grenet to invite-only group B; grenet opens B. This used to answer + `not_authorized_for_group` with no way back — the device-linking `known` + fast-path dropped straight into `_join_ok` and never looked at a code. With a + real invite waiting it must ask for the code, and a valid one must admit. + """ + GROUP_A = "a" * 32 + GROUP_B = "b" * 32 + gek_b = generate_gek() + sk_ed, pk_ed_b64, pk_x_b64, sk_x = _keypair_full() + + await roster.pin_identity("grenet", "grenet", pk_ed_b64, pk_x_b64, "code") + await roster.set_member(GROUP_A, "grenet", ROLE_MEMBER, "active", "cbesson") + code = await roster.create_invite(GROUP_B, "grenet", ROLE_MEMBER, "cbesson") + + session = _session(tmp_path, roster, user_id="grenet", group_id=GROUP_B, + gek=gek_b, join_policy="invite") + + # First connect (node-wide group_id=""), no code: prompt for it, do not refuse. + await session._do_join_request( + _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, + user_id="grenet", group_id="")) + assert _last(session).get("reason") == "code_required" + assert await roster.get_member(GROUP_B, "grenet") is None + + # grenet enters the code cbesson sent through another channel. + await session._do_join_request( + _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, + code=code, user_id="grenet", group_id=GROUP_B)) + + reply = _last(session) + assert reply["ok"] is True and reply["gek"] is True + assert unwrap_gek_aes(reply, *_x_raw(sk_x, pk_x_b64)) == gek_b + member = await roster.get_member(GROUP_B, "grenet") + assert member and member["role"] == ROLE_MEMBER and member["status"] == "active" + + +async def test_known_pin_with_no_invite_still_gets_the_flat_refusal(tmp_path, roster): + """H3 guard: a pinned identity with no membership and no invite waiting for + it here gets `not_authorized_for_group`, not a code prompt.""" + GROUP_B = "b" * 32 + sk_ed, pk_ed_b64, pk_x_b64 = _keypair() + await roster.pin_identity("eve", "eve", pk_ed_b64, pk_x_b64, "code") + await roster.set_member("a" * 32, "eve", ROLE_MEMBER, "active", "cbesson") + + session = _session(tmp_path, roster, user_id="eve", group_id=GROUP_B, + gek=generate_gek(), join_policy="invite") + await session._do_join_request( + _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, + user_id="eve", group_id="")) + assert _last(session).get("reason") == "not_authorized_for_group" + + +async def test_known_device_already_a_member_still_needs_no_code(tmp_path, roster): + """Guard for the fix above: an existing member of B joins B with no code.""" + GROUP_B = "b" * 32 + gek_b = generate_gek() + sk_ed, pk_ed_b64, pk_x_b64, sk_x = _keypair_full() + await roster.pin_identity("grenet", "grenet", pk_ed_b64, pk_x_b64, "code") + await roster.set_member(GROUP_B, "grenet", ROLE_MEMBER, "active", "cbesson") + + session = _session(tmp_path, roster, user_id="grenet", group_id=GROUP_B, + gek=gek_b, join_policy="invite") + await session._do_join_request( + _join_msg(session, sk_ed, pk_ed_b64, pk_x_b64, + user_id="grenet", group_id="")) + + reply = _last(session) + assert reply["ok"] is True and reply["gek"] is True + assert unwrap_gek_aes(reply, *_x_raw(sk_x, pk_x_b64)) == gek_b + + async def test_unknown_group_is_invite_only(tmp_path, roster): """ Fail closed: a group whose policy the node cannot read is treated as |