diff options
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/static/auth-page.js | 37 | ||||
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/static/group-settings.js | 9 | ||||
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/static/style.css | 2 | ||||
| -rw-r--r-- | packages/meshbay-hub/tests/test_invite_email_choice.py | 5 | ||||
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/cli/setup.py | 5 | ||||
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/platform.py | 64 | ||||
| -rw-r--r-- | packages/meshbay-node/tests/test_platform.py | 63 | ||||
| -rw-r--r-- | packaging/README.md | 2 | ||||
| -rwxr-xr-x | packaging/build/build-node.sh | 11 | ||||
| -rw-r--r-- | packaging/win/build-node-runtime.ps1 | 8 |
10 files changed, 106 insertions, 100 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/auth-page.js b/packages/meshbay-hub/src/meshbay_hub/static/auth-page.js index 2164eae..09c4acf 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/auth-page.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/auth-page.js @@ -344,6 +344,23 @@ function WelcomePitch() { `; } +// The sign-in page's dark gradient backdrop and frosted card, without the +// pitch beside it — so Register (and its verify/recovery/done steps) sits on +// the same background and reads in the same dark theme as Login. A lone +// `.welcome-side` is centred by `.welcome`'s `justify-content`. +function AuthShell({ children }) { + return html` + <div class="page-center"> + <div class="welcome-backdrop" aria-hidden="true"></div> + <div class="welcome"> + <div class="welcome-side"> + ${children} + </div> + </div> + </div> + `; +} + export function RegisterPage() { const [username, setUsername] = useState(''); const [email, setEmail] = useState(''); @@ -358,7 +375,9 @@ export function RegisterPage() { const [recoveryMnemonic, setRecoveryMnemonic] = useState(''); const [recoverySaved, setRecoverySaved] = useState(false); const [recoveryCopied, setRecoveryCopied] = useState(false); - const [emailRecovery, setEmailRecovery] = useState(true); + // Off by default: mailing the recovery key is opt-in — the key is shown on + // screen to save, and sending a copy is the user's own choice to make. + const [emailRecovery, setEmailRecovery] = useState(false); const captcha = useCaptcha(); const onSubmit = async (e) => { @@ -457,7 +476,7 @@ export function RegisterPage() { if (phase === 'done') { return html` - <div class="page-center"> + <${AuthShell}> <div class="card login-card"> <h2>${t('register.verified_title')}</h2> <p style="text-align:center; margin-bottom:16px; color:var(--text-secondary)"> @@ -467,7 +486,7 @@ export function RegisterPage() { <p style="text-align:center; margin-bottom:16px">${t('invite.after_register')}</p>`} <a href="#/login" style="display:block; text-align:center">${t('register.go_login')}</a> </div> - </div> + </${AuthShell}> `; } @@ -480,7 +499,7 @@ export function RegisterPage() { } catch { /* clipboard blocked — the text is on screen to copy by hand */ } }; return html` - <div class="page-center"> + <${AuthShell}> <div class="card login-card"> <h2>${t('register.recovery_title')}</h2> <p style="margin-bottom:12px; color:var(--text-secondary)"> @@ -509,13 +528,13 @@ export function RegisterPage() { ${t('register.recovery_continue')} </button> </div> - </div> + </${AuthShell}> `; } if (phase === 'verify') { return html` - <div class="page-center"> + <${AuthShell}> <div class="card login-card"> <h2>${t('register.success_title')}</h2> <p style="text-align:center; margin-bottom:16px; color:var(--text-secondary)"> @@ -538,12 +557,12 @@ export function RegisterPage() { ${t('register.resend_sent')}</span>`} </div> </div> - </div> + </${AuthShell}> `; } return html` - <div class="page-center"> + <${AuthShell}> <div class="card login-card"> <h2>${t('register.title')}</h2> <form onSubmit=${onSubmit}> @@ -585,7 +604,7 @@ export function RegisterPage() { ${t('register.has_account')} <a href="#/login">${t('register.login_link')}</a> </div> </div> - </div> + </${AuthShell}> `; } diff --git a/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js b/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js index a510e63..fba8a0e 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js @@ -417,7 +417,8 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef, // Whether the hub mails the invitation. Checked, the hub is handed the code // to write it into the mail — so it is the inviter's choice, remembered per // account (docs/MESHBAY_DESIGN.md §3.4). Unchecked, the hub never sees it. - const [inviteByEmail, setInviteByEmail] = useState(true); + // Off by default: mailing the code is opt-in, not something to do unasked. + const [inviteByEmail, setInviteByEmail] = useState(false); const [error, setError] = useState(''); // Node loopback state (Electron-only) @@ -811,7 +812,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef, useEffect(() => { hubFetch('/v1/users/me/preferences', { token }) - .then(prefs => setInviteByEmail(prefs[INVITE_EMAIL_PREF] !== 'false')) + .then(prefs => setInviteByEmail(prefs[INVITE_EMAIL_PREF] === 'true')) .catch(() => {}); }, [token]); @@ -1059,7 +1060,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef, ${inviting ? '...' : t('members.invite_btn')} </button> </div> - <label style="display:flex; gap:8px; align-items:flex-start; margin:6px 0 0; + <label style="display:flex; gap:8px; align-items:center; margin:6px 0 0; font-size:0.88em; color:var(--text-secondary)"> <input type="checkbox" checked=${inviteByEmail} onChange=${e => toggleInviteByEmail(e.target.checked)} /> @@ -1105,7 +1106,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef, ${linking ? '...' : t('members.link_btn')} </button> </div> - <label style="display:flex; gap:8px; align-items:flex-start; margin:6px 0 0; + <label style="display:flex; gap:8px; align-items:center; margin:6px 0 0; font-size:0.88em; color:var(--text-secondary)"> <input type="checkbox" checked=${inviteByEmail} onChange=${e => toggleInviteByEmail(e.target.checked)} /> diff --git a/packages/meshbay-hub/src/meshbay_hub/static/style.css b/packages/meshbay-hub/src/meshbay_hub/static/style.css index 37775d8..8433b1a 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/style.css +++ b/packages/meshbay-hub/src/meshbay_hub/static/style.css @@ -682,7 +682,7 @@ a:hover { text-decoration: underline; } overflow: hidden; pointer-events: none; background: linear-gradient(155deg, - #86a3c4 0%, #6a819b 18%, #3d4d61 42%, #232b36 66%, #0f1113 100%); + #809cbc 0%, #6a819b 18%, #3d4d61 42%, #232b36 66%, #0f1113 100%); } /* The night-blue pool. */ .welcome-backdrop::before { diff --git a/packages/meshbay-hub/tests/test_invite_email_choice.py b/packages/meshbay-hub/tests/test_invite_email_choice.py index e04c31f..de9410d 100644 --- a/packages/meshbay-hub/tests/test_invite_email_choice.py +++ b/packages/meshbay-hub/tests/test_invite_email_choice.py @@ -3,8 +3,9 @@ Whether the hub mails an invitation is the inviter's choice, and it is remembere Mailing it hands the hub the code — `invite-notify` writes it into the message — which is exactly what §3.4 says the code is for not doing. So the Members tab -offers it as a box, checked by default, and an unchecked box must mean the hub -is never asked. The choice lives in an account preference; a key the hub does +offers it as a box, unchecked by default (mailing the code is opt-in), and an +unchecked box must mean the hub is never asked. The choice lives in an account +preference, remembered once set; a key the hub does not list is refused, and the box would snap back on every click with nothing on screen to say why. """ diff --git a/packages/meshbay-node/src/meshbay_node/cli/setup.py b/packages/meshbay-node/src/meshbay_node/cli/setup.py index b2a8e83..48a55ef 100644 --- a/packages/meshbay-node/src/meshbay_node/cli/setup.py +++ b/packages/meshbay-node/src/meshbay_node/cli/setup.py @@ -33,11 +33,6 @@ def init(args) -> None: cfg_dir = cfg_path.parent cfg_dir.mkdir(parents=True, exist_ok=True) - from meshbay_node.platform import install_node_env - env_written = install_node_env(cfg_dir) - if env_written: - print(f"Wrote {env_written} (packaged defaults).") - hub_url = args.hub_url username = args.username diff --git a/packages/meshbay-node/src/meshbay_node/platform.py b/packages/meshbay-node/src/meshbay_node/platform.py index 7e840ad..7db251b 100644 --- a/packages/meshbay-node/src/meshbay_node/platform.py +++ b/packages/meshbay-node/src/meshbay_node/platform.py @@ -80,9 +80,10 @@ def state_dir() -> Path: def packaged_default_env() -> Path | None: """ The `default.env` shipped with the package: build-time defaults, currently - the shared read-only TMDB token. `init` copies it to config_dir()/node.env - and nothing reads it in place, so an operator's edits to their own copy - survive an upgrade. + the shared read-only TMDB token. The daemon reads it in place, beneath + <config>/node.env, so it reaches every node however that node was set up -- + `meshbay-node init` and the desktop client's onboarding alike -- and an + operator's own node.env still wins. Frozen (PyInstaller/Windows): beside the executable, where build-node-runtime.ps1 puts it -- the same placement it uses for ffmpeg. @@ -102,39 +103,7 @@ def packaged_default_env() -> Path | None: return None -def install_node_env(target_dir: Path) -> Path | None: - """ - Copy the packaged default.env to <target_dir>/node.env, once, at init. - - Never overwrites: an existing node.env holds the operator's own values, and - silently replacing a configured token with the packaged one would be worse - than doing nothing. Returns the path when written, None when there was - nothing to copy or a file was already there. - """ - src = packaged_default_env() - if src is None: - return None - dest = target_dir / "node.env" - if dest.exists(): - return None - dest.write_bytes(src.read_bytes()) - chmod_private(dest) - return dest - - -def load_node_env(source_dir: Path) -> int: - """ - Read <source_dir>/node.env into os.environ, returning how many names were - set. - - systemd does this on Linux through `EnvironmentFile=`, but the Windows - autostart is a Startup-folder .vbs with no equivalent, so the daemon reads - the file itself and both platforms behave the same. An existing environment - variable always wins -- an operator exporting a value, or systemd having - already loaded the same file, overrides the packaged default rather than - being overridden by it. - """ - path = source_dir / "node.env" +def _load_env_file(path: Path) -> int: try: text = path.read_text(encoding="utf-8") except (OSError, UnicodeDecodeError): @@ -154,6 +123,29 @@ def load_node_env(source_dir: Path) -> int: return count +def load_node_env(source_dir: Path) -> int: + """ + Read <source_dir>/node.env, then the packaged default.env, into + os.environ, returning how many names were set. + + systemd does the first through `EnvironmentFile=`, but the Windows + autostart is a Startup-folder .vbs with no equivalent, so the daemon reads + the file itself and both platforms behave the same. An existing environment + variable always wins, and node.env wins over the packaged default -- an + operator exporting a value, or systemd having already loaded the same file, + overrides the packaged default rather than being overridden by it. + + The packaged default used to reach a node only as a copy made by + `meshbay-node init`; a node onboarded by the desktop client never ran it and + ran with no TMDB token at all. + """ + count = _load_env_file(source_dir / "node.env") + packaged = packaged_default_env() + if packaged is not None: + count += _load_env_file(packaged) + return count + + # ── File permissions ───────────────────────────────────────────────────────── diff --git a/packages/meshbay-node/tests/test_platform.py b/packages/meshbay-node/tests/test_platform.py index 5c80c5b..bebe8d9 100644 --- a/packages/meshbay-node/tests/test_platform.py +++ b/packages/meshbay-node/tests/test_platform.py @@ -427,39 +427,8 @@ def test_source_checkout_has_no_packaged_default(monkeypatch, tmp_path): assert plat.packaged_default_env() is None -def test_install_node_env_copies_once(monkeypatch, tmp_path): - src = tmp_path / "default.env" - src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJfirst\n") - monkeypatch.setattr(plat, "packaged_default_env", lambda: src) - cfg = tmp_path / "config" - cfg.mkdir() - - written = plat.install_node_env(cfg) - assert written == cfg / "node.env" - assert "eyJfirst" in written.read_text() - - -def test_install_node_env_never_overwrites_operator_values(monkeypatch, tmp_path): - """An existing node.env holds the operator's own token; clobbering it would - silently downgrade a configured node to the shared default.""" - src = tmp_path / "default.env" - src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJpackaged\n") - monkeypatch.setattr(plat, "packaged_default_env", lambda: src) - cfg = tmp_path / "config" - cfg.mkdir() - (cfg / "node.env").write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJoperator\n") - - assert plat.install_node_env(cfg) is None - assert "eyJoperator" in (cfg / "node.env").read_text() - - -def test_install_node_env_is_a_noop_without_a_package(monkeypatch, tmp_path): - monkeypatch.setattr(plat, "packaged_default_env", lambda: None) - assert plat.install_node_env(tmp_path) is None - assert not (tmp_path / "node.env").exists() - - def test_load_node_env_sets_names(monkeypatch, tmp_path): + monkeypatch.setattr(plat, "packaged_default_env", lambda: None) (tmp_path / "node.env").write_text( "# a comment\n" "\n" @@ -482,5 +451,33 @@ def test_load_node_env_does_not_override_the_environment(monkeypatch, tmp_path): assert os.environ["MESHBAY_TMDB_DEFAULT_TOKEN"] == "eyJfromenv" -def test_load_node_env_tolerates_a_missing_file(tmp_path): +def test_load_node_env_tolerates_a_missing_file(monkeypatch, tmp_path): + monkeypatch.setattr(plat, "packaged_default_env", lambda: None) assert plat.load_node_env(tmp_path) == 0 + + +def test_load_node_env_reads_the_packaged_default_without_a_node_env(monkeypatch, tmp_path): + """A node onboarded by the desktop client has no node.env: nothing ran + `init` to copy one. The packaged token must reach it anyway.""" + src = tmp_path / "default.env" + src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJpackaged\n") + monkeypatch.setattr(plat, "packaged_default_env", lambda: src) + monkeypatch.delenv("MESHBAY_TMDB_DEFAULT_TOKEN", raising=False) + cfg = tmp_path / "config" + cfg.mkdir() + + assert plat.load_node_env(cfg) == 1 + assert os.environ["MESHBAY_TMDB_DEFAULT_TOKEN"] == "eyJpackaged" + + +def test_load_node_env_prefers_the_operator_node_env(monkeypatch, tmp_path): + src = tmp_path / "default.env" + src.write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJpackaged\n") + monkeypatch.setattr(plat, "packaged_default_env", lambda: src) + monkeypatch.delenv("MESHBAY_TMDB_DEFAULT_TOKEN", raising=False) + cfg = tmp_path / "config" + cfg.mkdir() + (cfg / "node.env").write_text("MESHBAY_TMDB_DEFAULT_TOKEN=eyJoperator\n") + + plat.load_node_env(cfg) + assert os.environ["MESHBAY_TMDB_DEFAULT_TOKEN"] == "eyJoperator" diff --git a/packaging/README.md b/packaging/README.md index b65d0ed..6081fc7 100644 --- a/packaging/README.md +++ b/packaging/README.md @@ -95,7 +95,7 @@ no key-generation step to run by hand. ## Post-install (node) ```bash -meshbay-node init # copies default.env (with TMDB token) +meshbay-node init nano ~/.config/meshbay/node.toml systemctl --user enable --now meshbay-node ``` diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh index 8970176..fde67a5 100755 --- a/packaging/build/build-node.sh +++ b/packaging/build/build-node.sh @@ -45,8 +45,10 @@ ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node" # --- Node-specific assets ------------------------------------------------- mkdir -p "$ROOT/opt/meshbay-node/share" -# Default env with the shared TMDB token, read at build time and copied to -# <config>/node.env by `meshbay-node init`. +# Default env with the shared TMDB token, read at build time. The daemon reads +# it in place, beneath <config>/node.env, so it must be readable by whoever runs +# the node -- 0600 root made it unreadable to every per-user node. It is the +# same token in every copy of the package, so 0644 hides nothing. # # tmdb.py sends `Authorization: Bearer`, so this is the v4 *read access token* # (a JWT, "eyJ..."), not the 32-char v3 API key that sits beside it in the same @@ -72,13 +74,12 @@ fi if [ -n "$TMDB_TOKEN" ]; then cat > "$ROOT/opt/meshbay-node/share/default.env" <<EOF # Default environment for meshbay-node. -# Copied to <config>/node.env by 'meshbay-node init' if it does not exist. -# The operator may override any value there or in the systemd EnvironmentFile. +# Read by the daemon beneath <config>/node.env; set a value there to override it. # TMDB API token for the Videos app (read-only, shared across installations) MESHBAY_TMDB_DEFAULT_TOKEN=$TMDB_TOKEN EOF - chmod 600 "$ROOT/opt/meshbay-node/share/default.env" + chmod 644 "$ROOT/opt/meshbay-node/share/default.env" echo " TMDB token baked into default.env (${#TMDB_TOKEN} chars)" elif [ "${MESHBAY_ALLOW_NO_TMDB:-0}" = "1" ]; then echo " !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" >&2 diff --git a/packaging/win/build-node-runtime.ps1 b/packaging/win/build-node-runtime.ps1 index 20eacc8..28c4061 100644 --- a/packaging/win/build-node-runtime.ps1 +++ b/packaging/win/build-node-runtime.ps1 @@ -120,9 +120,9 @@ else { # --- 5. default.env (shared TMDB token) ------------------------------ # Beside the exe, where platform.packaged_default_env() looks for it, and the -# same placement ffmpeg gets above. `meshbay-node init` copies it to -# %LOCALAPPDATA%\meshbay\node.env, and the daemon loads that file itself: -# Windows autostart is a Startup-folder .vbs, with no systemd EnvironmentFile. +# same placement ffmpeg gets above. The daemon reads it in place, beneath +# %LOCALAPPDATA%\meshbay\node.env: Windows autostart is a Startup-folder .vbs, +# with no systemd EnvironmentFile. function Get-TmdbToken([string]$File) { if (-not $File -or -not (Test-Path -LiteralPath $File)) { return "" } $lines = Get-Content -LiteralPath $File @@ -149,7 +149,7 @@ $noBom = New-Object System.Text.UTF8Encoding $false # a BOM would break parsin if ($tmdb) { $body = @( "# Default environment for meshbay-node.", - "# Copied to <config>\node.env by 'meshbay-node init' if it does not exist.", + "# Read by the daemon beneath <config>\node.env; set a value there to override it.", "", "# TMDB API token for the Videos app (read-only, shared across installations)", "MESHBAY_TMDB_DEFAULT_TOKEN=$tmdb" |