diff options
Diffstat (limited to 'devel-phases-next.md')
| -rw-r--r-- | devel-phases-next.md | 78 |
1 files changed, 76 insertions, 2 deletions
diff --git a/devel-phases-next.md b/devel-phases-next.md index cccce44..3e49f19 100644 --- a/devel-phases-next.md +++ b/devel-phases-next.md @@ -1,6 +1,6 @@ # MeshBay — Next Implementation Phases -> Base: Phases 1–10 complete (except 10.9 → Phase 13). 155 tests. Web SPA + admin panel live on meshbay.org. +> Base: Phases 1–10b complete (except 10.9 → Phase 13). 166 tests. Web SPA + admin panel + self-service UI live on meshbay.org. > Architecture reference: docs/meshbay-draft-v4.md > First security review: first-review.md (2026-08-10) @@ -202,7 +202,7 @@ ICE/STUN handles all tested NAT types automatically. ## Phase 10 — meshbay.org site + admin/moderation UI -Commit: 8fa298e (10.1–10.4), pending (10.5–10.8, 10.10) — 155 tests. +Commit: 8fa298e (10.1–10.4), 022da76 (10.5–10.10) — 155 tests. **Objective:** meshbay.org becomes both a production hub and the project's public website, with admin/moderation interfaces and user-facing features. @@ -331,6 +331,80 @@ same GEK bundles, same storage). Purpose: load distribution via DNS round-robin. --- +## Phase 10b — Self-service UI + client-side features + +Pending commit — 166 tests. + +**Objective:** make the web SPA fully self-service — users can create groups, +manage members, join open groups, upload files, and search across all cached +group file indexes. No admin intervention needed for basic operations. + +### Self-service features + +| # | Component | Status | +|---|---|---| +| 10b.1 | Group creation UI (CreateGroupPage) | ✅ | +| 10b.2 | Member management + invite (MembersPanel) | ✅ | +| 10b.3 | Group join flow (open groups self-join) | ✅ | +| 10b.4 | File upload (client → node via MNP FILE_UPLOAD) | ✅ | +| 10b.5 | IndexedDB caching (group file indexes cached locally) | ✅ | +| 10b.6 | Cross-group file search (SearchPage — client-side, no hub) | ✅ | + +### New API endpoints (10b.1–10b.3) + +| Method | Path | Auth | Description | +|---|---|---|---| +| POST | `/v1/groups` | Access token | Create a new group (name, visibility, join_policy) | +| GET | `/v1/groups/{id}/members` | Access token | List group members (requires membership) | +| POST | `/v1/groups/{id}/join` | Access token | Self-join open group (checks join_policy) | +| POST | `/v1/groups/{id}/members/{username}/gek` | Access token | Store GEK bundle for invitee | +| GET | `/v1/groups/{id}/gek` | Access token | Get own GEK bundle (for wrapping) | + +### New MNP message types (10b.4) + +| Type | Direction | Description | +|---|---|---| +| `file_upload` | client → node | Push encrypted file chunk (filename, chunk_index, total_chunks, data) | +| `file_upload_ack` | node → client | Acknowledge chunk receipt | + +Node stores uploads in `shared_root/.uploads/` as `.part` files during transfer, +renames to final location on last chunk. Filename sanitized (no path traversal). + +### Browser crypto additions (10b.2) + +AES-256-GCM ECIES variant for GEK wrapping in browsers. WebCrypto does not +support ChaCha20-Poly1305, so a parallel ECIES scheme uses AES-256-GCM with +a distinct HKDF info string (`meshbay:gek_wrap:v1:aes` vs `meshbay:gek_wrap:v1`). +Both Python and browser implement the AES variant for interop. + +Functions added to `crypto.js`: `generateGEK()`, `wrapGEK()`, `unwrapGEK()`, +`encryptChunk()`, `b64encode()`. + +Functions added to `crypto.py`: `wrap_gek_aes()`, `unwrap_gek_aes()`. + +### IndexedDB caching (10b.5) + +When a group's file index is fetched from a node, it is cached in IndexedDB +(`meshbay` database, `group_indexes` store). On subsequent visits, cached +entries are shown immediately while the live connection is established. This +gives instant file list display even before WebRTC connects. + +Cache key: `groupId`. Stored: `{ groupId, groupName, entries[], cachedAt }`. +Best-effort — failures are silently ignored. + +### Cross-group file search (10b.6) + +SearchPage component at `#/search`. Searches file names and paths across ALL +cached group indexes in IndexedDB. Pure client-side — no hub involvement. +Results link back to the group page. Accessible from sidebar. + +### Tests added + +- 8 tests: group self-service (create, join open, join invite rejected, join already member, members list, non-member denied, search, join triggers notification) +- 3 tests: AES GEK wrap/unwrap (round-trip, wrong key rejected, differs from ChaCha20 wrap) + +--- + ## Phase 11 — Android client MVP **Objective:** Android app for account creation, group browsing, file download, |