diff options
Diffstat (limited to 'docs/MESHBAY_DESIGN.md')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 42 |
1 files changed, 39 insertions, 3 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 394dfb5..4541d64 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1006,6 +1006,17 @@ a film already playing — a reconnect fetches a fresh one. `meshbay_common/toke holds the two audience strings, shared by the hub that issues and the node that verifies. +**The MNP token names the node it is for** (`node` claim = that node's Ed25519 +key), and a node refuses a token that names a different key. The client knows +the target node's key before it connects (from `/v1/groups/{id}/nodes`) and asks +for a token bound to it. So the credential a member hands one operator is of no +use at any other node the member belongs to: not for a session there — the +group-key proof already refuses one to whoever does not hold the key — nor for +the **pre-proof window**, where a token accepted at face value would otherwise +fetch the member's *encrypted* keypair bundle for that node. A token that names +no node is accepted, since the hub mints one only for the authenticated +requester and it therefore grants nothing across accounts. + **Authorization rules:** - `group_id` is **mandatory**. Omitting it once skipped the membership check and @@ -1808,7 +1819,10 @@ groups from a client (**NS7**). Signaling is rate-limited, SDP-size bounded, capped per user, and **the caller must share an active group with the target node**. Otherwise any authenticated user could make a third party's machine allocate peer connections on demand (**H6**). -The address in a NAT-punch request must match the caller's source address. +The NAT-punch signal shares the offer relay's gate — the caller must share an +active group with the node, checked before anything reveals whether the node is +connected, so it is no liveness oracle — and the address it names must match the +caller's own source address. **The offer ceilings bound a member and never an ordinary one** (**AV30**). They are sized against an account with twenty groups on three devices, because a @@ -2601,6 +2615,28 @@ its own bounded pool after a file is first seen: the file appears in the index immediately with size and hash, and an index delta fills in the technical and parsed fields once ready. **No scan is blocked waiting for enrichment.** +**TMDB metadata is queried in one node-wide language, and not until one is chosen.** +A cached fiche is keyed by TMDB id alone — it records no language, because there is +only ever one. Two rules keep it honest, both there to make the very first fetch the +right language rather than English-then-corrected: + +- **No language configured, no query.** While `tmdb_language` is unset the node + answers `media_meta_req`/`season_meta_req` with confidence 0 and makes no TMDB call + — it does *not* fall back to TMDB's English default. Browsing the library is what + triggers the lazy fetch, and it routinely happens before the operator has opened the + settings, so querying on an unset language would fetch the whole library in English + and then throw it all away the moment a language was picked — double the requests + against TMDB's rate limit, for a result nobody wanted. The fetch waits for the + choice, so the first (and only) query is in the chosen language. English is a + first-class choice like any other (`en-US`), not the accidental default of skipping + the setting. +- **Changing the language wipes the cache.** A fiche fetched under the old language + would otherwise be served for its whole 30-day TTL. The file→TMDB matches are + language-independent and survive the wipe; only the localized fiches are dropped and + refetched, lazily, on the next request. The client refetches on its own when the + `tmdb_config_ack` carrying the new language arrives, so the grid switches language + (or fills in for the first time) without a page reload. + ### 9.8 Music An album browser and a player over the audio files in the group's configured @@ -3237,7 +3273,7 @@ had already been asked. | **E7** | **Several named roots** per group, forming one virtual root (§6.2) | | **E8** | **exFAT/NTFS and Windows are the common case.** Linux ships first; that is build order, not population (§10) | | **E9** | **Group-related server state lives on the node. Always** (§1.3) | -| **E10** | **The credential a member presents to a node is not the one the hub API accepts.** A member hands its handshake token to the node operator, who is in the threat model, so it is a short-lived node-audience token (`aud = MNP_AUD`, §5.2), useless at the hub API; the session token (`aud` = hub API) is never disclosed to a node. Before this the member presented its hub session token, so an operator held a live hub credential for the member — enough to enumerate their other groups and act as them at the hub. Closed by the audience split and the MNP 4.0 flag day (§5.6) | +| **E10** | **The credential a member presents to a node opens nothing else.** A member hands its handshake token to the node operator (in the threat model), so it is a short-lived node-audience token (`aud = MNP_AUD`, §5.2): the session token that opens the hub API is never disclosed to a node, and the MNP token names the one node it is for (`node` claim) so it cannot be presented to another node the member uses. Established by the MNP 4.0 flag day (§5.6) | | **O1** | Initial key setup in the pre-proof window — deferred; that window is where C4 and C5b came from | | **O2** | A LAN enrolment door — one endpoint, bounded window, one-time code, closing permanently on success | | **O3** | `device_policy {allow_bundle: false}`, signed by a pinned key — **the mechanism that actually closes C4** (§3.7) | @@ -3279,7 +3315,7 @@ had already been asked. 20. **Private keys never leave the device on native clients.** Qualified: a browser has no durable storage of its own and still needs a bundle on each node, so C4 closes for an *account* only when it opts out of browser use. 21. **Hub minimisation is enforced by an acceptance test, not by policy.** The hub must be *unable* to see keys, content or file listings. 22. **No new code exchanges between people.** Safety numbers are refused for identity verification, permanently. The device-linking code is between a person's own devices and is unaffected. The total user-visible cost of the whole authorship story is **one notice**: *"this account's key changed"*. -23. **A member's credential to a node is audience-separated from its hub credential** (**E10**, §5.2). The handshake carries a short-lived `aud = MNP_AUD` token, never the hub session token; the hub API accepts only its own audience. A node operator therefore holds nothing that acts at the hub. +23. **A member's credential to a node is separate from its hub credential and bound to that node** (**E10**, §5.2). The handshake carries a short-lived `aud = MNP_AUD` token that names the node it is for, never the hub session token; the hub API accepts only its own audience, and each node accepts only a token that names it. A node operator therefore holds nothing that acts at the hub or at another node. ### 14.2 Client architecture |