diff options
Diffstat (limited to 'docs/MESHBAY_NODE_PROTOCOL.md')
| -rw-r--r-- | docs/MESHBAY_NODE_PROTOCOL.md | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/docs/MESHBAY_NODE_PROTOCOL.md b/docs/MESHBAY_NODE_PROTOCOL.md index 2206971..3351793 100644 --- a/docs/MESHBAY_NODE_PROTOCOL.md +++ b/docs/MESHBAY_NODE_PROTOCOL.md @@ -866,10 +866,11 @@ source of authority is a second thing to get wrong. ### 8.6 Invitation links (`kind = "link"`) A code for someone who may have no account yet, so it names none: it is bound to the -first account that redeems it (`invite_link_create`, §10.4). What stops a stranger -holding it is not the node but the hub, which lets only the account whose verified -address the inviter named reach the node at all (`MESHBAY_DESIGN.md` §3.4). At the -node it is therefore a **bearer code**, and everything else about it is fixed: +first account that redeems it (`invite_link_create`, §10.4). Nothing stops a +stranger holding the whole link — the hub's ticket is a bearer secret too +(`MESHBAY_DESIGN.md` §3.4) — so what bounds it is that it works once, for seven +days, and can be cancelled. At the node it is a **bearer code**, and everything else +about it is fixed: * role `member`, never `operator`; a row that says otherwise is refused, not honoured; * one named group, never node-wide, and only redeemed on a connection authenticated to |