1 files changed, 25 insertions, 11 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
index fc40204..56e0e4b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py
@@ -20,7 +20,7 @@ import time
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, Request
-from pydantic import BaseModel
+from pydantic import BaseModel, Field, field_validator
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -41,9 +41,23 @@ _webrtc_answers: dict[str, asyncio.Future] = {}
 _answer_owner: dict[str, str] = {}
 
 
+# A browser offers a handful of candidates — a host and a reflexive one per
+# interface — and embeds them in the SDP anyway. The list is relayed to the node
+# as it came, so it is bounded like the SDP beside it.
+MAX_ICE_CANDIDATES = 64
+MAX_ICE_BYTES = 32 * 1024
+
+
 class WebRTCOfferRequest(BaseModel):
     sdp: str
-    ice_candidates: list[dict] = []
+    ice_candidates: list[dict] = Field(default_factory=list, max_length=MAX_ICE_CANDIDATES)
+
+    @field_validator("ice_candidates")
+    @classmethod
+    def _bounded(cls, v: list[dict]) -> list[dict]:
+        if len(json.dumps(v)) > MAX_ICE_BYTES:
+            raise ValueError("ICE candidates too large")
+        return v
 
 
 class WebRTCOfferResponse(BaseModel):
@@ -171,19 +185,11 @@ async def webrtc_offer(
     Finding H4: it also ignored group status, so "suspend a group" did not stop new
     connections from being brokered to nodes hosting it.
     """
-    from meshbay_hub.api.revocation import _connected_nodes, _node_groups
+    from meshbay_hub.api.revocation import _connected_nodes
 
     if len(body.sdp) > MAX_SDP_BYTES:
         raise HTTPException(status_code=413, detail="SDP too large")
 
-    # Logged here because this is the moment a browser starts a peer connection,
-    # and the address it starts it from is this one — the hub's own view of the
-    # TCP connection. Whatever address the peers then discover through STUN is
-    # theirs to negotiate and is not what a log should record.
-    db.add(IPLog(user_id=current_user.id, event="webrtc_offer",
-                 ip_address=client_ip(request), detail=node_id[:8]))
-    await db.commit()
-
     ws = _connected_nodes.get(node_id)
     if not ws:
         raise HTTPException(status_code=404, detail="Node not connected")
@@ -205,6 +211,14 @@ async def webrtc_offer(
         raise HTTPException(status_code=429, detail="Too many connections to this node",
                             headers={"Retry-After": str(max(1, math.ceil(wait)))})
 
+    # Logged once the offer is going to a node, not before: the address a peer
+    # connection starts from is the hub's own view of this TCP connection, and an
+    # IP log row is kept a year — written before the checks above, any account
+    # could add rows for any string it named as a node.
+    db.add(IPLog(user_id=current_user.id, event="webrtc_offer",
+                 ip_address=client_ip(request), detail=node_id[:8]))
+    await db.commit()
+
     peer_id = str(uuid.uuid4())
     answer_future: asyncio.Future = asyncio.get_event_loop().create_future()
     _webrtc_answers[peer_id] = answer_future