1 files changed, 94 insertions, 9 deletions
diff --git a/packages/meshbay-hub/tests/test_moderation.py b/packages/meshbay-hub/tests/test_moderation.py
index 3109e29..b328d67 100644
--- a/packages/meshbay-hub/tests/test_moderation.py
+++ b/packages/meshbay-hub/tests/test_moderation.py
@@ -22,6 +22,20 @@ async def _register_and_login(client, username: str) -> dict:
     return {"Authorization": f"Bearer {r.json()['access_token']}"}
 
 
+async def _node_headers(client, username: str) -> dict:
+    """A node daemon's token for a fresh account — what a node syncs with."""
+    from meshbay_hub.auth import issue_access_token
+    user = await _register_and_login(client, username)
+    me = (await client.get("/v1/users/me", headers=user)).json()
+    tok = issue_access_token(me["user_id"], ttl=3600, groups=[], scope="node")
+    return {"Authorization": f"Bearer {tok}"}
+
+
+async def _blocked(client, h: str) -> bool:
+    node = await _node_headers(client, f"node_{h[:6]}_{len(h)}")
+    return h in (await client.get("/v1/blocklist", headers=node)).json()["hashes"]
+
+
 @pytest.fixture
 async def reporter(client):
     return await _register_and_login(client, "reporter_one")
@@ -69,8 +83,7 @@ async def test_same_reporter_cannot_walk_the_threshold(client, reporter):
     assert r.json()["report_count"] == 1
     assert r.json()["status"] == "already_reported"
 
-    check = await client.get(f"/v1/blocklist/check?hash={h}")
-    assert check.json()["blocked"] is False
+    assert not await _blocked(client, h)
 
 
 @pytest.mark.asyncio
@@ -84,8 +97,7 @@ async def test_auto_block_on_distinct_reporters(client):
     assert r.json()["status"] == "auto_blocked"
     assert r.json()["report_count"] == 3
 
-    check = await client.get(f"/v1/blocklist/check?hash={h}")
-    assert check.json()["blocked"] is True
+    assert await _blocked(client, h)
 
 
 @pytest.mark.asyncio
@@ -118,14 +130,13 @@ async def test_admin_add_remove_blocklist(client, admin_headers):
                           headers=admin_headers)
     assert r.status_code == 201
 
-    r = await client.get(f"/v1/blocklist/check?hash={hash4}")
-    assert r.json()["blocked"] is True
+    assert await _blocked(client, hash4)
 
     r = await client.delete(f"/v1/admin/blocklist/{hash4}", headers=admin_headers)
     assert r.status_code == 200
 
-    r = await client.get(f"/v1/blocklist/check?hash={hash4}")
-    assert r.json()["blocked"] is False
+    node = await _node_headers(client, "node_after_unblock")
+    assert hash4 not in (await client.get("/v1/blocklist", headers=node)).json()["hashes"]
 
 
 @pytest.mark.asyncio
@@ -134,6 +145,80 @@ async def test_full_blocklist(client, admin_headers):
     await client.post("/v1/admin/blocklist",
                       json={"content_hash": hash5, "reason": "test"},
                       headers=admin_headers)
-    r = await client.get("/v1/blocklist")
+    node = await _node_headers(client, "node_full")
+    r = await client.get("/v1/blocklist", headers=node)
     assert r.status_code == 200
     assert hash5 in r.json()["hashes"]
+
+
+@pytest.mark.asyncio
+async def test_only_a_node_token_reads_the_blocklist(client, reporter):
+    assert (await client.get("/v1/blocklist")).status_code in (401, 422)
+    assert (await client.get("/v1/blocklist", headers=reporter)).status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_the_blocklist_pages_past_its_limit(client, admin_headers):
+    hashes = sorted(f"{i:064x}" for i in range(5))
+    for h in hashes:
+        await client.post("/v1/admin/blocklist",
+                          json={"content_hash": h, "reason": "test"},
+                          headers=admin_headers)
+    node = await _node_headers(client, "node_pager")
+    seen, after = [], ""
+    while True:
+        page = (await client.get(f"/v1/blocklist?limit=2&after={after}",
+                                 headers=node)).json()
+        seen += page["hashes"]
+        if not page["next"]:
+            break
+        after = page["next"]
+    assert [h for h in seen if h in hashes] == hashes
+
+
+@pytest.mark.asyncio
+async def test_an_admin_cannot_block_something_that_is_not_a_hash(client, admin_headers):
+    r = await client.post("/v1/admin/blocklist",
+                          json={"content_hash": "x" * 5000, "reason": "test"},
+                          headers=admin_headers)
+    assert r.status_code == 422
+
+
+@pytest.mark.asyncio
+async def test_a_change_is_pushed_to_nodes_hosting_a_public_group_only(db_session):
+    """A node hosting only private groups has nothing to apply the list to."""
+    import json
+
+    import meshbay_hub.api.revocation as rev
+    from meshbay_hub.db.models import Group, User
+
+    db_session.add(User(id="owner-bl", username="owner_bl", email="x", hub_id="h",
+                        pw_hash=b"x", pw_salt=b"x"))
+    db_session.add(Group(id="pub-bl", name="pub", admin_id="owner-bl",
+                         visibility="public"))
+    db_session.add(Group(id="priv-bl", name="priv", admin_id="owner-bl",
+                         visibility="private"))
+    await db_session.commit()
+
+    class _WS:
+        def __init__(self):
+            self.sent = []
+
+        async def send_text(self, text):
+            self.sent.append(json.loads(text))
+
+    public_node, private_node = _WS(), _WS()
+    saved = dict(rev._connected_nodes), dict(rev._node_groups)
+    rev._connected_nodes.update({"n-pub": public_node, "n-priv": private_node})
+    rev._node_groups.update({"n-pub": ["pub-bl"], "n-priv": ["priv-bl"]})
+    try:
+        sent = await rev.broadcast_blocklist_update(db_session, add=["a" * 64])
+    finally:
+        rev._connected_nodes.clear()
+        rev._connected_nodes.update(saved[0])
+        rev._node_groups.clear()
+        rev._node_groups.update(saved[1])
+    assert sent == 1
+    assert public_node.sent == [{"type": "blocklist_update", "add": ["a" * 64],
+                                 "remove": []}]
+    assert private_node.sent == []