diff options
Diffstat (limited to 'packages/meshbay-hub/tests/test_revocation.py')
| -rw-r--r-- | packages/meshbay-hub/tests/test_revocation.py | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/packages/meshbay-hub/tests/test_revocation.py b/packages/meshbay-hub/tests/test_revocation.py index 494d77d..d1147e1 100644 --- a/packages/meshbay-hub/tests/test_revocation.py +++ b/packages/meshbay-hub/tests/test_revocation.py @@ -121,3 +121,37 @@ async def test_revoke_group(client): }, headers=hdrs) assert r.status_code == 200 assert r.json()["status"] == "revoked" + + +@pytest.mark.asyncio +async def test_group_status_message_names_the_real_state(client): + """A member of a revoked group must not be told it was merely 'suspended'. + + `GET /v1/groups/{id}/nodes` and `POST /join` used to answer "Group is + suspended" for any non-active status. Suspend is the reversible hub flag; + revoke is a signed instruction every node enforces. The client shows this + string verbatim, so it has to be the truth. + """ + sk_ed = Ed25519PrivateKey.generate() + sk_x = X25519PrivateKey.generate() + admin_token, _ = await _register_and_login( + client, "admin_msg", + pk_to_b64(sk_ed.public_key()), pk_to_b64(sk_x.public_key())) + set_admin_usernames(["admin_msg"]) + hdrs = {"Authorization": f"Bearer {admin_token}"} + + gid = (await client.post("/v1/groups", json={"name": "state-msg"}, + headers=hdrs)).json()["group_id"] + + # Suspend → the message says suspended. + await client.patch(f"/v1/admin/groups/{gid}", json={"status": "suspended"}, + headers=hdrs) + r = await client.get(f"/v1/groups/{gid}/nodes", headers=hdrs) + assert r.status_code == 403 and r.json()["detail"] == "Group is suspended" + + # Revoke → the message says revoked, not suspended. + await client.post("/v1/admin/revoke", + json={"target": "group", "target_id": gid, "reason": "x"}, + headers=hdrs) + r = await client.get(f"/v1/groups/{gid}/nodes", headers=hdrs) + assert r.status_code == 403 and r.json()["detail"] == "Group is revoked" |