summaryrefslogtreecommitdiffstats
path: root/packages/meshbay-hub/tests/test_revocation.py
diff options
context:
space:
mode:
Diffstat (limited to 'packages/meshbay-hub/tests/test_revocation.py')
-rw-r--r--packages/meshbay-hub/tests/test_revocation.py34
1 files changed, 34 insertions, 0 deletions
diff --git a/packages/meshbay-hub/tests/test_revocation.py b/packages/meshbay-hub/tests/test_revocation.py
index 494d77d..d1147e1 100644
--- a/packages/meshbay-hub/tests/test_revocation.py
+++ b/packages/meshbay-hub/tests/test_revocation.py
@@ -121,3 +121,37 @@ async def test_revoke_group(client):
}, headers=hdrs)
assert r.status_code == 200
assert r.json()["status"] == "revoked"
+
+
+@pytest.mark.asyncio
+async def test_group_status_message_names_the_real_state(client):
+ """A member of a revoked group must not be told it was merely 'suspended'.
+
+ `GET /v1/groups/{id}/nodes` and `POST /join` used to answer "Group is
+ suspended" for any non-active status. Suspend is the reversible hub flag;
+ revoke is a signed instruction every node enforces. The client shows this
+ string verbatim, so it has to be the truth.
+ """
+ sk_ed = Ed25519PrivateKey.generate()
+ sk_x = X25519PrivateKey.generate()
+ admin_token, _ = await _register_and_login(
+ client, "admin_msg",
+ pk_to_b64(sk_ed.public_key()), pk_to_b64(sk_x.public_key()))
+ set_admin_usernames(["admin_msg"])
+ hdrs = {"Authorization": f"Bearer {admin_token}"}
+
+ gid = (await client.post("/v1/groups", json={"name": "state-msg"},
+ headers=hdrs)).json()["group_id"]
+
+ # Suspend → the message says suspended.
+ await client.patch(f"/v1/admin/groups/{gid}", json={"status": "suspended"},
+ headers=hdrs)
+ r = await client.get(f"/v1/groups/{gid}/nodes", headers=hdrs)
+ assert r.status_code == 403 and r.json()["detail"] == "Group is suspended"
+
+ # Revoke → the message says revoked, not suspended.
+ await client.post("/v1/admin/revoke",
+ json={"target": "group", "target_id": gid, "reason": "x"},
+ headers=hdrs)
+ r = await client.get(f"/v1/groups/{gid}/nodes", headers=hdrs)
+ assert r.status_code == 403 and r.json()["detail"] == "Group is revoked"