1 files changed, 6 insertions, 1 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
index fdb0444..15c7a5d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
@@ -586,9 +586,14 @@ async def update_group(
 async def add_group_member(
     group_id: str,
     username: str,
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_user_scope),
     db: AsyncSession = Depends(get_db),
 ):
+    # `require_user_scope`, like every other mutating group endpoint: a
+    # node-scoped daemon token must not manage membership (NS7 — the operator
+    # manages groups from the browser). This was the one membership endpoint
+    # still on `get_current_user`, so a node token could add members to its
+    # operator's own groups.
     group = await db.get(Group, group_id)
     if not group:
         raise HTTPException(status_code=404, detail="Group not found")