diff options
Diffstat (limited to 'packages/meshbay-node/src/meshbay_node/transport/server.py')
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/transport/server.py | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/transport/server.py b/packages/meshbay-node/src/meshbay_node/transport/server.py index 6a1b05b..76ac13a 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/server.py +++ b/packages/meshbay-node/src/meshbay_node/transport/server.py @@ -104,6 +104,7 @@ class _ConnectionHandler: gek: bytes, shared_root: Path, index: GroupIndex, + groups: dict[str, dict] | None = None, ): self._reader = reader self._writer = writer @@ -112,8 +113,10 @@ class _ConnectionHandler: self._gek = gek self._shared_root = shared_root self._index = index + self._groups = groups self._peer = writer.get_extra_info("peername") self._user_id: str | None = None + self._group_id: str | None = None async def handle(self) -> None: try: @@ -133,16 +136,28 @@ class _ConnectionHandler: raise ValueError(f"Expected handshake, got {msg.get('type')!r}") token = msg.get("token", "") + group_id = msg.get("group_id", "") try: decoded = jwt.decode(token, self._hub_pk_pem, algorithms=["EdDSA"]) except Exception as e: raise PermissionError(f"Invalid JWT: {e}") from e - if decoded.get("exp", 0) < int(time.time()): - raise PermissionError("JWT expired") + if group_id and group_id not in decoded.get("groups", []): + raise PermissionError("Not a member of this group") + + if group_id and self._groups and group_id not in self._groups: + raise PermissionError("Group not hosted on this node") self._user_id = decoded["sub"] - log.info("[%s] Handshake OK — user=%s", self._peer, self._user_id[:8]) + self._group_id = group_id + + if group_id and self._groups and group_id in self._groups: + ctx = self._groups[group_id] + self._gek = ctx["gek"] + self._shared_root = ctx["shared_root"] + self._index = ctx["index"] + + log.info("[%s] Handshake OK — user=%s group=%s", self._peer, self._user_id[:8], group_id[:8] if group_id else "none") await _send(self._writer, { "type": MNP.HANDSHAKE_ACK, @@ -221,6 +236,7 @@ class ChunkServer: port: int = 19000, cert_path: Path | None = None, key_path: Path | None = None, + groups: dict[str, dict] | None = None, ): self._sk_node = sk_node self._hub_pk_pem = hub_pk_pem @@ -231,6 +247,7 @@ class ChunkServer: self._port = port self._cert_path = cert_path self._key_path = key_path + self._groups = groups self._server: asyncio.Server | None = None @property @@ -264,5 +281,6 @@ class ChunkServer: reader, writer, self._sk_node, self._hub_pk_pem, self._gek, self._shared_root, self._index, + groups=self._groups, ) await handler.handle() |