diff options
Diffstat (limited to 'packages/meshbay-node/src/meshbay_node')
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py | 41 |
1 files changed, 37 insertions, 4 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py index 4958b92..dfa775e 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py +++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py @@ -1039,10 +1039,11 @@ class WebRTCPeerSession: f"paired with this node") return if known: - # An operator's row is node-wide (empty group), so a lookup for the - # group they happen to be opening finds nothing. Fall back to it, or - # the client is told it has no role on a node it administers. - member = (await roster.get_member(group_id, user_id) + # This group's own row first; then the join message's group_id (empty + # on the node-wide first connect); then the operator's node-wide row, + # which is where an operator opening any group finds their authority. + member = (await roster.get_member(session_group, user_id) + or await roster.get_member(group_id, user_id) or await roster.get_member("", user_id)) if not member and self._group_join_policy(session_group) == "open": await roster.set_member( @@ -1050,6 +1051,38 @@ class WebRTCPeerSession: status="active", approved_by="open-join", ) member = await roster.get_member(session_group, user_id) + if not member: + # A device this node already pinned — for another group, or an + # operator pairing — opening an invite-only group it has no row + # for. The device-linking `known` fast-path used to drop straight + # into `_join_ok`, which answered `not_authorized_for_group` and + # left a real invitee with no way to redeem the code they were + # sent. Tell them to enter it *only* when one is actually + # waiting for them here; a bare hub-invented pin, with nothing + # inviting it, still gets the flat refusal H3 relies on. + if not code: + invited = any( + i["user_id"] == user_id + and i["group_id"] in (session_group, "") + for i in await roster.list_invites()) + self._join_refuse( + "code_required" if invited else "not_authorized_for_group") + return + invite = await roster.consume_invite(code, user_id) + if not invite: + self._join_refuse("code_invalid") + return + await roster.set_member( + group_id=invite["group_id"], user_id=user_id, + role=invite["role"], status="active", + approved_by=invite["created_by"], + ) + self._audit_join( + "join_pinned", + f"group={invite['group_id'][:8]} role={invite['role']} " + "via=code (device already known)") + member = (await roster.get_member(session_group, user_id) + or await roster.get_member(invite["group_id"], user_id)) await self._join_ok( user_id, pk_x_raw, session_group, role=member["role"] if member else "", |