1 files changed, 26 insertions, 0 deletions
diff --git a/packages/meshbay-node/tests/test_device_linking.py b/packages/meshbay-node/tests/test_device_linking.py
index 3580ff8..6d50580 100644
--- a/packages/meshbay-node/tests/test_device_linking.py
+++ b/packages/meshbay-node/tests/test_device_linking.py
@@ -82,6 +82,32 @@ async def _session(tmp_path: Path, roster, user_id: str = "alice"):
     return session
 
 
+async def test_device_messages_need_an_authenticated_session(tmp_path, roster):
+    """
+    Filing a device is not a pre-proof message, and must not become one.
+
+    The pre-proof window exists for what a peer needs *in order to* prove
+    possession of the group key, and adding a device is not that: the request is
+    countersigned later by a device already pinned, so nothing is lost by
+    requiring the caller to finish its own handshake first. Left in the window it
+    would be a second thing a hub that forges a JWT could reach.
+
+    Driven through the real dispatcher, because this is a property of the order
+    of its branches and of nothing else.
+    """
+    session = await _session(tmp_path, roster)
+    session._user_id = None            # challenged, has not proved anything yet
+    _sk, pk_ed, pk_x = _keys()
+
+    for mtype in ("device_add_request", "device_hello", "device_lookup",
+                  "device_add", "device_list", "device_revoke"):
+        session.sent.clear()
+        session._dispatch_message({"type": mtype, "pk_ed25519": pk_ed,
+                                   "pk_x25519": pk_x})
+        assert _last(session) == {"type": "error",
+                                  "detail": "Handshake required"}, mtype
+
+
 def _last(session):
     return session.sent[-1] if session.sent else {}