diff options
Diffstat (limited to 'packages/meshbay-node/tests/test_roster_pairing.py')
| -rw-r--r-- | packages/meshbay-node/tests/test_roster_pairing.py | 24 |
1 files changed, 19 insertions, 5 deletions
diff --git a/packages/meshbay-node/tests/test_roster_pairing.py b/packages/meshbay-node/tests/test_roster_pairing.py index 665c060..a2f7cd1 100644 --- a/packages/meshbay-node/tests/test_roster_pairing.py +++ b/packages/meshbay-node/tests/test_roster_pairing.py @@ -737,8 +737,22 @@ def test_admin_authority_is_never_fetched_from_the_hub(): The fix M3 invites: ask the hub which key belongs to the operator. That would hand a malicious hub the node — the same substitution as H3, one level deeper. """ - source = (Path(__file__).parent.parent - / "src" / "meshbay_node" / "daemon.py").read_text() - admin_region = source[source.find("_legacy_admin_pk"):] - assert "pubkeys" not in admin_region.split("def ")[1], ( - "node authority must never be resolved through a hub lookup") + src = Path(__file__).parent.parent / "src" / "meshbay_node" + + verifier = (src / "transport" / "webrtc_server.py").read_text() + body = verifier[verifier.index("async def _verify_admin_sig"):] + body = body[:body.index("\n def ", 1)] + assert "operator_pks" in body, "the roster is where authority comes from" + # Past the docstring: it names what was removed on purpose, so a reader knows + # not to put it back. What must not reappear is code. + code = body[body.index('"""', body.index('"""') + 3):] + for forbidden in ("hub", "pubkeys", "admin_pk_ed25519"): + assert forbidden not in code, ( + f"_verify_admin_sig mentions {forbidden!r} — authority must come from " + "the local roster and nothing else") + + daemon = (src / "daemon.py").read_text() + assert "has_operator()" in daemon, "the daemon reads authority from the roster" + assert "admin_pk_ed25519" not in daemon, ( + "the node.toml operator key is gone; it must not come back as a second " + "source of authority") |