1 files changed, 38 insertions, 1 deletions
diff --git a/packages/meshbay-node/tests/test_transport.py b/packages/meshbay-node/tests/test_transport.py
index 2064ba5..0e70d72 100644
--- a/packages/meshbay-node/tests/test_transport.py
+++ b/packages/meshbay-node/tests/test_transport.py
@@ -41,7 +41,7 @@ def shared_dir(tmp_path):
     (d / "small.txt").write_bytes(b"hello meshbay " * 100)
     return d
 
-def make_jwt(sk_hub, pk_node_b64, user_id="user-001", ttl=3600):
+def make_jwt(sk_hub, pk_node_b64, user_id="user-001", ttl=3600, groups=None):
     sk_pem = sk_hub.private_bytes(
         serialization.Encoding.PEM,
         serialization.PrivateFormat.PKCS8,
@@ -53,6 +53,7 @@ def make_jwt(sk_hub, pk_node_b64, user_id="user-001", ttl=3600):
         "pk_user": pk_node_b64, "hub_id": "test-hub",
         "jti": "test-jti",
         "iat": now, "exp": now + ttl,
+        "groups": groups or [],
     }, sk_pem, algorithm="EdDSA")
 
 
@@ -154,6 +155,42 @@ async def test_invalid_jwt_rejected(sk_node, sk_hub, gek, shared_dir, tmp_path):
 
 
 @pytest.mark.asyncio
+async def test_wrong_group_rejected(sk_node, sk_hub, gek, shared_dir, tmp_path):
+    """TCP+TLS server rejects a client whose JWT groups don't include the requested group_id."""
+    hub_pk_pem = sk_hub.public_key().public_bytes(
+        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
+
+    indexer = DirectoryIndexer(root=shared_dir, group_id="g",
+                               sk_node=sk_node, gek=gek)
+    await indexer.initial_scan()
+
+    cert_path = tmp_path / "node.crt"
+    key_path  = tmp_path / "node.key"
+
+    server = ChunkServer(
+        sk_node=sk_node, hub_pk_pem=hub_pk_pem, gek=gek,
+        shared_root=shared_dir, index=indexer.index,
+        host="127.0.0.1", port=0,
+        cert_path=cert_path, key_path=key_path,
+    )
+    await server.start()
+    port = server._server.sockets[0].getsockname()[1]
+
+    token = make_jwt(sk_hub, pk_to_b64(sk_node.public_key()), groups=["group-a"])
+
+    with pytest.raises(ConnectionError, match="rejected"):
+        async with ChunkClient(
+            host="127.0.0.1", port=port,
+            jwt_token=token, gek=gek,
+            pk_node_b64=pk_to_b64(sk_node.public_key()),
+            group_id="group-b",
+        ) as client:
+            pass
+
+    await server.stop()
+
+
+@pytest.mark.asyncio
 async def test_fetch_index(sk_node, sk_hub, gek, shared_dir, tmp_path):
     hub_pk_pem = sk_hub.public_key().public_bytes(
         serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)