diff options
Diffstat (limited to 'packages/meshbay-node/tests/test_webrtc_transport.py')
| -rw-r--r-- | packages/meshbay-node/tests/test_webrtc_transport.py | 34 |
1 files changed, 30 insertions, 4 deletions
diff --git a/packages/meshbay-node/tests/test_webrtc_transport.py b/packages/meshbay-node/tests/test_webrtc_transport.py index 93cd3fd..cc0c6a2 100644 --- a/packages/meshbay-node/tests/test_webrtc_transport.py +++ b/packages/meshbay-node/tests/test_webrtc_transport.py @@ -823,8 +823,31 @@ async def test_webrtc_dtls_channel_binding_detects_mitm(sk_node, sk_hub, gek, sh await transport.close_all() +async def _paired_operator_roster(tmp_path, sk_admin): + """ + A roster holding one operator, which is the only thing that authorizes an + admin operation now. It used to be enough to name a key in node.toml; that + path is gone, so these tests build the authority the way an operator does — + by pairing. + """ + from meshbay_node.roster import Roster + + roster = Roster(db_path=tmp_path / "roster.db") + await roster.open() + await roster.pin_identity( + user_id="user-001", username="operator", + pk_ed25519=base64.b64encode(sk_admin.public_key().public_bytes( + encoding=serialization.Encoding.Raw, + format=serialization.PublicFormat.Raw)).decode(), + pk_x25519="", via="test") + await roster.set_member(group_id="", user_id="user-001", role="operator", + status="active", approved_by="test") + return roster + + @pytest.mark.asyncio -async def test_webrtc_admin_challenge_response(sk_node, sk_hub, gek, shared_dir): +async def test_webrtc_admin_challenge_response(sk_node, sk_hub, gek, shared_dir, + tmp_path): """WebRTC DataChannel: admin file delete requires Ed25519 challenge-response.""" hub_pk_pem = _hub_pk_pem(sk_hub) indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=gek) @@ -837,7 +860,8 @@ async def test_webrtc_admin_challenge_response(sk_node, sk_hub, gek, shared_dir) shared_root=shared_dir, index=indexer.index, stun_servers=[], ) - transport._ctx["admin_pk_ed25519"] = sk_admin.public_key() + transport._ctx["roster"] = await _paired_operator_roster(tmp_path, sk_admin) + transport._ctx["has_admin_authority"] = True transport._ctx["node_user_id"] = "user-001" browser_pc, channel, received = await _setup_peer( @@ -871,7 +895,8 @@ async def test_webrtc_admin_challenge_response(sk_node, sk_hub, gek, shared_dir) @pytest.mark.asyncio -async def test_webrtc_admin_bad_signature_rejected(sk_node, sk_hub, gek, shared_dir): +async def test_webrtc_admin_bad_signature_rejected(sk_node, sk_hub, gek, shared_dir, + tmp_path): """WebRTC DataChannel: wrong Ed25519 signature is rejected — hub can't fake admin.""" hub_pk_pem = _hub_pk_pem(sk_hub) indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=gek) @@ -885,7 +910,8 @@ async def test_webrtc_admin_bad_signature_rejected(sk_node, sk_hub, gek, shared_ shared_root=shared_dir, index=indexer.index, stun_servers=[], ) - transport._ctx["admin_pk_ed25519"] = sk_admin.public_key() + transport._ctx["roster"] = await _paired_operator_roster(tmp_path, sk_admin) + transport._ctx["has_admin_authority"] = True transport._ctx["node_user_id"] = "user-001" browser_pc, channel, received = await _setup_peer( |