diff options
Diffstat (limited to 'packages/meshbay-node')
10 files changed, 275 insertions, 665 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py index 371c2f0..5036803 100644 --- a/packages/meshbay-node/src/meshbay_node/daemon.py +++ b/packages/meshbay-node/src/meshbay_node/daemon.py @@ -1198,15 +1198,10 @@ class NodeDaemon: async def _app_directories_ctx(self, group_id: str) -> dict: """ - Each app's configured directories, plus the legacy scalar names the - rest of the tree still reads. + Each app's configured directories, plus the second name an app is + also published under where something reads one (`chat_directory`). - The scalars are derived here rather than stored, so the two can never - disagree: `video_root` is the first of `video_directories` and exists - for MNP 1.0 clients and for the handful of call sites that predate the - list. A group with several video directories reports the first as its - `video_root` — which is what an old client can represent, and all it - could ever have shown. + Derived here rather than stored, so the two can never disagree. """ dirs = {} for app in self.APP_DIR_KEYS: @@ -1406,7 +1401,7 @@ class NodeDaemon: shared index before they have chosen which folder is actually their media library would burn both TMDB's rate limit and the node's CPU on files that were never meant to be in the Videos app at all. Once a - root is set, `_enrich_video_root_now` (called from ops.set_video_root) + root is set, `_enrich_video_root_now` (called when it changes) separately sweeps whatever it already contains — this path alone only ever sees entries new since the last broadcast. """ @@ -1433,7 +1428,7 @@ class NodeDaemon: async def _enrich_video_root_now(self, group_id: str) -> None: """ Videos app: sweep a group's existing index for enrichment right - after its video_root is set or changed (ops.set_video_root). + after its video root is set or changed. The ordinary path above only ever looks at entries new since the last broadcast, so a folder that already had files sitting in it @@ -1528,7 +1523,7 @@ class NodeDaemon: async def _enrich_audio_root_now(self, group_id: str) -> None: """ Music app: sweep a group's existing index right after its - audio_root is set or changed (ops.set_audio_root). Mirrors + audio root is set or changed. Mirrors `_enrich_video_root_now` exactly — the ordinary path above only ever looks at entries new since the last broadcast, so a folder that already had files in it before it became the audio_root would @@ -1594,7 +1589,7 @@ class NodeDaemon: async def _enrich_photo_roots_now(self, group_id: str) -> None: """ Photos app: sweep a group's existing index right after its - photo_roots set changes (ops.set_photo_roots). Mirrors + photo roots change. Mirrors `_enrich_video_root_now`/`_enrich_audio_root_now` — the ordinary path above only ever looks at entries new since the last broadcast, so a folder that already had photos in it before it was added to diff --git a/packages/meshbay-node/src/meshbay_node/ops.py b/packages/meshbay-node/src/meshbay_node/ops.py index 5b8e22d..4d3422d 100644 --- a/packages/meshbay-node/src/meshbay_node/ops.py +++ b/packages/meshbay-node/src/meshbay_node/ops.py @@ -1641,9 +1641,8 @@ async def set_app_directories(state: dict, group_id: str, app_key: str, One function for every app, keyed by the app's own name: adding an application is a registry entry and a settings component, not another - near-identical op here. It replaces `set_video_root`, `set_audio_root` and - `set_photo_roots`, which differed only in the key they wrote and whether - they took a string or a list. + near-identical op here — one per app differing only in the key it wrote + and whether it took a string or a list. Empty means nothing configured, which every app reads as "show nothing until an operator has chosen" — never "the whole group index". Pointing an @@ -1661,9 +1660,9 @@ async def set_app_directories(state: dict, group_id: str, app_key: str, await roster.set_app_directories(group_id, app_key, clean, set_by=state.get("node_user_id", "")) ctx[f"{app_key}_directories"] = clean - # The scalar the handshake ack still publishes for MNP 1.0 clients is - # derived, and has to be re-derived here: leaving it behind would make the - # ack disagree with the list within a single run, and only until a restart + # An app whose directories are also published under a second name (chat's + # single destination) has that name re-derived here: leaving it behind + # would make the two disagree within a single run, and only until a restart # — the shape of bug that reads as "it works after a restart". from meshbay_node.roster import Roster alias = Roster.ctx_alias(app_key, clean) @@ -1696,27 +1695,6 @@ async def set_app_directory(state: dict, group_id: str, app_key: str, return {**result, "path": dirs[0] if dirs else ""} -# The per-app wrappers MNP still names. They exist so an MNP 1.0 client's -# `video_root` / `audio_root` / `photo_roots` messages keep working; nothing -# new should be added here — a new app calls the generic pair above. - -async def set_video_root(state: dict, group_id: str, path: str) -> dict: - result = await set_app_directory(state, group_id, "video", path) - return {"path": result["path"], "group_id": group_id} - - -async def set_audio_root(state: dict, group_id: str, path: str) -> dict: - # "music", not "audio": the app's registry key is what identifies it - # everywhere, and `audio_root` is only the name the setting used to have. - result = await set_app_directory(state, group_id, "music", path) - return {"path": result["path"], "group_id": group_id} - - -async def set_photo_roots(state: dict, group_id: str, roots: list[str]) -> dict: - result = await set_app_directories(state, group_id, "photo", roots) - return {"roots": result["directories"], "group_id": group_id} - - # ── Chat ───────────────────────────────────────────────────────────────────── async def set_chat_directory(state: dict, group_id: str, path: str) -> dict: diff --git a/packages/meshbay-node/src/meshbay_node/roster.py b/packages/meshbay-node/src/meshbay_node/roster.py index ae0b4cf..b7fbf8e 100644 --- a/packages/meshbay-node/src/meshbay_node/roster.py +++ b/packages/meshbay-node/src/meshbay_node/roster.py @@ -817,14 +817,12 @@ class Roster: "photo": ("photo_roots", "list"), } - # The name each app's directories are *also* published under, for readers - # that predate the list — the handshake ack's `video_root`, and the group - # context the ack builds from. Derived from the list, never stored beside - # it, so the two cannot disagree; the shape says how to derive it. + # The name an app's directories are *also* published under, where + # something reads that name. Chat is the only one: it has a single + # destination, the handshake ack publishes it as `chat_directory`, and the + # paperclip reads it. Derived from the list, never stored beside it, so the + # two cannot disagree; the shape says how to derive it. CTX_ALIASES = { - "video": ("video_root", "scalar"), - "music": ("audio_root", "scalar"), - "photo": ("photo_roots", "list"), "chat": ("chat_directory", "scalar"), } diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py index b3618b5..b2374d3 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py +++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py @@ -72,12 +72,9 @@ from meshbay_common.adminop import ( OP_TRANSFER_LIMITS, OP_TMDB_CONFIG, OP_TMDB_ENABLED, - OP_VIDEO_ROOT, OP_TMDB_OVERRIDE, OP_TMDB_REMATCH, OP_MUSICBRAINZ_ENABLED, - OP_AUDIO_ROOT, - OP_PHOTO_ROOTS, OP_APP_DIRECTORIES, OP_CHAT_DIRECTORY, OP_CHAT_EPOCH, @@ -577,12 +574,6 @@ class WebRTCPeerSession: self._do_tmdb_config(msg) elif mtype == MNP.TMDB_ENABLED: self._do_tmdb_enabled(msg) - elif mtype == MNP.VIDEO_ROOT: - self._do_video_root(msg) - elif mtype == MNP.AUDIO_ROOT: - self._do_audio_root(msg) - elif mtype == MNP.PHOTO_ROOTS: - self._do_photo_roots(msg) elif mtype == MNP.APP_DIRECTORIES: self._do_app_directories(msg) elif mtype == MNP.CHAT_DIRECTORY: @@ -870,7 +861,7 @@ class WebRTCPeerSession: # below is sealed under a GEK-derived subkey, which gives it an # authentication tag from a key the hub does not hold. Until MNP 1.0 the # signed transcript named no ack field at all, so is_node_admin, - # enabled_apps, video_root and the rest were authenticated by the DTLS + # enabled_apps, the app directories and the rest were authenticated by DTLS # channel and nothing else. config = { "is_node_admin": self._is_node_admin(), @@ -879,14 +870,10 @@ class WebRTCPeerSession: # setting (or one whose context has not loaded it yet) hides # nothing. "enabled_apps": list(self._group_ctx().get("enabled_apps") or []), - # Which folder the Videos app treats as its entry point for - # this group — "" means the whole group index. - "video_root": self._group_ctx().get("video_root") or "", - # Per-group (2026-08-24 — used to be node-wide), same "read once, - # kept current in place by the signed op" shape as video_root - # above — surfaced here rather than only via tmdb_enabled_ack so - # a client that connects after the operator already configured - # it does not have to wait for a live change to find out. + # Read once and kept current in place by the signed op, and + # surfaced here rather than only via tmdb_enabled_ack, so a client + # that connects after the operator configured it does not have to + # wait for a live change to find out. "tmdb_enabled": bool(self._group_ctx().get("tmdb_enabled", True)), # Token/language stay node-wide (one shared credential/cache) — # via daemon_state, kept current by tmdb_config_ack. @@ -898,15 +885,6 @@ class WebRTCPeerSession: # fields above. No language field: MusicBrainz search doesn't # take one the way TMDB does. "musicbrainz_enabled": bool(self._group_ctx().get("musicbrainz_enabled", True)), - # Which folder the Music app treats as its entry point for this - # group — same shape as video_root above, "" means unset (the - # Music tab shows nothing yet). - "audio_root": self._group_ctx().get("audio_root") or "", - # Which folder(s) the Photos app treats as its entry points for - # this group — a *list*, unlike video_root/audio_root above - # (docs/photos.md §2.1). Empty means unset (the Photos tab shows - # nothing yet). - "photo_roots": list(self._group_ctx().get("photo_roots") or []), # The same three answers in one shape, plus every other app's — # `<app>_directories`, keyed by the app's registry name, always a # list. The scalars above are derived from these (daemon.py's @@ -2203,7 +2181,7 @@ class WebRTCPeerSession: """ Whether TMDB lookups run for this group at all. Per-group, unlike tmdb_config's token/language — see ops.set_tmdb_enabled. Signed like - video_root: it decides whether this group's members' Videos tab ever + app_directories: it decides whether this group's members' Videos tab ever makes outbound TMDB traffic. """ enabled = msg.get("enabled") @@ -2237,172 +2215,16 @@ class WebRTCPeerSession: except Exception: pass - def _do_video_root(self, msg: dict) -> None: - """ - Which folder (possibly a subfolder of a shared root) the Videos app - treats as its entry point for this group. Signed like apps_enabled: - it decides what every member's Videos tab shows. - - An empty path is always accepted (it means "the whole group index", - today's behaviour). A non-empty path must resolve to a real, - currently-readable directory — validated against the group's own - roots the same way directory creation/deletion already is, so a - stale or mistyped path is refused before a signature is even asked - for. - """ - path = msg.get("path") - if not isinstance(path, str): - self._send({"type": "error", "detail": "Missing or invalid 'path'"}) - return - path = path.strip("/") - if path: - ctx = self._group_ctx() - resolved = ctx["roots"].resolve(path) if ctx.get("roots") else None - if not resolved or not resolved.is_dir(): - self._send({"type": "error", "detail": "Not a directory in this group"}) - return - if not self._has_admin_authority(): - self._send({"type": "error", "detail": "No authorized key for this"}) - return - self._issue_admin_challenge(OP_VIDEO_ROOT, path) - - async def _admin_exec_video_root( - self, pending: dict, transcript: bytes, sig: bytes, - ) -> None: - path = pending["subject"] - if not await self._verify_admin_sig(transcript, sig): - self._send({"type": "error", "detail": "Signature verification failed"}) - self._audit("admin_auth_failed", f"video_root:{path}") - return - try: - await self._run_op(ops.set_video_root, self._group_id or "", path) - except ops.OpError as e: - self._send({"type": "error", "detail": e.message}) - return - self._audit("video_root", path) - - notice = {"type": MNP.VIDEO_ROOT_ACK, "v": MNP_VERSION, "path": path} - for uid, session in list(self._peer_registry().items()): - try: - session._send(notice) - except Exception: - pass - - def _do_audio_root(self, msg: dict) -> None: - """Same shape as _do_video_root above — the Music app's own entry point.""" - path = msg.get("path") - log.debug("audio_root request user=%s path=%r", - (self._user_id or "?")[:8], path) - if not isinstance(path, str): - self._send({"type": "error", "detail": "Missing or invalid 'path'"}) - return - path = path.strip("/") - if path: - ctx = self._group_ctx() - resolved = ctx["roots"].resolve(path) if ctx.get("roots") else None - if not resolved or not resolved.is_dir(): - self._send({"type": "error", "detail": "Not a directory in this group"}) - return - if not self._has_admin_authority(): - self._send({"type": "error", "detail": "No authorized key for this"}) - return - self._issue_admin_challenge(OP_AUDIO_ROOT, path) - - async def _admin_exec_audio_root( - self, pending: dict, transcript: bytes, sig: bytes, - ) -> None: - path = pending["subject"] - if not await self._verify_admin_sig(transcript, sig): - self._send({"type": "error", "detail": "Signature verification failed"}) - self._audit("admin_auth_failed", f"audio_root:{path}") - return - try: - await self._run_op(ops.set_audio_root, self._group_id or "", path) - except ops.OpError as e: - self._send({"type": "error", "detail": e.message}) - return - self._audit("audio_root", path) - - notice = {"type": MNP.AUDIO_ROOT_ACK, "v": MNP_VERSION, "path": path} - for uid, session in list(self._peer_registry().items()): - try: - session._send(notice) - except Exception: - pass - - def _do_photo_roots(self, msg: dict) -> None: - """ - Which folder(s) the Photos app treats as its entry points for this - group (docs/photos.md §2.1) — a *set*, replaced whole in one signed - op, same shape as apps_enabled rather than one op per root the way - video_root/audio_root are single values. - - An empty list is always accepted (nothing configured yet, today's - "Photos shows nothing" state). Every non-empty path must resolve to - a real, currently-readable directory, and no root may be nested - inside another in the same submitted set — both checked, and - refused, before a signature is ever asked for, same principle as - video_root's path check and apps_enabled's "empty set refused up - front". - """ - roots = msg.get("roots") - if not isinstance(roots, list) or not all(isinstance(r, str) for r in roots): - self._send({"type": "error", "detail": "Missing or invalid 'roots'"}) - return - roots = sorted({r.strip("/") for r in roots if r.strip("/")}) - ctx = self._group_ctx() - for path in roots: - resolved = ctx["roots"].resolve(path) if ctx.get("roots") else None - if not resolved or not resolved.is_dir(): - self._send({"type": "error", - "detail": f"Not a directory in this group: {path}"}) - return - # Case-insensitive nesting check (§6.8) — a root may not be a folder - # itself sitting inside another root in the same set. - folded = [r.casefold() for r in roots] - for i, a in enumerate(folded): - for j, b in enumerate(folded): - if i != j and (a == b or a.startswith(b + "/")): - self._send({"type": "error", - "detail": f"Root nested inside another: {roots[i]}"}) - return - if not self._has_admin_authority(): - self._send({"type": "error", "detail": "No authorized key for this"}) - return - self._issue_admin_challenge(OP_PHOTO_ROOTS, ",".join(roots)) - - async def _admin_exec_photo_roots( - self, pending: dict, transcript: bytes, sig: bytes, - ) -> None: - roots = pending["subject"].split(",") if pending["subject"] else [] - if not await self._verify_admin_sig(transcript, sig): - self._send({"type": "error", "detail": "Signature verification failed"}) - self._audit("admin_auth_failed", f"photo_roots:{pending['subject']}") - return - try: - await self._run_op(ops.set_photo_roots, self._group_id or "", roots) - except ops.OpError as e: - self._send({"type": "error", "detail": e.message}) - return - self._audit("photo_roots", pending["subject"]) - - notice = {"type": MNP.PHOTO_ROOTS_ACK, "v": MNP_VERSION, "roots": roots} - for uid, session in list(self._peer_registry().items()): - try: - session._send(notice) - except Exception: - pass - # ── App directories (generic) ──────────────────────────────────────── def _do_app_directories(self, msg: dict) -> None: """ Which folder(s) an application works over, for any application. - One handler where there were three near-identical ones (`video_root`, - `audio_root`, `photo_roots`) differing only in the key they wrote and - whether they carried a string or a list. Those three still exist for - clients that speak them; nothing new is added beside them. + One handler for every application, keyed by the app's own name: adding + an application adds no message type, and there is no per-app handler + differing only in the key it writes and whether it carries a string or + a list. `app` must be one this node knows (`ALLOWED_APPS`) — a client-supplied key is otherwise a way to write arbitrary rows into `group_settings`. @@ -2651,7 +2473,7 @@ class WebRTCPeerSession: """ Whether MusicBrainz lookups run for this group at all. Per-group from the start (docs/musicbay.md §3.2/§6) — signed like - tmdb_enabled/video_root: it decides whether this group's members' + tmdb_enabled: it decides whether this group's members' Music tab ever makes outbound MusicBrainz traffic. """ enabled = msg.get("enabled") @@ -4136,7 +3958,7 @@ class WebRTCPeerSession: def _do_tmdb_override(self, msg: dict) -> None: """ An operator correcting a wrong automatic TMDB match. Signed like - video_root/tmdb_config: it replaces what every member sees for a + app_directories/tmdb_config: it replaces what every member sees for a show/movie, node-wide (media_cache is shared, not per-viewer). For a **show**, applied to every entry sharing the representative @@ -5317,9 +5139,6 @@ class WebRTCPeerSession: elif pending["op"] == OP_TMDB_ENABLED: self._spawn( self._admin_exec_tmdb_enabled(pending, transcript, sig_bytes)) - elif pending["op"] == OP_VIDEO_ROOT: - self._spawn( - self._admin_exec_video_root(pending, transcript, sig_bytes)) elif pending["op"] == OP_TMDB_OVERRIDE: self._spawn( self._admin_exec_tmdb_override(pending, transcript, sig_bytes)) @@ -5329,12 +5148,6 @@ class WebRTCPeerSession: elif pending["op"] == OP_MUSICBRAINZ_ENABLED: self._spawn( self._admin_exec_musicbrainz_enabled(pending, transcript, sig_bytes)) - elif pending["op"] == OP_AUDIO_ROOT: - self._spawn( - self._admin_exec_audio_root(pending, transcript, sig_bytes)) - elif pending["op"] == OP_PHOTO_ROOTS: - self._spawn( - self._admin_exec_photo_roots(pending, transcript, sig_bytes)) elif pending["op"] == OP_ROOT_ADD: self._spawn( self._admin_exec_root_add(pending, transcript, sig_bytes)) diff --git a/packages/meshbay-node/tests/test_app_directories.py b/packages/meshbay-node/tests/test_app_directories.py index 3ede1b6..69b3be5 100644 --- a/packages/meshbay-node/tests/test_app_directories.py +++ b/packages/meshbay-node/tests/test_app_directories.py @@ -26,10 +26,14 @@ from types import SimpleNamespace import pytest from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey +from meshbay_common.adminop import OP_APP_DIRECTORIES from meshbay_node import ops from meshbay_node.indexer.group_index import GroupIndex from meshbay_node.roots import RootSet from meshbay_node.roster import Roster +from meshbay_node.transport.webrtc_server import WebRTCPeerSession + +from conftest import one_root pytestmark = pytest.mark.asyncio @@ -157,11 +161,11 @@ async def test_a_directory_on_an_unplugged_drive_can_still_be_configured(tmp_pat # ── The derived scalar ─────────────────────────────────────────────────────── -async def test_the_legacy_scalar_follows_the_list_in_the_live_context(tmp_path): +async def test_the_list_is_what_the_live_context_carries(tmp_path): """ - `video_root` rides on the handshake ack for MNP 1.0 clients and is read - from the group context. Left behind by a save, it would disagree with the - list until the next restart. + One name per app in the group context, and it is the list. A second name + for the same idea is a second thing a save has to update, and the one it + forgets disagrees until the next restart. """ state, roster = await _state(tmp_path) ctx = state["groups_ctx"][GROUP] @@ -169,26 +173,33 @@ async def test_the_legacy_scalar_follows_the_list_in_the_live_context(tmp_path): await ops.set_app_directories(state, GROUP, "video", ["Media/Films", "Media/Albums"]) assert ctx["video_directories"] == ["Media/Albums", "Media/Films"] - assert ctx["video_root"] == "Media/Albums", ( - "the scalar must be the first of the list, not a stale value") + assert "video_root" not in ctx, ( + "a scalar nothing reads is a scalar that can go stale unnoticed") await ops.set_app_directories(state, GROUP, "video", []) - assert ctx["video_root"] == "" + assert ctx["video_directories"] == [] finally: await roster.close() -async def test_the_photo_alias_stays_a_list_and_chat_stays_a_string(tmp_path): - """The alias table has to carry the shape, not just the name.""" +async def test_chat_is_also_published_under_the_name_the_ack_uses(tmp_path): + """ + Chat has one destination and the handshake ack publishes it as + `chat_directory`, which the paperclip reads. That second name is derived + from the list on every save, never stored beside it. + """ state, roster = await _state(tmp_path) ctx = state["groups_ctx"][GROUP] try: - await ops.set_app_directories(state, GROUP, "photo", - ["Media/Films", "Media/Albums"]) - assert ctx["photo_roots"] == ["Media/Albums", "Media/Films"] await ops.set_app_directory(state, GROUP, "chat", "Media", require_writable=True) assert ctx["chat_directory"] == "Media" + assert ctx["chat_directories"] == ["Media"] + + await ops.set_app_directories(state, GROUP, "photo", + ["Media/Films", "Media/Albums"]) + assert ctx["photo_directories"] == ["Media/Albums", "Media/Films"] + assert "photo_roots" not in ctx finally: await roster.close() @@ -290,3 +301,72 @@ async def test_setting_link_previews_updates_the_live_context(tmp_path): assert state["groups_ctx"][GROUP]["chat_link_preview"] is False finally: await roster.close() + + +# ── The handler, before any signature ──────────────────────────────────────── +# +# `_do_app_directories` refuses three things up front and asks for a signature +# for everything else. The paths are not among the three: `_validate_app_dirs` +# checks those after the signature, deliberately (a settings change is not a +# capability), and `test_app_directories_signed.py` drives that whole path. + +def _handler_session(tmp_path, *, authorized: bool) -> WebRTCPeerSession: + shared = tmp_path / "shared" + (shared / "Films").mkdir(parents=True, exist_ok=True) + index = GroupIndex(group_id=GROUP, sk_node=Ed25519PrivateKey.generate()) + session = WebRTCPeerSession.__new__(WebRTCPeerSession) + session._ctx = {"roots": one_root(shared), "index": index, + "sk_node": index.sk_node} + session._group_id = GROUP + session._user_id = "op" + session.sent = [] + session._send = session.sent.append + session._audit = lambda *a, **k: None + session._has_admin_authority = lambda: authorized + session.issued = [] + session._issue_admin_challenge = lambda op, subject: session.issued.append( + (op, subject)) + return session + + +async def test_an_app_this_node_does_not_know_is_refused(tmp_path): + """A client-supplied key is otherwise a way to write arbitrary rows into + `group_settings`.""" + session = _handler_session(tmp_path, authorized=True) + session._do_app_directories({"app": "../etc", "directories": ["shared"]}) + assert session.issued == [] + assert [m for m in session.sent if m.get("type") == "error"] + + +@pytest.mark.parametrize("dirs", [None, "shared/Films", [1], {"a": 1}]) +async def test_directories_that_are_not_a_list_of_strings_are_refused(tmp_path, dirs): + session = _handler_session(tmp_path, authorized=True) + session._do_app_directories({"app": "video", "directories": dirs}) + assert session.issued == [] + assert [m for m in session.sent if m.get("type") == "error"] + + +async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path): + """No operator key on this node's roster means no signature can ever + arrive, so asking for one would be a dialog that cannot be completed.""" + session = _handler_session(tmp_path, authorized=False) + session._do_app_directories({"app": "video", "directories": ["shared/Films"]}) + assert session.issued == [] + assert [m for m in session.sent if m.get("type") == "error"] + + +async def test_the_subject_names_the_app_and_the_cleaned_paths(tmp_path): + """What the operator is shown before signing has to say which application + is about to be pointed where — two apps' challenges are otherwise + indistinguishable — and it must match what the node will store.""" + session = _handler_session(tmp_path, authorized=True) + session._do_app_directories( + {"app": "video", "directories": ["/b/", "a", "a", ""]}) + assert session.issued == [(OP_APP_DIRECTORIES, "video:a,b")] + + +async def test_an_empty_set_is_signable(tmp_path): + """Clearing an app's folders is an instruction like any other.""" + session = _handler_session(tmp_path, authorized=True) + session._do_app_directories({"app": "video", "directories": []}) + assert session.issued == [(OP_APP_DIRECTORIES, "video:")] diff --git a/packages/meshbay-node/tests/test_app_directories_signed.py b/packages/meshbay-node/tests/test_app_directories_signed.py new file mode 100644 index 0000000..eda09d8 --- /dev/null +++ b/packages/meshbay-node/tests/test_app_directories_signed.py @@ -0,0 +1,148 @@ +""" +Pointing an application at folders, through the real signed-op path. + +`app_directories` is one operator instruction for every application, keyed by +the app's own name. What only this file can check is the path from the message +to the database: everything else either calls `ops.set_app_directories` +directly or mocks out `_issue_admin_challenge`, and neither one exercises real +signature verification (`_verify_admin_sig`, `_do_admin_response`) or the shared +groups_ctx/roster wiring `_run_op` depends on. + +Found live, on the per-app op this replaced: a save that looked like it worked — +the Music tab showed content right afterwards — did not survive a reload. Worth +ruling out a break in that real path specifically, and not just in the setter. + +Note what is deliberately *not* checked before the challenge: whether the path +exists. `_do_app_directories` validates the app name and the shape of +`directories`, then asks for a signature; `ops._validate_app_dirs` refuses a +path outside the group's roots afterwards. A settings change is not a +capability, so refusing after the signature costs a round trip and nothing else. +""" + +import base64 +from pathlib import Path + +import pytest +from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + +from meshbay_common.adminop import OP_APP_DIRECTORIES, admin_transcript +from meshbay_common.crypto import pk_to_b64 +from meshbay_common.join import ROLE_OPERATOR +from meshbay_node.indexer.group_index import GroupIndex +from meshbay_node.roster import open_roster +from meshbay_node.transport.webrtc_server import WebRTCPeerSession + +from conftest import one_root + +pytestmark = pytest.mark.asyncio + +# Session shape mirrors test_admin_ops_mnp.py's _session helper. + +GROUP = "g" * 32 + + +def _keypair(): + sk = Ed25519PrivateKey.generate() + return sk, pk_to_b64(sk.public_key()) + + +async def _full_session(tmp_path: Path, roster) -> tuple[WebRTCPeerSession, Ed25519PrivateKey]: + shared = tmp_path / "shared" + (shared / "Music").mkdir(parents=True) + index = GroupIndex(group_id=GROUP, sk_node=Ed25519PrivateKey.generate()) + roots = one_root(shared) + + sk_op, pk_op = _keypair() + await roster.pin_identity("grenet", "grenet", pk_op, pk_op, "code") + await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli") + + group_ctx = {"gek": b"\x01" * 32, "roots": roots, "index": index, + "join_policy": "invite", "music_directories": []} + state = { + "groups_ctx": {GROUP: group_ctx}, + "roster": roster, + "node_user_id": "node-user", + } + + session = WebRTCPeerSession.__new__(WebRTCPeerSession) + session._ctx = { + "roots": roots, "index": index, "sk_node": index.sk_node, + "roster": roster, "groups": {GROUP: group_ctx}, + "has_admin_authority": True, + "daemon_state": state, + } + session._group_id = GROUP + session._user_id = "grenet" + session._pk_user = "" + session._admin_ops = {} + session.sent = [] + session._send = session.sent.append + session._audit = lambda *a, **k: None + session.spawned = [] + session._spawn = session.spawned.append + # A real session registers itself here on handshake completion + # (`self._peer_registry()[self._user_id] = self`) — without it, the + # broadcast loop in _admin_exec_audio_root (and every other admin op) + # has nobody to send the final ack to, including the requester itself. + group_ctx["_peers"] = {"grenet": session} + session._peer_registry = lambda: group_ctx["_peers"] + return session, sk_op + + +async def _drain(session): + for coro in session.spawned: + await coro + session.spawned.clear() + + +async def test_a_real_signed_save_persists_and_survives_a_fresh_roster_read(tmp_path): + """ + The exact question a "worked, then reverted after reload" report raises: + does the value set through the real challenge/response path actually + land in the database, in a form any later connection — this one, or a + freshly-opened Roster after a restart — reads back correctly? + """ + roster = await open_roster(tmp_path) + try: + session, sk_op = await _full_session(tmp_path, roster) + + session._do_app_directories( + {"app": "music", "directories": ["shared/Music"]}) + challenge = session.sent[-1] + assert challenge["type"] == "admin_challenge", challenge + + transcript = admin_transcript( + op=OP_APP_DIRECTORIES, node_pk_b64=session._node_pk_b64(), + group_id=GROUP, subject="music:shared/Music", + nonce=base64.b64decode(challenge["nonce"]), + ts=challenge["ts"]) + session._do_admin_response({ + "op_id": challenge["op_id"], + "signature": base64.b64encode(sk_op.sign(transcript)).decode(), + }) + await _drain(session) + + ack = session.sent[-1] + assert ack["type"] == "app_directories_ack", ack + assert ack["app"] == "music" + assert ack["directories"] == ["shared/Music"] + + assert (session._ctx["groups"][GROUP]["music_directories"] + == ["shared/Music"]), ( + "the live in-memory context must reflect the new folder at once") + assert await roster.app_directories(GROUP, "music") == ["shared/Music"], ( + "the same Roster instance must read back what it just wrote") + finally: + await roster.close() + + # A fresh connection (or a restarted daemon) never touches the Roster + # instance above at all — it opens its own. This is the check that + # actually answers "does it survive a reload". + reopened = await open_roster(tmp_path) + try: + assert await reopened.app_directories(GROUP, "music") == ["shared/Music"], ( + "a freshly-opened Roster against the same db file must see the " + "committed value — anything else means the write was never " + "durable in the first place") + finally: + await reopened.close() diff --git a/packages/meshbay-node/tests/test_audio_root_gates_enrichment.py b/packages/meshbay-node/tests/test_audio_root_gates_enrichment.py index 5a8f9b1..d353d27 100644 --- a/packages/meshbay-node/tests/test_audio_root_gates_enrichment.py +++ b/packages/meshbay-node/tests/test_audio_root_gates_enrichment.py @@ -8,7 +8,7 @@ against a real messy library, where everything under every shared folder got mixed together with no way to scope Music down to just the actual music library. -Setting or changing the root (ops.set_audio_root) fires a one-off sweep +Setting or changing the folder (ops.set_app_directory) fires a one-off sweep (_enrich_audio_root_now) of whatever it already contains — same shape as _enrich_video_root_now. """ @@ -147,7 +147,8 @@ async def test_setting_the_audio_root_sweeps_what_it_already_contains(tmp_path): "groups_ctx": {group_id: {"roots": one_root(shared)}}, "enrich_app_dirs_fns": {"music": daemon._enrich_audio_root_now}, } - await ops.set_audio_root(state, group_id, "shared/Music") + await ops.set_app_directory(state, group_id, "music", + "shared/Music") await asyncio.sleep(0.05) # let the fire-and-forget sweep actually run entry = next(iter(indexer.index.entries)) diff --git a/packages/meshbay-node/tests/test_audio_root_policy.py b/packages/meshbay-node/tests/test_audio_root_policy.py deleted file mode 100644 index e2e9254..0000000 --- a/packages/meshbay-node/tests/test_audio_root_policy.py +++ /dev/null @@ -1,260 +0,0 @@ -""" -Which folder (possibly a subfolder of a shared root) is the Music app's -entry point for a group. Same shape as test_video_root_policy.py — a -signed operator instruction, per-group, stored via roster.py's -group_settings table, added later once a real messy library showed -musicbay.md's original "no root, whole shared tree" call was wrong. -""" - -import base64 -from pathlib import Path - -import pytest -from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey - -from meshbay_common.adminop import OP_AUDIO_ROOT, admin_transcript -from meshbay_common.crypto import pk_to_b64 -from meshbay_common.join import ROLE_OPERATOR -from meshbay_node.indexer.group_index import GroupIndex -from meshbay_node.roster import Roster, open_roster -from meshbay_node.transport.webrtc_server import WebRTCPeerSession - -from conftest import one_root - -pytestmark = pytest.mark.asyncio - - -def _session(tmp_path: Path, user_id: str, *, operator: str | None = None) -> WebRTCPeerSession: - shared_root = tmp_path / "shared" - shared_root.mkdir(exist_ok=True) - (shared_root / "Music").mkdir() - (shared_root / "Podcasts").mkdir() - index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate()) - ctx = { - "roots": one_root(shared_root), - "index": index, - "sk_node": index.sk_node, - "node_user_id": operator, - } - session = WebRTCPeerSession.__new__(WebRTCPeerSession) - session._ctx = ctx - session._group_id = None - session._user_id = user_id - session._pk_user = "" - session.sent = [] - session._send = session.sent.append - session._audit = lambda *a, **k: None - return session - - -# ── Refused before a challenge is even issued ─────────────────────────────── - -async def test_missing_path_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_audio_root({}) - - assert not issued - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_a_nonexistent_folder_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_audio_root({"path": "shared/Nonexistent"}) - - assert not issued, "a mistyped path must be refused before a signature round trip" - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_path_traversal_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_audio_root({"path": "../../etc"}) - - assert not issued - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path): - session = _session(tmp_path, "member-1", operator="the-operator") - session._has_admin_authority = lambda: False - - session._do_audio_root({"path": "shared/Music"}) - - assert [m for m in session.sent if m.get("type") == "error"] - - -# ── Accepted cases ─────────────────────────────────────────────────────────── - -async def test_an_empty_path_is_always_accepted(tmp_path): - """Empty means 'unset' — Music shows nothing yet, always valid to clear.""" - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_audio_root({"path": ""}) - - assert issued == [(OP_AUDIO_ROOT, "")] - - -async def test_a_real_subfolder_is_accepted_and_signed(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_audio_root({"path": "shared/Music"}) - - assert issued == [(OP_AUDIO_ROOT, "shared/Music")] - - -# ── Where it is stored ────────────────────────────────────────────────────── - -async def test_the_setting_lives_on_the_node_and_survives_a_restart(tmp_path): - roster = Roster(db_path=tmp_path / "roster.db") - await roster.open() - try: - assert await roster.app_directories("g1", "music") == [], ( - "absent must mean unset") - await roster.set_app_directories("g1", "music", ["shared/Music"], - set_by="op") - assert await roster.app_directories("g1", "music") == ["shared/Music"] - finally: - await roster.close() - - reopened = Roster(db_path=tmp_path / "roster.db") - await reopened.open() - try: - assert await reopened.app_directories("g1", "music") == ["shared/Music"] - assert await reopened.app_directories("g2", "music") == [], ( - "one group's setting must not answer for another") - finally: - await reopened.close() - - -# ── End to end through the real signed-op path ────────────────────────────── -# -# Everything above either calls ops.set_audio_root directly or mocks out -# _issue_admin_challenge — neither one ever exercises real signature -# verification (_verify_admin_sig, _do_admin_response) or the shared -# groups_ctx/roster wiring _run_op depends on. Found live: a save that -# looked like it worked (the Music tab showed content right afterward) did -# not survive a reload — worth ruling out a break somewhere in that real -# path specifically, not just in the pure-Python setter. Session shape -# mirrors test_admin_ops_mnp.py's _session helper. - -GROUP = "g" * 32 - - -def _keypair(): - sk = Ed25519PrivateKey.generate() - return sk, pk_to_b64(sk.public_key()) - - -async def _full_session(tmp_path: Path, roster) -> tuple[WebRTCPeerSession, Ed25519PrivateKey]: - shared = tmp_path / "shared" - (shared / "Music").mkdir(parents=True) - index = GroupIndex(group_id=GROUP, sk_node=Ed25519PrivateKey.generate()) - roots = one_root(shared) - - sk_op, pk_op = _keypair() - await roster.pin_identity("grenet", "grenet", pk_op, pk_op, "code") - await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli") - - group_ctx = {"gek": b"\x01" * 32, "roots": roots, "index": index, - "join_policy": "invite", "audio_root": ""} - state = { - "groups_ctx": {GROUP: group_ctx}, - "roster": roster, - "node_user_id": "node-user", - } - - session = WebRTCPeerSession.__new__(WebRTCPeerSession) - session._ctx = { - "roots": roots, "index": index, "sk_node": index.sk_node, - "roster": roster, "groups": {GROUP: group_ctx}, - "has_admin_authority": True, - "daemon_state": state, - } - session._group_id = GROUP - session._user_id = "grenet" - session._pk_user = "" - session._admin_ops = {} - session.sent = [] - session._send = session.sent.append - session._audit = lambda *a, **k: None - session.spawned = [] - session._spawn = session.spawned.append - # A real session registers itself here on handshake completion - # (`self._peer_registry()[self._user_id] = self`) — without it, the - # broadcast loop in _admin_exec_audio_root (and every other admin op) - # has nobody to send the final ack to, including the requester itself. - group_ctx["_peers"] = {"grenet": session} - session._peer_registry = lambda: group_ctx["_peers"] - return session, sk_op - - -async def _drain(session): - for coro in session.spawned: - await coro - session.spawned.clear() - - -async def test_a_real_signed_save_persists_and_survives_a_fresh_roster_read(tmp_path): - """ - The exact question a "worked, then reverted after reload" report raises: - does the value set through the real challenge/response path actually - land in the database, in a form any later connection — this one, or a - freshly-opened Roster after a restart — reads back correctly? - """ - roster = await open_roster(tmp_path) - try: - session, sk_op = await _full_session(tmp_path, roster) - - session._do_audio_root({"path": "shared/Music"}) - challenge = session.sent[-1] - assert challenge["type"] == "admin_challenge", challenge - - transcript = admin_transcript( - op=OP_AUDIO_ROOT, node_pk_b64=session._node_pk_b64(), group_id=GROUP, - subject="shared/Music", nonce=base64.b64decode(challenge["nonce"]), - ts=challenge["ts"]) - session._do_admin_response({ - "op_id": challenge["op_id"], - "signature": base64.b64encode(sk_op.sign(transcript)).decode(), - }) - await _drain(session) - - ack = session.sent[-1] - assert ack["type"] == "audio_root_ack", ack - assert ack["path"] == "shared/Music" - - assert session._ctx["groups"][GROUP]["audio_root"] == "shared/Music", ( - "the live in-memory context must reflect the new root immediately") - assert await roster.app_directories(GROUP, "music") == ["shared/Music"], ( - "the same Roster instance must read back what it just wrote") - finally: - await roster.close() - - # A fresh connection (or a restarted daemon) never touches the Roster - # instance above at all — it opens its own. This is the check that - # actually answers "does it survive a reload". - reopened = await open_roster(tmp_path) - try: - assert await reopened.app_directories(GROUP, "music") == ["shared/Music"], ( - "a freshly-opened Roster against the same db file must see the " - "committed value — anything else means the write was never " - "durable in the first place") - finally: - await reopened.close() diff --git a/packages/meshbay-node/tests/test_video_root_gates_enrichment.py b/packages/meshbay-node/tests/test_video_root_gates_enrichment.py index b88ecaf..fd0e040 100644 --- a/packages/meshbay-node/tests/test_video_root_gates_enrichment.py +++ b/packages/meshbay-node/tests/test_video_root_gates_enrichment.py @@ -6,7 +6,7 @@ rate limit and the node's CPU on an operator's whole shared index before they have chosen which folder is actually their media library would be real, ongoing cost for files never meant to be in the Videos app at all. -Setting or changing the root (ops.set_video_root) fires a one-off sweep +Setting or changing the folder (ops.set_app_directory) fires a one-off sweep (_enrich_video_root_now) of whatever it already contains: the ordinary per-broadcast path only ever looks at files new since the last broadcast, so anything already sitting in a folder before it became the video_root @@ -144,7 +144,8 @@ async def test_setting_the_video_root_sweeps_what_it_already_contains(tmp_path): "groups_ctx": {group_id: {"roots": one_root(shared)}}, "enrich_app_dirs_fns": {"video": daemon._enrich_video_root_now}, } - await ops.set_video_root(state, group_id, "shared/Movies") + await ops.set_app_directory(state, group_id, "video", + "shared/Movies") await asyncio.sleep(0.05) # let the fire-and-forget sweep actually run entry = next(iter(indexer.index.entries)) diff --git a/packages/meshbay-node/tests/test_video_root_policy.py b/packages/meshbay-node/tests/test_video_root_policy.py deleted file mode 100644 index 8d8c45a..0000000 --- a/packages/meshbay-node/tests/test_video_root_policy.py +++ /dev/null @@ -1,144 +0,0 @@ -""" -Which folder (possibly a subfolder of a shared root) is the Videos app's -entry point for a group. Same shape as test_apps_enabled_policy.py: a -signed operator instruction, per-group (unlike tmdb_config, which is -node-wide), stored via roster.py's group_settings table. - -Specific to this one: a non-empty path must resolve to a real, readable -directory inside one of the group's own roots before a challenge is ever -issued — refusing a typo up front, the same way an empty apps set is -refused up front rather than round-tripped to the operator's browser. -""" - -from pathlib import Path - -import pytest - -from meshbay_common.adminop import OP_VIDEO_ROOT -from meshbay_node.indexer.group_index import GroupIndex -from meshbay_node.roster import Roster -from meshbay_node.transport.webrtc_server import WebRTCPeerSession -from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey - -from conftest import one_root - -pytestmark = pytest.mark.asyncio - - -def _session(tmp_path: Path, user_id: str, *, operator: str | None = None) -> WebRTCPeerSession: - shared_root = tmp_path / "shared" - shared_root.mkdir(exist_ok=True) - (shared_root / "Movies").mkdir() - (shared_root / "Shows").mkdir() - index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate()) - ctx = { - "roots": one_root(shared_root), - "index": index, - "sk_node": index.sk_node, - "node_user_id": operator, - } - session = WebRTCPeerSession.__new__(WebRTCPeerSession) - session._ctx = ctx - session._group_id = None - session._user_id = user_id - session._pk_user = "" - session.sent = [] - session._send = session.sent.append - session._audit = lambda *a, **k: None - return session - - -# ── Refused before a challenge is even issued ─────────────────────────────── - -async def test_missing_path_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_video_root({}) - - assert not issued - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_a_nonexistent_folder_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_video_root({"path": "shared/Nonexistent"}) - - assert not issued, "a mistyped path must be refused before a signature round trip" - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_path_traversal_is_refused(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_video_root({"path": "../../etc"}) - - assert not issued - assert [m for m in session.sent if m.get("type") == "error"] - - -async def test_a_request_with_nobody_to_authorize_it_is_refused(tmp_path): - session = _session(tmp_path, "member-1", operator="the-operator") - session._has_admin_authority = lambda: False - - session._do_video_root({"path": "shared/Movies"}) - - assert [m for m in session.sent if m.get("type") == "error"] - - -# ── Accepted cases ─────────────────────────────────────────────────────────── - -async def test_an_empty_path_is_always_accepted(tmp_path): - """Empty means 'the whole group index' — always valid, nothing to resolve.""" - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_video_root({"path": ""}) - - assert issued == [(OP_VIDEO_ROOT, "")] - - -async def test_a_real_subfolder_is_accepted_and_signed(tmp_path): - session = _session(tmp_path, "op", operator="op") - session._has_admin_authority = lambda: True - issued = [] - session._issue_admin_challenge = lambda op, subject: issued.append((op, subject)) - - session._do_video_root({"path": "shared/Movies"}) - - assert issued == [(OP_VIDEO_ROOT, "shared/Movies")] - - -# ── Where it is stored ────────────────────────────────────────────────────── - -async def test_the_setting_lives_on_the_node_and_survives_a_restart(tmp_path): - roster = Roster(db_path=tmp_path / "roster.db") - await roster.open() - try: - assert await roster.app_directories("g1", "video") == [], ( - "absent must mean nothing configured") - await roster.set_app_directories("g1", "video", ["shared/Movies"], - set_by="op") - assert await roster.app_directories("g1", "video") == ["shared/Movies"] - finally: - await roster.close() - - reopened = Roster(db_path=tmp_path / "roster.db") - await reopened.open() - try: - assert await reopened.app_directories("g1", "video") == ["shared/Movies"] - assert await reopened.app_directories("g2", "video") == [], ( - "one group's setting must not answer for another") - finally: - await reopened.close() |