diff options
Diffstat (limited to 'packages/meshbay-node')
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/daemon.py | 14 | ||||
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/ops.py | 22 | ||||
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/roster.py | 15 | ||||
| -rw-r--r-- | packages/meshbay-node/tests/test_roster_pairing.py | 104 |
4 files changed, 149 insertions, 6 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py index bb50bcf..c16e49f 100644 --- a/packages/meshbay-node/src/meshbay_node/daemon.py +++ b/packages/meshbay-node/src/meshbay_node/daemon.py @@ -2409,9 +2409,17 @@ def main() -> None: cfg, f"/api/members/{match['user_id']}/revoke?group_id={group_id}", method="POST") print(f"{args.target} revoked from {group_id[:8]}") - print("They stop receiving the group key on their next connection.") - print("They still hold the current one — rotate it:") - print(f" meshbay-node gek-init --group {group_id}") + if out.get("invites_dropped"): + print("Their unredeemed invitation was cancelled.") + # The node decides whether a rotation is warranted and says so in + # the reminder — somebody who never redeemed a code never held the + # key, and advising a rotation there is advice to ignore the next + # time it is real. Deciding it again here is the second + # implementation this file exists not to have. + if out.get("reminder"): + print("They stop receiving the group key on their next connection.") + print("They still hold the current one — rotate it:") + print(f" meshbay-node gek-init --group {group_id}") return if sub == "unpin": diff --git a/packages/meshbay-node/src/meshbay_node/ops.py b/packages/meshbay-node/src/meshbay_node/ops.py index baea365..b680d43 100644 --- a/packages/meshbay-node/src/meshbay_node/ops.py +++ b/packages/meshbay-node/src/meshbay_node/ops.py @@ -243,13 +243,29 @@ async def revoke_member(state: dict, user_id: str, group_id: str) -> dict: Takes effect on their next connection: the key is wrapped on demand, so there is no stored bundle left behind that would outlive this. Rotating the group key is still required — they hold the current one. + + **An unredeemed invite is a membership that has not happened yet**, so it is + revoked here too, and on its own it is enough for this to be a removal. A + member row appears only when a code is consumed: somebody invited to the + wrong group has none, this refused them with "no such member", and the + browser's removal — node half first, deliberately — died on that refusal + before it reached the hub half. They stayed a member on the hub, with a live + code, and the interface offered no other way to take either back. """ roster = _roster(state) - if not await roster.set_status(group_id, user_id, "revoked"): + revoked = await roster.set_status(group_id, user_id, "revoked") + dropped = await roster.drop_invites(group_id, user_id) + if not revoked and not dropped: raise OpError("No such member in that group", status=404) - log.info("Member revoked: user=%s group=%s", user_id[:8], group_id[:8]) + log.info("Member revoked: user=%s group=%s member=%s invites_dropped=%d", + user_id[:8], group_id[:8], revoked, dropped) return {"status": "revoked", "user_id": user_id, "group_id": group_id, - "reminder": "rotate the group key: meshbay-node gek rotate"} + "was_member": revoked, "invites_dropped": dropped, + # Only what is true: somebody who never redeemed a code never held + # the key, and telling an operator to rotate it teaches them that + # the advice is noise. + "reminder": ("rotate the group key: meshbay-node gek rotate" + if revoked else "")} async def unpin_member(state: dict, user_id: str) -> dict: diff --git a/packages/meshbay-node/src/meshbay_node/roster.py b/packages/meshbay-node/src/meshbay_node/roster.py index 9478a32..9533f25 100644 --- a/packages/meshbay-node/src/meshbay_node/roster.py +++ b/packages/meshbay-node/src/meshbay_node/roster.py @@ -1081,6 +1081,21 @@ class Roster: await self._db.commit() return code + async def drop_invites(self, group_id: str, user_id: str) -> int: + """ + Cancel any code this person has not redeemed yet for this group. + + A code already used is left alone: `used_at` is the record that the join + happened, and it is the only thing that makes a second attempt fail. + """ + assert self._db + cur = await self._db.execute( + "DELETE FROM invites WHERE group_id = ? AND user_id = ? AND used_at IS NULL", + (group_id, user_id), + ) + await self._db.commit() + return cur.rowcount + async def consume_invite(self, code: str, user_id: str) -> dict | None: """ Redeem a code for `user_id`, or return None. diff --git a/packages/meshbay-node/tests/test_roster_pairing.py b/packages/meshbay-node/tests/test_roster_pairing.py index 82336e2..91191c1 100644 --- a/packages/meshbay-node/tests/test_roster_pairing.py +++ b/packages/meshbay-node/tests/test_roster_pairing.py @@ -1160,6 +1160,110 @@ async def test_revoking_is_confined_to_the_group_it_was_asked_for(tmp_path, rost "the pinned identity was dropped; that is `member unpin`, not this") +async def test_revoking_someone_who_never_redeemed_their_code(tmp_path, roster): + """ + An invitation sent to the wrong person is the case removal has to cover. + + A member row exists only once a code is consumed, so until then there is + nothing for `set_status` to update, and this answered "no such member in + that group" — a refusal that stopped the browser before it reached the hub + half, leaving the person a member there and their code live. Nothing else + offered to take either back. + """ + from meshbay_common.adminop import admin_transcript + + sk_op, pk_op, pk_x_op = _keypair() + await roster.pin_identity("grenet", "grenet", pk_op, pk_x_op, "code") + await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli") + + code = await roster.create_invite( + group_id="g1", user_id="misinvited", role=ROLE_MEMBER, + created_by="grenet", username="misinvited") + assert await roster.get_member("g1", "misinvited") is None + + session = _session(tmp_path, roster, group_id="g1", gek=generate_gek()) + session._admin_ops = {} + session._ctx["has_admin_authority"] = True + session._ctx["peers"] = {} + + transcript = admin_transcript( + op="member_revoke", node_pk_b64=session._node_pk_b64(), group_id="g1", + subject="misinvited", nonce=b"\x55" * 32, ts=int(time.time())) + await session._admin_exec_member_revoke( + {"op": "member_revoke", "subject": "misinvited"}, transcript, + sk_op.sign(transcript)) + + assert _last(session)["type"] == "member_revoke_ack", ( + f"the node refused: {_last(session).get('detail')!r}") + # The half that matters: the code that was emailed out no longer works. + assert await roster.consume_invite(code, "misinvited") is None + assert [i for i in await roster.list_invites() + if i["user_id"] == "misinvited"] == [] + + +async def test_revoking_does_not_cancel_their_invitation_to_another_group( + tmp_path, roster): + """ + Inviting somebody to the wrong group and then to the right one is one + errand, not two, and undoing the first must not undo the second — the + second code has usually not been redeemed yet when the mistake is noticed. + """ + from meshbay_common.adminop import admin_transcript + + sk_op, pk_op, pk_x_op = _keypair() + await roster.pin_identity("grenet", "grenet", pk_op, pk_x_op, "code") + await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli") + + await roster.create_invite(group_id="g1", user_id="misinvited", + role=ROLE_MEMBER, created_by="grenet") + keeper = await roster.create_invite(group_id="g2", user_id="misinvited", + role=ROLE_MEMBER, created_by="grenet") + + session = _session(tmp_path, roster, group_id="g1", gek=generate_gek()) + session._admin_ops = {} + session._ctx["has_admin_authority"] = True + session._ctx["peers"] = {} + + transcript = admin_transcript( + op="member_revoke", node_pk_b64=session._node_pk_b64(), group_id="g1", + subject="misinvited", nonce=b"\x66" * 32, ts=int(time.time())) + await session._admin_exec_member_revoke( + {"op": "member_revoke", "subject": "misinvited"}, transcript, + sk_op.sign(transcript)) + + assert _last(session)["type"] == "member_revoke_ack" + assert await roster.consume_invite(keeper, "misinvited") is not None, ( + "the invitation to the other group was cancelled as well") + + +async def test_revoking_a_stranger_is_still_refused(tmp_path, roster): + """ + Neither a member row nor a code: the 404 is what tells an operator they + named the wrong person or the wrong group, and dropping it would make every + typo look like a removal. + """ + from meshbay_common.adminop import admin_transcript + + sk_op, pk_op, pk_x_op = _keypair() + await roster.pin_identity("grenet", "grenet", pk_op, pk_x_op, "code") + await roster.set_member("", "grenet", ROLE_OPERATOR, "active", "local-cli") + + session = _session(tmp_path, roster, group_id="g1", gek=generate_gek()) + session._admin_ops = {} + session._ctx["has_admin_authority"] = True + session._ctx["peers"] = {} + + transcript = admin_transcript( + op="member_revoke", node_pk_b64=session._node_pk_b64(), group_id="g1", + subject="nobody", nonce=b"\x77" * 32, ts=int(time.time())) + await session._admin_exec_member_revoke( + {"op": "member_revoke", "subject": "nobody"}, transcript, + sk_op.sign(transcript)) + + assert _last(session)["type"] == "error" + assert "No such member" in _last(session)["detail"] + + async def test_an_operator_cannot_revoke_themselves(tmp_path, roster): """It would leave the group with nobody able to invite or remove.""" session = _session(tmp_path, roster, group_id="g1", gek=generate_gek()) |