summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* docs: second security review + roadmap rewrite0.1Christophe Besson2026-08-134-59/+1451
| | | | | | | | | | | | | | | | | | Second architecture and security review (second-review.md): 6 critical and 7 high findings against the Phase 12 implementation, plus an assessment of whether the system meets its end-to-end confidentiality claim. Roadmap rewritten against those findings (devel-phases-next.md): new blocking Phase 11.5 (security remediation), Phase 12 (hub minimization), Phase 13 (native desktop client). Old phases 12-17 renumbered to 14-19. tmp-decisions.md records two open decisions: whether the hub keeps serving the web UI, and browser extension vs native desktop client vs both. CLAUDE.md and devel-phases-next.md also carry pre-existing Phase 12 edits from the working tree that could not be cleanly separated from the review changes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* feat: Phase 12 — P2P crypto material, password split, node Ed25519 authChristophe Besson2026-08-1330-787/+3584
| | | | | | | | | | | | | | | | Baseline commit capturing in-progress Phase 12 work that was already present in the working tree (uncommitted) before the Phase 11.5 security remediation begins. Committed as-is, without review or modification, so that remediation changes arrive as a separable diff. Contents: BundleStore (P2P GEK + keypair bundles), password split (auth_key / bundle_key), node Ed25519 auth (POST /v1/nodes/auth, node-scoped JWT), GEK-HMAC handshake proof with DTLS channel binding, Ed25519 admin challenge-response, node local admin UI rewrite, browser key persistence. Not authored in this session — captured to establish a baseline. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* feat(node): audit logging + local admin UI rewriteChristophe Besson2026-08-115-133/+705
| | | | | | | | | | | | | | | | | | | Add SQLite audit store for legal compliance (LCEN/DSA): logs user IP, actions (handshake, file download/upload/delete, stream, chat), and timestamps. Retention: 1 year, with cleanup method. WebRTC transport now logs all user actions to the audit store with remote IP extraction from the ICE transport. Local web UI rewritten as a proper admin dashboard: - Stats cards (groups, files, peers) - Connected peers table with IP, username, group, state - Group cards with file listings and shared directory info - Audit log page with event/user filtering - Dark theme, responsive, auto-refresh - JSON API: /api/status, /api/groups, /api/peers, /api/audit, /api/config Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(node): index push to WebRTC peers + swarm registration (11.5, 11.9)Christophe Besson2026-08-114-18/+189
| | | | | | | | | | | When watchdog detects file changes, the daemon now: - Pushes INDEX_SYNC to all connected WebRTC peers in that group - Registers file hashes with hub /v1/swarm/register endpoint Also registers all file hashes on startup for initial discovery. hub_client: add register_swarm() method for bulk hash registration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(node): Phase 11 — production-ready daemon with WebRTC, WS, chat, HTTPChristophe Besson2026-08-117-65/+454
| | | | | | | | | | | | | | | | | | The node daemon was previously a skeleton that only started QUIC/TCP servers and the local web UI. All browser-facing functionality (WebRTC, hub WebSocket, chat store, HTTP file API) lived in QE demo scripts. This rewrites daemon.py to be fully self-contained: - WebRTC transport for browser clients (aiortc DataChannel) - Hub WebSocket task (signaling, revocations, WebRTC offers) - ChatStore per group (SQLite in ~/.local/share/meshbay/) - HTTP file API per group (create_http_app on configured port) - Graceful shutdown (all transports, stores, tasks) - hub_client: _ws tracking + send_ws() for chat notifications - config: data_dir field for persistent state - systemd: security hardening (ProtectSystem, StateDirectory) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ui): reduce upload chunk size to 48KB to fit aiortc SCTP limitChristophe Besson2026-08-111-1/+1
| | | | | | | | | | aiortc advertises maxMessageSize=65536 in SDP. A 64KB data chunk + msgpack envelope + 4-byte length prefix exceeds this limit, causing "Trying to send message larger than max-message-size" on upload. 48KB data + overhead stays well under 65536 bytes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ui): set MediaSource duration from ffprobe and clamp seeks to buffered rangeChristophe Besson2026-08-111-5/+23
| | | | | | | | | | | | | | | Two fixes for the MSE video player: 1. Set mediaSource.duration from the ffprobe-reported duration on sourceopen, so the seek bar shows the correct video length instead of NaN/infinite. 2. Use SourceBuffer mode='sequence' for sequential append without timestamp gaps. Add a seeking handler that clamps currentTime to the buffered range — seeking beyond buffered data snaps back instead of freezing the video. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ui): remove duplicate connecting messages and buggy stream progress barChristophe Besson2026-08-112-52/+4
| | | | | | | | | | | | | | 1. "Connecting..." was shown in 3 places simultaneously (status badge, cached files area, and general status). Now only the badge shows it when cached files are visible — the redundant messages are removed. 2. The floating stream progress bar caused constant re-renders during video streaming (every 256KB segment triggered setState). The fMP4 remux size also differs from the original file size, making the progress inaccurate. Removed the overlay bar entirely — the video element's native buffered range indicator is sufficient. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: add Phases 11–17 roadmap (node daemon, CLI, Sender Keys, Android, ↵Christophe Besson2026-08-111-31/+155
| | | | | | | | | | packaging) Phase 11 (node daemon production-ready) is the critical next step — all WebRTC, WS, chat, and HTTP wiring currently lives in the demo script and must move into the daemon. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: Phase 10c — MSE video streaming (real-time playback)Christophe Besson2026-08-119-54/+467
| | | | | | | | | Replace download-then-play VideoPlayer with MSE (MediaSource Extensions) streaming. Node remuxes to fMP4 via ffmpeg, probes codecs with ffprobe, and sends encrypted segments over DataChannel. Browser decrypts and appends to SourceBuffer — playback starts within seconds. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(hub): move _handle_chat_notify before @router.websocket decoratorChristophe Besson2026-08-111-1/+1
| | | | | | | The function was placed between the decorator and node_websocket, breaking the WebSocket endpoint registration (403 on all WS connects). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: chat notifications via hub, file delete, upload fix, cached display, ↵Christophe Besson2026-08-112-0/+48
| | | | | | | | | | | | | | | | | | | | | inline thumbnails Backend: - Chat store persists sender_name (SQLite migration, no more UUID display) - FILE_DELETE / FILE_DELETE_ACK MNP types — node admin can delete files - Node sends chat_notify to hub WS — hub creates notifications for offline members - Hub revocation.py handles chat_notify, creates per-member notifications Frontend: - Upload chunk size 64KB (was 1MB) — fixes WebRTC DataChannel max-message-size - Show cached files immediately while WebRTC connects - ChatImage component — inline image thumbnails in chat (download+decrypt) - File delete action in menu (group admin, with confirm dialog) - Member panel: "Owner" label instead of confusing "Group admin" - Create group page: hint about needing a node - Refresh index after chat attachment upload Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ui): upload chunk size, cached file display, chat names, file delete, ↵Christophe Besson2026-08-117-26/+179
| | | | | | | | | | | | | | | | inline thumbnails - Upload chunks capped at 64KB to avoid WebRTC DataChannel max-message-size - Show cached files immediately while WebRTC connects (tabs visible during connection) - Persist sender_name in chat store (SQLite) — no more UUID display in history - File delete action in menu (node admin only, enforced server-side) - FILE_DELETE / FILE_DELETE_ACK MNP message types - Inline image thumbnails in chat attachments (download+decrypt, Signal-style) - Member panel: "Owner" label instead of "Group admin" to avoid hub/group admin confusion - Create group page: hint about needing a node - Refresh index after chat file attachment upload Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(node): iterate dict copies in WebRTC peer broadcast and close_allChristophe Besson2026-08-111-2/+2
| | | | | | | Concurrent peer disconnects could mutate _peers/_sessions during iteration, causing RuntimeError: dictionary changed size during iteration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ui): group creation error, chat UUIDs, file preview, action menuChristophe Besson2026-08-115-53/+428
| | | | | | | | | | | | | | | | | | | Bug fixes: - Group creation "[object Object]" error: removed dead pkcs8 import code that threw before GEK wrapping, added array detail handling in hubFetch - Chat shows usernames instead of UUIDs (sender_name passed through node) - Join button: navigate to group on "Already a member" instead of error UI improvements: - Loading spinner animation for async states (connecting, fetching) - File action menu (3-dot dropdown: View, Download, Play) - Click filename to preview inline (images, text/code files) - FilePreview overlay for images and text files - Chat file attachment button (upload to node + structured message) - Chat attachment display (icon, filename, size) - Member panel: "Group admin" badge instead of plain "Admin" text Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: Phase 10b — Self-service UI (group create/join, upload, IndexedDB, ↵Christophe Besson2026-08-1113-15/+974
| | | | | | | | | | | | | | | | search) Six self-service features for the web SPA: - Group creation UI with GEK auto-generation (AES-256-GCM ECIES) - Member management + invite by username (GEK wrapping for invitee) - Open group self-join flow (POST /v1/groups/{id}/join) - File upload client→node (FILE_UPLOAD MNP type, .uploads/ staging) - IndexedDB caching of group file indexes (instant display on revisit) - Cross-group file search (SearchPage, pure client-side on cached indexes) 11 new tests (166 total): 8 group self-service + 3 AES GEK wrap/unwrap. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(hub): Phase 10.5–10.8, 10.10 — notifications, settings, search, versionChristophe Besson2026-08-1113-29/+543
| | | | | | | | | | | | - 10.5: Notification model + CRUD API (list, mark read, mark all read) Triggered on: group invite, role change, suspend/unsuspend - 10.6: SettingsPage shows role, per-group notification mute (localStorage) - 10.7: GET /v1/groups?q= search filter (ilike on name) - 10.8: NotificationFeed on home page + bell with unread badge in navbar - 10.10: GET /v1/hub/version endpoint for client update checks - 8 new tests (test_notifications.py), 155 total Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: update Phase 10 commit hash, API reference, key modulesChristophe Besson2026-08-113-6/+25
| | | | Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(hub): Phase 10.1–10.4 — Site overlay + admin/moderation UIChristophe Besson2026-08-1115-34/+1646
| | | | | | | | | | | | | | - Site overlay: landing page, /about, /downloads (dark/light, responsive) - User role column (user/moderator/admin) with config-based admin sync - require_moderator dependency + admin API (8 endpoints: stats, users, groups, audit logs) - Admin SPA panel at #/admin with 5 tabs (stats, users, groups, logs, blocklist) — visible only to moderators/admins - SPA also served at /app/ for Caddy site overlay integration - GET /v1/users/me returns current user role - 15 new tests, 147 total passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: update Phase 9 commit hash in devel-phases-nextChristophe Besson2026-08-111-1/+1
| | | | Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: Phase 9 — Web client SPA with WebRTC P2P transportChristophe Besson2026-08-1127-316/+3039
| | | | | | | | | | | | | | | | Complete browser-based client: Preact SPA with login, group file browser, encrypted download, video playback, group chat, i18n, and dark/light theme. Browser connects P2P to nodes behind residential NAT via WebRTC DataChannel (aiortc). Hub handles signaling only — all data flows E2E. Performance: pipelined downloads (8-chunk sliding window), binary msgpack wire format (no base64), redundant I/O elimination. Large file downloads stream to disk via File System Access API (showSaveFilePicker). Validated on SFR + Orange residential NATs, Chrome + Firefox, IPv4/IPv6. 132 tests passing. Deployed to meshbay.org + Orange node. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: Phase 9.1–9.5 — WebRTC DataChannel transport for browser P2PChristophe Besson2026-08-1015-172/+3045
| | | | | | | | | | | | | | | | | | | | | | | | Browser clients can now connect P2P to nodes behind residential NAT via WebRTC DataChannel with ICE/STUN. Validated on SFR Port-Restricted Cone NAT + 4G CGNAT across three scenarios (WiFi LAN, 4G IPv6, 4G IPv4 STUN). No TURN relay needed. Hub serves only as signaling relay (<1 KB). New files: - webrtc_server.py: aiortc-based WebRTC transport (node side) - signaling.py: SDP/ICE relay endpoint (hub side) - transport.js: browser WebRTC client with msgpack framing - webrtc-test.html: spike test page for browser→NAT→node validation - test_webrtc_transport.py: 4 tests (handshake, file transfer, auth, guard) - meshbay-draft-v4.md: architecture spec updated for web client Modified: - hub_client.py: WebRTC offer handling via hub WebSocket - revocation.py: node_id from WS auth + webrtc_answer routing - pyproject.toml: aiortc>=1.9 dependency 123 tests passing (117 existing + 6 new). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(hub): Phase 8 — Hub v2 security hardening + production readinessChristophe Besson2026-08-1020-90/+508
| | | | | | | | | | | | | | | | | | | | 8.1 Config-based admin authz (require_admin on all admin endpoints) 8.2 Email encrypted at rest (AES-256-GCM, HKDF from hub Ed25519 key) 8.3 Refresh token rotation with family-based reuse detection 8.4 Federation persistence (HubPeer model replaces in-memory dict) 8.5 Federation token verification now async (DB-backed) 8.6 CSAM hash check wired into swarm registration flow 8.7 Rate limiting on auth endpoints (5/10/20 per minute) 8.8 Healthcheck endpoint (GET /v1/health, no auth) 8.9 IP log cleanup background task (365-day retention) 8.10 Argon2id params bumped to 256 MB (pw_version, rehash on login) Deployed to meshbay.org — schema migrated, existing emails encrypted. 117 tests pass (29 hub, 88 common+node). Resolves security review items S1, S2, S5. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist)Christophe Besson2026-08-1026-155/+2151
| | | | | | | | | | | | | | | | | | | | | | | | | | | Implements all 8 milestones (7.0-7.7): - 7.0: JWT carries `groups` claim; node verifies group membership at MNP handshake (QUIC + TCP+TLS). Resolves security review C2. - 7.1: QUIC 0-RTT session resumption via stored session tickets (17-21ms reconnect vs 47ms cold). - 7.2: Hub→node WebSocket signaling for NAT punch coordination (`client_incoming`/`punch_ready`) + jti denylist push. Denylist class blocks revoked users/jtis at handshake. - 7.3: Multi-group daemon — one QUIC port serves N groups with per-group GEK, shared_root, and index routing. - 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg segment extraction). - 7.5: Sender Keys protocol for group chat (Signal Groups approach). Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM encryption, Ed25519 signing. Resolves security review C1. - 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type with peer broadcast, web UI with WebSocket push. - 7.7: Argon2id calibration CLI. First security review included (first-review.md). 109 tests, demo-v3 validated against meshbay.org production hub. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: update draft v3 + phases-next with Phase 7 decisionsChristophe Besson2026-08-102-24/+87
| | | | | | | | | | Multi-group: single QUIC port (multiplexing), group_id from JWT. Signaling punch/connect: hub WS client_incoming/punch_ready protocol, reduces handshake 12.7s → < 200ms. SFR Port-Restricted findings added. Chat model: between forum and Signal — persistent, threaded, E2E, per-group scope, push for online / pull for offline members. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: add devel-phases-next.md — Phases 7-12 roadmapChristophe Besson2026-08-101-0/+149
| | | | | | | | | | | | | Phase 7: Node v2 (multi-group, 0-RTT, HLS QUIC, chat) Phase 8: Hub v2 (admin roles, MHP network, CSAM) Phase 9: Android MVP (Kotlin, quiche JNI, STUN) Phase 10: Web client v2 (private group AES-GCM, HLS player) Phase 11: Network resilience (TURN relay, 0-RTT, CGNAT) Phase 12: RPM/DEB CI/CD Open questions per phase documented. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: add demo-v2 NAT findings to CLAUDE.mdChristophe Besson2026-08-101-0/+14
| | | | | | Port-Restricted Cone SFR, punch_nat() mechanism, 12.7s handshake note. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: update devel-phases — demo-v2 NAT traversal QUIC validatedChristophe Besson2026-08-101-0/+4
| | | | | | | SFR Port-Restricted Cone NAT diagnosed. punch_nat() implemented. QUIC direct Fedora→SFR→meshbay.org: 12.7s handshake, file transfer OK. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): punch_nat() — NAT traversal from QUIC server socketChristophe Besson2026-08-101-0/+16
| | | | | | | | | | | | | | | | | | | SFR residential NAT is Port-Restricted Cone: inbound is only allowed from (peer_ip, peer_port) if the node previously sent a packet TO (peer_ip, peer_port) from the SAME socket. punch_nat(peer_ip, peer_port): sends a probe UDP packet from the QUIC server's own transport (_transport.sendto), creating the correct NAT entry. Used after server.start() to enable direct QUIC connections through SFR NAT without UPnP or relay. demo-v2 result: QUIC/UDP direct Fedora→SFR NAT→meshbay.org validated. Connection time 12.7s (QUIC handshake through NAT). File transfer 700B. QuicChunkClient local_port param: ensures client binds to same port as punch_nat destination (Port-Restricted Cone requirement). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* fix(node): QuicChunkClient local_port + QuicChunkServer dual-stackChristophe Besson2026-08-102-8/+11
| | | | | | | | local_port=0 param on QuicChunkClient — specify for Port-Restricted Cone NAT hole punching (client must send from the same port the node probed to). QuicChunkServer default host '::' for IPv4+IPv6 dual-stack on Linux. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* fix: 4 corrections — streaming hash, watchdog bug, cipher doc, depsChristophe Besson2026-08-092-4/+23
| | | | | | | | | | | | | | | | | | | 1. indexer.py: streaming blake3 (8MB chunks) instead of read_bytes(). Large files (initrd.img, ISOs, VM images) no longer load into RAM. 2. QE/demo-v1/run_node.py: call indexer.start() not initial_scan(). initial_scan() alone never starts the watchdog observer — files added after startup were silently ignored. Added indexer.stop() on shutdown. 3. USERGUIDE.md §8: clarify symmetric vs asymmetric. Ed25519/X25519 = asymmetric (key pairs). ChaCha20-Poly1305 and AES-256-GCM = symmetric AEAD 256-bit (content encryption). ChaCha20 is PRIMARY; AES-GCM is optional browser-compat variant only. 4. pyproject.toml: aioquic, websockets, aiosqlite, slowapi added to proper package deps (were installed manually, now declared). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* fix: complete pyproject.toml deps + graceful QUIC fallbackChristophe Besson2026-08-095-21/+57
| | | | | | | | | | | | | | | | | | | | meshbay-node/pyproject.toml: add aioquic>=1.0 (was commented 'v2'), websockets>=12.0 (revocation push). Both are production code since Phase 5. meshbay-hub/pyproject.toml: add aiosqlite (tests without PostgreSQL), slowapi (rate limiting), websockets (revocation push), PyJWT (explicit). transport/__init__.py: QUIC imports wrapped in try/except — node works without aioquic (TCP+TLS + HTTP fallback). QUIC_AVAILABLE flag exported. QUICKSTART.md: replace manual pip list with 'pip install -e' that pulls all deps from pyproject.toml automatically. Add dependency table. CLAUDE.md: clarify that all deps go in pyproject.toml, not manual installs. 81/81 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* fix: venv --clear required when copying repo across OS (Fedora→Ubuntu)Christophe Besson2026-08-092-15/+11
| | | | | | | | | | | | | Root cause: certifi.where() in the Fedora venv points to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem which does not exist on Ubuntu. 'python3 -m venv .venv' without --clear keeps the Fedora certifi paths. Fix: always use --clear when recreating a venv on a different OS. Documented in QUICKSTART.md and CLAUDE.md. rsync command updated to exclude .venv/ (in QE/server-state, not versioned). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* fix: document pip SSL_CERT_FILE workaround for Python 3.14 on Ubuntu/FedoraChristophe Besson2026-08-092-14/+29
| | | | | | | | pip + Python 3.14 fails with FileNotFoundError in certifi.where() on fresh venvs (truststore bug). Fix: SSL_CERT_FILE pointing to system CA bundle. Documented in CLAUDE.md (Python environment section) and QUICKSTART.md. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: update all pointers after keyderive + QE restructureChristophe Besson2026-08-095-17/+183
| | | | | | | | | | | | | | | | | | | | | | CLAUDE.md: add QE/ to structure, key modules table, server state reference, security rule updated (QE/ not keypair files), meshbay.org inventory pointer. devel-phases.md: add milestones 6.6-6.9 (keyderive, bundle, demo scripts, QUICKSTART rewrite). 81/81 tests. docs/meshbay-draft-v3.md §6.1.1: new section documenting 3 key generation strategies (Argon2id CLI, WebCrypto browser+bundle, keystore file) and the algorithm mismatch caveat between CLI and web registration paths. docs/USERGUIDE.md §2 Register+Login: replace "generate and persist before registering" warning with the two clean strategies (derive_keys_from_password for CLI, keyderive.js + keypair_bundle for browser). Login response updated with keypair_bundle field. hub/models.py + users.py + Alembic migration: keypair_bundle column on User, stored at registration, returned at login (web clients only). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat: password-based key derivation + operational QUICKSTARTChristophe Besson2026-08-096-363/+501
| | | | | | | | | | | | | | | | | | | | | keyderive.py: derive Ed25519+X25519 from username+password via Argon2id. Same credentials → same keys on any device. Encrypt/decrypt keypair bundle (AES-256-GCM) for hub storage (web clients). 7/7 tests. Full suite: 81/81. keyderive.js: browser counterpart using PBKDF2-SHA512 + random keypairs encrypted for hub storage. Avoids algorithm mismatch with Python. hub/models.py + users.py: keypair_bundle field added to User, stored on registration, returned in login response for web client key recovery. QUICKSTART.md: fully rewritten. 3 operational scripts in QE/demo-v1/: setup_demo.py — create accounts, group, distribute GEK run_node.py — start HTTP node (watches shared/ directory) download.py — bob login → GEK fetch → decrypt → save All tested locally end-to-end. No invented URLs. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* chore: add QE/ structure (not versioned) + server-state docsChristophe Besson2026-08-091-0/+3
| | | | | | | | | QE/ added to .gitignore. Contains: demo-v1/, spikes/, server-state/. QE/server-state/meshbay.org.md: authoritative inventory of what runs on meshbay.org and the deploy procedure. Rule: open port → test → close port+kill processes in same code block. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: add QUICKSTART.md and USERGUIDE.mdChristophe Besson2026-08-092-0/+1219
| | | | | | | | | | | | | QUICKSTART (434 lines): 6-step guide tested against live https://meshbay.org — demo accounts alice_test/bob_test, real transfer of README.txt (23ms) and 1MB chunk (275ms recv, 2.4ms decrypt), exact Python commands with measured output. USERGUIDE (785 lines): 11-section reference — architecture, account management, group/node config, file sharing, HLS streaming, security model, moderation/CSAM, troubleshooting, full API table. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: mark Phase 6 complete — 74/74 testsChristophe Besson2026-08-091-6/+8
| | | | Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat: Phase 6 complete — chat, multi-group, federation, replication, webcryptoChristophe Besson2026-08-097-19/+536
| | | | | | | | | | | | | | | | | | | | | | | | | | 6.1 Double Ratchet (meshbay_common/ratchet.py): Forward secrecy, break-in recovery, out-of-order delivery. Signal-spec KDF_RK/KDF_CK via HKDF-SHA256. 11/11 tests. 6.2 Multi-group node (config.py): [[groups]] TOML array, per-group ports, back-compat [group]. 6.3 MHP federation persistence (db/models.py FederatedGroup + SwarmSource): receive_directory() now persists to federated_groups table. list_public_groups() includes federated results with source attribution. 6.4 Content replication (node/replication.py + hub SwarmSource): ContentReplicator: fetch-index, download, hash-verify, register-swarm. Hub: POST /v1/swarm/register, GET /v1/swarm/{hash} for multi-source. 6.5 Browser private group (webcrypto.py + static/crypto.js): AES-256-GCM variant of GEK for WebCrypto-compatible groups. crypto.js: SubtleCrypto importGEK + deriveChunkKey + decryptChunk. Keys distinct from ChaCha20 via :aes HKDF info suffix. 4/4 tests. 74/74 tests total. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): multi-group config support — 6.2Christophe Besson2026-08-091-24/+65
| | | | | | | | | Config now supports [[groups]] array (N groups) alongside back-compat [group] single section. Each group has independent port/quic_port/http_port and visibility. GroupConfig gains quic_port, http_port, visibility fields. NodeConfig gains quic_port and http_port defaults. 70/70 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(common): add Double Ratchet algorithm — 6.1Christophe Besson2026-08-092-0/+478
| | | | | | | | | | | | | | | | | RatchetState: full Signal-spec Double Ratchet (DH ratchet + symmetric ratchet). KDF_RK/KDF_CK via HKDF-SHA256. AES-256-GCM message encryption. MKSKIP for out-of-order delivery (max 1000 skipped keys). ChatMessage dataclass with to_dict/from_dict for wire serialisation. Properties validated by tests: ✓ Forward secrecy (consumed keys unreplayable) ✓ Out-of-order delivery ✓ Associated data binding ✓ Break-in recovery (post-ratchet keys independent) ✓ 100-message stress test 11/11 tests in 0.06s. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: add Phase 6 plan — chat, multi-group, federation, replicationChristophe Besson2026-08-091-2/+19
| | | | Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: mark Phase 5 complete — QUIC, federation, moderation, packagingChristophe Besson2026-08-091-11/+36
| | | | | | | 59/59 tests. Hub deployed on meshbay.org with all Phase 5 features. Android/iOS deferred. MHP federation memory-only (DB persistence next). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(hub): add CSAM hash matching module — 5.8Christophe Besson2026-08-092-0/+161
| | | | | | | | | | | | | CSAMChecker: loads blake3 hash database from file (NCMEC/IWF format). check_content_hash(): used before serving public content. /v1/admin/csam/status: hash count + DB path. /v1/admin/csam/check: admin-only hash check (no hash logged). Hash database NOT included — hub operators must obtain access from NCMEC (US) or IWF (EU). Instructions in csam.py header. 59/59 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(hub): add MHP federation + Mesh Relay registration — 5.2 + 5.3Christophe Besson2026-08-093-0/+334
| | | | | | | | | | | | | | Federation (MHP 0.1): /mhp/info, /mhp/directory (GET=export, POST=receive), /mhp/revoke (propagation), /mhp/peers (admin registration). Peer auth: JWT EdDSA signed by requesting hub's key. Explicit peer allowlist — no auto-discovery. Relay (5.3): /v1/relays (GET=list), /v1/relays/register (relay keepalive), /v1/relays/approve (admin pre-approval). Relays pre-approved by admin, then self-register with signed endpoint. Nodes query when hole punch fails. 59/59 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* chore: add RPM/DEB packaging artifacts — 5.10Christophe Besson2026-08-0910-0/+404
| | | | | | | | | | | 3 packages: python3-meshbay-common (dep), meshbay-hub, meshbay-node. RPM: spec files with pre/post scriptlets (useradd, systemd macros). DEB: DEBIAN/control + postinst for hub, control for node + common. Systemd: hub.service (system, security hardening) + node.service (user template @%i, EnvironmentFile for MESHBAY_UNLOCK_KEY). packaging/README.md: build + install instructions. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(hub): add moderation — content blocklist + reports — 5.9Christophe Besson2026-08-094-1/+333
| | | | | | | | | | | DB: ContentReport + ContentBlocklist tables. POST /v1/reports: public endpoint, auto-blocks after 2 reports. GET /v1/blocklist/check: node sync check before serving public content. GET /v1/blocklist: full list for node startup sync. GET|POST|DELETE /v1/admin/blocklist: admin management. 6/6 tests. Full suite: 59/59. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat: add revocation push (WebSocket hub→node) — 5.7Christophe Besson2026-08-094-5/+473
| | | | | | | | | | | | | Hub: /v1/nodes/ws WebSocket endpoint for persistent node connections. /v1/admin/revoke marks user/group revoked in DB, signs JWT revocation token (EdDSA), broadcasts to all connected nodes. Node: RevocationSubscriber maintains WS connection, verifies incoming revocation tokens offline (hub Ed25519 PK), adds to local blocklist (_revoked_users/_revoked_groups sets). 53/53 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): add QUIC transport (MNP v2) — quic_server + quic_clientChristophe Besson2026-08-094-2/+639
| | | | | | | | | | | | | | QuicChunkServer/QuicChunkClient: same MNP protocol over QUIC/UDP. Enables hole-punching (Spike 4 Cone NAT validated). Uses aioquic 1.3.0. Bug found+fixed: asyncio.Event race condition in client recv loop (quic_event_received overwrote _stream_events[0] after _recv created it). Fixed with asyncio.Queue (no shared mutable state). Server uses synchronous handlers in quic_event_received (avoids ensure_future transmit timing issue). 3/3 tests. Full suite: 50/50. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
generated by cgit v1.2.3 (git 2.51.0) at 2026-09-25 15:18:06 +0000