summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* feat: password-based key derivation + operational QUICKSTARTChristophe Besson2026-08-096-363/+501
| | | | | | | | | | | | | | | | | | | | | keyderive.py: derive Ed25519+X25519 from username+password via Argon2id. Same credentials → same keys on any device. Encrypt/decrypt keypair bundle (AES-256-GCM) for hub storage (web clients). 7/7 tests. Full suite: 81/81. keyderive.js: browser counterpart using PBKDF2-SHA512 + random keypairs encrypted for hub storage. Avoids algorithm mismatch with Python. hub/models.py + users.py: keypair_bundle field added to User, stored on registration, returned in login response for web client key recovery. QUICKSTART.md: fully rewritten. 3 operational scripts in QE/demo-v1/: setup_demo.py — create accounts, group, distribute GEK run_node.py — start HTTP node (watches shared/ directory) download.py — bob login → GEK fetch → decrypt → save All tested locally end-to-end. No invented URLs. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* chore: add QE/ structure (not versioned) + server-state docsChristophe Besson2026-08-091-0/+3
| | | | | | | | | QE/ added to .gitignore. Contains: demo-v1/, spikes/, server-state/. QE/server-state/meshbay.org.md: authoritative inventory of what runs on meshbay.org and the deploy procedure. Rule: open port → test → close port+kill processes in same code block. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: add QUICKSTART.md and USERGUIDE.mdChristophe Besson2026-08-092-0/+1219
| | | | | | | | | | | | | QUICKSTART (434 lines): 6-step guide tested against live https://meshbay.org — demo accounts alice_test/bob_test, real transfer of README.txt (23ms) and 1MB chunk (275ms recv, 2.4ms decrypt), exact Python commands with measured output. USERGUIDE (785 lines): 11-section reference — architecture, account management, group/node config, file sharing, HLS streaming, security model, moderation/CSAM, troubleshooting, full API table. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: mark Phase 6 complete — 74/74 testsChristophe Besson2026-08-091-6/+8
| | | | Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat: Phase 6 complete — chat, multi-group, federation, replication, webcryptoChristophe Besson2026-08-097-19/+536
| | | | | | | | | | | | | | | | | | | | | | | | | | 6.1 Double Ratchet (meshbay_common/ratchet.py): Forward secrecy, break-in recovery, out-of-order delivery. Signal-spec KDF_RK/KDF_CK via HKDF-SHA256. 11/11 tests. 6.2 Multi-group node (config.py): [[groups]] TOML array, per-group ports, back-compat [group]. 6.3 MHP federation persistence (db/models.py FederatedGroup + SwarmSource): receive_directory() now persists to federated_groups table. list_public_groups() includes federated results with source attribution. 6.4 Content replication (node/replication.py + hub SwarmSource): ContentReplicator: fetch-index, download, hash-verify, register-swarm. Hub: POST /v1/swarm/register, GET /v1/swarm/{hash} for multi-source. 6.5 Browser private group (webcrypto.py + static/crypto.js): AES-256-GCM variant of GEK for WebCrypto-compatible groups. crypto.js: SubtleCrypto importGEK + deriveChunkKey + decryptChunk. Keys distinct from ChaCha20 via :aes HKDF info suffix. 4/4 tests. 74/74 tests total. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): multi-group config support — 6.2Christophe Besson2026-08-091-24/+65
| | | | | | | | | Config now supports [[groups]] array (N groups) alongside back-compat [group] single section. Each group has independent port/quic_port/http_port and visibility. GroupConfig gains quic_port, http_port, visibility fields. NodeConfig gains quic_port and http_port defaults. 70/70 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(common): add Double Ratchet algorithm — 6.1Christophe Besson2026-08-092-0/+478
| | | | | | | | | | | | | | | | | RatchetState: full Signal-spec Double Ratchet (DH ratchet + symmetric ratchet). KDF_RK/KDF_CK via HKDF-SHA256. AES-256-GCM message encryption. MKSKIP for out-of-order delivery (max 1000 skipped keys). ChatMessage dataclass with to_dict/from_dict for wire serialisation. Properties validated by tests: ✓ Forward secrecy (consumed keys unreplayable) ✓ Out-of-order delivery ✓ Associated data binding ✓ Break-in recovery (post-ratchet keys independent) ✓ 100-message stress test 11/11 tests in 0.06s. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: add Phase 6 plan — chat, multi-group, federation, replicationChristophe Besson2026-08-091-2/+19
| | | | Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: mark Phase 5 complete — QUIC, federation, moderation, packagingChristophe Besson2026-08-091-11/+36
| | | | | | | 59/59 tests. Hub deployed on meshbay.org with all Phase 5 features. Android/iOS deferred. MHP federation memory-only (DB persistence next). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(hub): add CSAM hash matching module — 5.8Christophe Besson2026-08-092-0/+161
| | | | | | | | | | | | | CSAMChecker: loads blake3 hash database from file (NCMEC/IWF format). check_content_hash(): used before serving public content. /v1/admin/csam/status: hash count + DB path. /v1/admin/csam/check: admin-only hash check (no hash logged). Hash database NOT included — hub operators must obtain access from NCMEC (US) or IWF (EU). Instructions in csam.py header. 59/59 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(hub): add MHP federation + Mesh Relay registration — 5.2 + 5.3Christophe Besson2026-08-093-0/+334
| | | | | | | | | | | | | | Federation (MHP 0.1): /mhp/info, /mhp/directory (GET=export, POST=receive), /mhp/revoke (propagation), /mhp/peers (admin registration). Peer auth: JWT EdDSA signed by requesting hub's key. Explicit peer allowlist — no auto-discovery. Relay (5.3): /v1/relays (GET=list), /v1/relays/register (relay keepalive), /v1/relays/approve (admin pre-approval). Relays pre-approved by admin, then self-register with signed endpoint. Nodes query when hole punch fails. 59/59 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* chore: add RPM/DEB packaging artifacts — 5.10Christophe Besson2026-08-0910-0/+404
| | | | | | | | | | | 3 packages: python3-meshbay-common (dep), meshbay-hub, meshbay-node. RPM: spec files with pre/post scriptlets (useradd, systemd macros). DEB: DEBIAN/control + postinst for hub, control for node + common. Systemd: hub.service (system, security hardening) + node.service (user template @%i, EnvironmentFile for MESHBAY_UNLOCK_KEY). packaging/README.md: build + install instructions. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(hub): add moderation — content blocklist + reports — 5.9Christophe Besson2026-08-094-1/+333
| | | | | | | | | | | DB: ContentReport + ContentBlocklist tables. POST /v1/reports: public endpoint, auto-blocks after 2 reports. GET /v1/blocklist/check: node sync check before serving public content. GET /v1/blocklist: full list for node startup sync. GET|POST|DELETE /v1/admin/blocklist: admin management. 6/6 tests. Full suite: 59/59. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat: add revocation push (WebSocket hub→node) — 5.7Christophe Besson2026-08-094-5/+473
| | | | | | | | | | | | | Hub: /v1/nodes/ws WebSocket endpoint for persistent node connections. /v1/admin/revoke marks user/group revoked in DB, signs JWT revocation token (EdDSA), broadcasts to all connected nodes. Node: RevocationSubscriber maintains WS connection, verifies incoming revocation tokens offline (hub Ed25519 PK), adds to local blocklist (_revoked_users/_revoked_groups sets). 53/53 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): add QUIC transport (MNP v2) — quic_server + quic_clientChristophe Besson2026-08-094-2/+639
| | | | | | | | | | | | | | QuicChunkServer/QuicChunkClient: same MNP protocol over QUIC/UDP. Enables hole-punching (Spike 4 Cone NAT validated). Uses aioquic 1.3.0. Bug found+fixed: asyncio.Event race condition in client recv loop (quic_event_received overwrote _stream_events[0] after _recv created it). Fixed with asyncio.Queue (no shared mutable state). Server uses synchronous handlers in quic_event_received (avoids ensure_future transmit timing issue). 3/3 tests. Full suite: 50/50. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: mark Phase 4 complete — web client live on meshbay.orgChristophe Besson2026-08-091-6/+25
| | | | | | | Node HTTP API (7/7 tests), hub web app deployed, HLS streaming (ffmpeg), public group listing. 47/47 total tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(hub): add web app + public group listing endpointChristophe Besson2026-08-094-1/+304
| | | | | | | | | | webapp.py: serves / (HTML SPA) and /app.js (JS client). app.js: login, hub API calls, node HTTP API integration, file browser, HLS video streaming via <video> tag. groups.py: GET /v1/groups — public group listing (no auth). Deployed on https://meshbay.org — 200 OK. 47/47 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): add HTTP file API for browser access (Phase 4)Christophe Besson2026-08-093-1/+564
| | | | | | | | | | | | | FastAPI app on port 19001: GET / (node info), GET /index (public group index JSON), GET /file/{id} (full download), GET /file/{id}/{n} (encrypted or plaintext chunk), GET /hls/{id}/playlist.m3u8 + GET /hls/{id}/{n}.ts (HLS streaming via ffmpeg). Public groups: index browsable without auth, files downloadable. Private groups: chunks encrypted with GEK, auth required. 7/7 tests passing. Full suite: 47/47. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: add Phase 4 plan — web client + node HTTP APIChristophe Besson2026-08-091-9/+33
| | | | Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: add HTTPS.md + configure www.meshbay.org redirectChristophe Besson2026-08-092-1/+141
| | | | | | | | | Caddyfile updated: www → 301 → meshbay.org (canonical). Caddy auto-issued Let's Encrypt cert for www.meshbay.org in 4s. HTTPS.md explains the setup, cert lifecycle (90-day, auto-renewed), why 1-year certs are not recommended, DNS requirements. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: mark Phase 3 complete — hub deployed on https://meshbay.orgChristophe Besson2026-08-091-18/+48
| | | | | | | | PostgreSQL 16 + Caddy HTTPS + systemd. 40 local tests (SQLite) + 11/11 smoke tests on production HTTPS. IP logging, rate limiting, JWT with jti, Argon2id passwords, GEK bundle API all operational. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(hub): add production hub — config, auth, API routers, testsChristophe Besson2026-08-0914-26/+1120
| | | | | | | | | | | | | config.py: TOML + env var priority. auth.py: Argon2id passwords, JWT EdDSA with jti, refresh token hashed (blake3). Routers: hub (info/pubkey), users (register/login/refresh/pubkeys), nodes (announce/get), groups (create/gek-bundle/gek-retrieve). Rate limiting via slowapi. app.py factory with lifespan. All 40 tests pass (SQLite in-memory, no PostgreSQL required). Fix: remove tests/__init__.py to resolve namespace conflicts. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(hub): add SQLAlchemy 2.0 async DB layer + AlembicChristophe Besson2026-08-098-0/+624
| | | | | | | | Models: User, Node, Group, GroupMember, GEKBundle, RefreshToken, IPLog. Engine configurable via MESHBAY_DATABASE_URL (asyncpg/aiosqlite). Alembic async env.py + initial_schema migration autogenerated. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: update devel-phases.md — Phase 2 complete with deps, Phase 3 ↵Christophe Besson2026-08-091-48/+123
| | | | | | detailed plan Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: mark Phase 2 complete in devel-phases.mdChristophe Besson2026-08-091-8/+8
| | | | Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): add config, daemon, and local web UIChristophe Besson2026-08-094-2/+478
| | | | | | | | | | | config.py: TOML + env var overrides, sane defaults. daemon.py: full startup sequence (keystore→hub→GEK→indexer→ server→UI), SIGINT/SIGTERM shutdown, calibrate-argon2 command. ui/app.py: FastAPI on localhost:18000, status+files JSON API, HTML status page (auto-refresh 10s). All bound to 127.0.0.1. Full suite: 29/29 tests. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): add TCP+TLS chunk server and client (MNP v1)Christophe Besson2026-08-095-0/+697
| | | | | | | | | | Self-signed TLS cert (RSA-2048, TLS 1.3 min). Server: JWT offline verify, index sync, file_request → encrypt+sign chunk pipeline. Client: handshake, fetch_index, fetch_chunk with Ed25519 verify + blake3 hash check + GEK decrypt. Integration test: 2MB file served in 2 chunks, reassembled == original. 3/3 tests. Full suite: 29/29. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): add directory indexer and Mesh Group IndexChristophe Besson2026-08-094-0/+600
| | | | | | | | | GroupIndex: msgpack→zstd→GEK-encrypt→sign for private groups, plaintext+sign for public groups. DirectoryIndexer: watchdog-based watcher, async initial scan via thread pool, on_change callback. Delta support (diff between versions). 10/10 tests passing. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): add hub client with JWT offline verify and GEK fetchChristophe Besson2026-08-092-0/+463
| | | | | | | | Register/login/announce/token-refresh/GEK-unwrap. JWT jti and pk_user verified at login. Hub PK cached after first fetch. 6/6 tests passing with httpx.MockTransport (no network). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* feat(node): add keystore module with 3 unlock modesChristophe Besson2026-08-092-0/+325
| | | | | | | | Argon2id + AES-256-GCM encryption at rest. Unlock via env var (MESHBAY_UNLOCK_KEY), unlock.key file (chmod 600), or interactive getpass. 10/10 tests passing. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: add devel-phases.md — 5-phase development roadmapChristophe Besson2026-08-091-0/+132
| | | | | | | | Phase 1 complete (POC + foundations). Phase 2 starting: Node v1 with keystore, hub client, indexer, TCP+TLS chunk server, local web UI. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* docs: add architecture draft v3 with POC findingsChristophe Besson2026-08-091-0/+804
| | | | | | | | | | | | | Key corrections from spikes 1-6: - JWT jti now required (prevents replay, enables revocation) - Argon2id params updated to target 500ms (256MB memory) - NAT order corrected: STUN before UPnP (UPnP unreliable on SFR) - Transport: TCP+TLS v1, QUIC v2 - GEK wrapping protocol confirmed (ECIES-like, 48B opaque bundle) - Hub API table complete with Spike 6 endpoints - 3-package monorepo structure documented Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* chore: initialize monorepo structure for MeshBayChristophe Besson2026-08-0936-0/+5767
3-package layout: meshbay-common (shared crypto/protocol), meshbay-hub (FastAPI server), meshbay-node (local daemon). Includes validated POC spikes 1-6 in poc/, architecture drafts v1/v2 in docs/, and CLAUDE.md project conventions. All cryptographic primitives extracted from POC into meshbay_common/crypto.py (GEK wrap/unwrap, chunk key derivation, keystore encryption, chunk signing). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
generated by cgit v1.2.3 (git 2.51.0) at 2026-09-25 17:21:48 +0000