|
|
path
Two coupled gaps in the moderation surface (docs/MESHBAY_DESIGN.md §7.5):
admin_patch_group let a moderator set a group to "revoked", while the user
handler makes revoke admin-only; and a "revoked" set through either PATCH was
never broadcast to nodes — unlike POST /v1/admin/revoke and account deletion —
so it behaved like "suspended" on nodes while claiming to be the signed,
node-enforced state H4 promises.
PATCH now refuses "revoked" on both users and groups (400, pointing at
POST /v1/admin/revoke, which signs and broadcasts), a moderator setting a group
to revoked is refused with 403 as on the user handler, and moving an entity out
of "revoked" requires admin — a moderator flipping the hub row back to active
would only disagree with the nodes still enforcing the broadcast. Revoke has one
door and it broadcasts.
The admin SPA already revokes through POST /v1/admin/revoke, so this is not a
UI-visible change.
test_revoke_is_one_path.py holds the refusals and the working path; verified red
against the pre-fix admin.py and green after.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|