From b86981f7b4ffe758136a527542ce256315823a46 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 18 Aug 2026 18:21:57 +0200 Subject: feat(node): the operator can close uploading to everyone but themselves MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A group where every member may add files stays the default. Some groups want a library the operator curates, and until now the only way to get one was to designate no upload root at all — which refuses the operator too. **The node enforces it; the interface merely stops offering it.** The Upload button in the Files toolbar and the paperclip in the chat composer both disappear, which is a courtesy to the people who are not trying. The control is `_do_file_upload` refusing with `member_upload_off`, so a member on an old tab, or one speaking MNP directly, gets the same answer. There is a test for each, and the enforcement test is in the node package rather than beside the UI one so nobody reads the hidden button as the mechanism. **Changing it is a signed operator instruction** — `OP_MEMBER_UPLOAD`, on the same path as removing a member. An unsigned one would let any member turn it back on and make the setting a suggestion. The transcript's subject is `on` or `off`: what the operator is shown before signing has to name the outcome, not the operation. **It lives on the node**, in a new `group_settings` table in `roster.db`. Not the hub, which has no business deciding who may write to someone else's disk. Not `node.toml` either: that file is hand-written and full of comments recording decisions, `ops.py` appends to it rather than round-tripping it through a writer, and a setting toggled from a panel must not rewrite the operator's file or need a restart. The value is cached in the group context because the upload path is synchronous, and the signed operation updates both — storing it without applying it would make the panel say one thing while the node did another. **Absent means allowed**, at every layer: no row in the table, no key in the context, no field in `handshake_ack`. An older node and an older client both behave exactly as before, and upgrading never silently closes a group. Each of those three has its own test, because they fail independently. The operator is always exempt — otherwise turning it off locks them out of their own node with a config file and a restart as the only way back. `is_node_admin` was being computed in two places by then and is now one function, since two copies of "is this the operator" is how the ack and the gate come to disagree. A change reaches everyone already connected via `member_upload_ack`, so the button goes without a reconnection. That message is both a broadcast and the reply to the request that caused it, which is why the client does not return early on it. Docs updated for a cold start: draft-v6 §2.1b and change 9, a new "Where Phase 13 stands" section in CLAUDE.md recording what is built, deployed and still missing, the module map row, and desktop-client-v1 §10b on the Settings tab and where group settings live. 883 tests pass. Co-Authored-By: Claude Opus 5 --- CLAUDE.md | 23 +++ docs/desktop-client-v1.md | 17 ++ docs/meshbay-draft-v6.md | 34 ++++ .../meshbay-common/src/meshbay_common/adminop.py | 4 + .../meshbay-common/src/meshbay_common/protocol.py | 2 + packages/meshbay-hub/src/meshbay_hub/static/app.js | 77 ++++++++- .../src/meshbay_hub/static/locales/de.js | 6 + .../src/meshbay_hub/static/locales/en.js | 6 + .../src/meshbay_hub/static/locales/es.js | 6 + .../src/meshbay_hub/static/locales/fr.js | 6 + .../src/meshbay_hub/static/locales/it.js | 6 + .../src/meshbay_hub/static/locales/ja.js | 6 + .../src/meshbay_hub/static/locales/nl.js | 6 + .../src/meshbay_hub/static/locales/pl.js | 6 + .../src/meshbay_hub/static/locales/pt-BR.js | 6 + .../src/meshbay_hub/static/locales/zh-CN.js | 6 + .../src/meshbay_hub/static/transport.js | 27 ++++ .../tests/test_upload_controls_hidden.py | 122 ++++++++++++++ packages/meshbay-node/src/meshbay_node/daemon.py | 7 + packages/meshbay-node/src/meshbay_node/roster.py | 57 +++++++ .../src/meshbay_node/transport/webrtc_server.py | 88 ++++++++++- .../tests/test_member_upload_policy.py | 176 +++++++++++++++++++++ 22 files changed, 691 insertions(+), 3 deletions(-) create mode 100644 packages/meshbay-hub/tests/test_upload_controls_hidden.py create mode 100644 packages/meshbay-node/tests/test_member_upload_policy.py diff --git a/CLAUDE.md b/CLAUDE.md index a5469a1..9f63595 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -246,6 +246,28 @@ keypair bundle, or anything that looks like a user's public key. the group named in the invitation (an operator pairs node-wide while opening a group) +## Where Phase 13 stands (2026-08-19) + +Stages A–D are **built and running**, not designed. `docs/desktop-client-v1.md` is still +the decision record; the sections below it describe what was decided, and this says what +exists. + +- Built: named roots, `ops.py` + CLI, device linking and hub device auth, the Electron + client (protocol handler, CSP header, `safeStorage` keys, streamed downloads to disk, + native folder picker), the group Settings tab, per-account resume positions, uploads + the operator can close +- Deployed: the hub runs MNP 0.3 with migration `e5a2b7d31f88`. **The SPA served in + production is older than this tree** — check `/a//` against + `meshbay_hub.api.webapp.ASSET_V` before concluding a fix is missing. `site/` and the + Caddy config have never been deployed +- Not built: D5 (node management panel), D6 (first-run wizard), D8 (`.deb`/`.rpm` — the + package must ship `chrome-sandbox` root-owned 4755), D9 (Python sidecar `group://`), + D10 (video thumbnails), D11 (Windows), D12 (release key and repo) +- One UI source: `packages/meshbay-hub/src/meshbay_hub/static/` is the interface, for the + web and the app alike. `packages/meshbay-client/build/sync-ui.js` copies it and CI + fails if the copy drifts — **never edit `packages/meshbay-client/ui/` by hand** +- Throwaway `e2e*` accounts accumulate on the production hub; the operator deletes them + ## Desktop client — decided, not built (2026-08-17) See `docs/desktop-client-v1.md`. Nothing here is implemented; it is the design and the @@ -685,6 +707,7 @@ SFR residential Fedora 44 → meshbay.org OVH VPS: | Streamed download (browser) | `static/downloads.js` + `static/sw.js` | Needs the page *controlled*, and the worker confirms it served the request | | Leave a group (hub) | `meshbay_hub.api.groups` | `POST /v1/groups/{id}/leave` — self only; the owner is refused | | Public group cap (hub) | `meshbay_hub.api.groups` | `_check_public_group_quota` — 10 live public groups per owner, staff exempt. **Checked at creation only, because PATCH refuses to change visibility** | +| Uploads on/off (node) | `meshbay_node.roster` + `transport.webrtc_server` | `member_upload_allowed` / `set_member_upload`, gate in `_do_file_upload`. Per group, **operator-signed** (`OP_MEMBER_UPLOAD`), stored in `roster.db`, cached in the group context because the upload path is synchronous. **Absent means allowed** at every layer | | Node presence (hub) | `meshbay_hub.api.groups` | `node_online` on `/v1/groups/mine`, read from the signaling registry — no poll, no timer | | Chat paging (node) | `meshbay_node.chat.store` | `get_recent` / `get_before` / `has_before`. `get_messages` pages *forwards* and is not what a chat opens with | | Liveness (MNP) | `meshbay_common.protocol` | `PING`/`PONG` on an **already-open** channel; never for discovery — a handshake costs 0.6-7 s | diff --git a/docs/desktop-client-v1.md b/docs/desktop-client-v1.md index c0bbb90..08dd548 100644 --- a/docs/desktop-client-v1.md +++ b/docs/desktop-client-v1.md @@ -1091,6 +1091,23 @@ Deletions enabled once native is the recommended client are unchanged from --- +## 10b. Group settings, and where they live + +The group tab that was "Members" is **"Settings"**, and it is where anything about the +group is administered: invitations, operator pairing, your devices on this node, whether +members may upload, leaving or deleting the group, and the roster — last, because it is +the only part with no upper bound. + +Two rules came out of building it and both are easy to undo by accident: + +- **The tab bar does not wait for the node.** Membership is hub-side. Gating the tab on a + live connection makes "leave this group" unreachable exactly when a node is down, which + is when someone most wants it. Sections that do need the node say so. +- **A setting that governs the node is stored on the node and enforced by the node.** + `member_upload` is the worked example: signed operator instruction, row in `roster.db`, + refusal in `_do_file_upload`. Hiding the Upload button and the chat paperclip is a + courtesy to people who are not trying; it is not the control. See draft-v6 §2.1b. + ## 11. Open items, each needing its own review | # | Item | Why it is not decided here | diff --git a/docs/meshbay-draft-v6.md b/docs/meshbay-draft-v6.md index 6a161cd..2ea73c4 100644 --- a/docs/meshbay-draft-v6.md +++ b/docs/meshbay-draft-v6.md @@ -42,6 +42,7 @@ | 6 | Portability | exFAT/NTFS and Windows are the **common** case. Case folding and Unicode normalization become correctness requirements, not compatibility notes | E8 / decision 12 | | 7 | Accounts | Native registration is **hybrid**: passphrase-derived `auth_key` (the recovery path) plus a device Ed25519 key for day-to-day authentication | E3 / decision 4 | | 8 | Authorship | Chat senders are **cryptographically authenticated to each other**; an upload has a **provable owner** who may delete it, as the operator may. v5's node-asserted attribution is replaced | operator decision, §2.4b | +| 9 | Node authority | The operator may **close uploading to everyone but themselves**, per group. Signed MNP op, stored on the node, enforced by the node — the hidden button is a courtesy, the refusal is the control | §2.1b | --- @@ -67,6 +68,39 @@ v5's rule that nothing derived is written beside the originals is **unchanged**, decides the video-thumbnail question: a frame grab is produced on demand and cached on the device that asked, so the node keeps no thumbnail store. +### 2.1b §5.2 Uploads — the operator may close them + +New. A group where every member may add files is the default and stays the default; +some groups want a library the operator curates, and until now the only way to get one +was to designate no upload root at all, which refuses the operator too. + +`member_upload` is a per-group setting, and three things about it are load-bearing: + +- **It lives on the node**, in `roster.db`, not in `node.toml` and not on the hub. Not + the hub because a hub that decides who may write to someone else's disk has authority + over that node, which is the arrangement this design exists to avoid (change 5). Not + `node.toml` because that file is hand-written, full of comments recording decisions, + and `ops.py` deliberately appends to it rather than round-tripping it through a + writer — a setting changed from a panel must not rewrite the operator's file, and must + not need a restart. +- **Changing it is a signed operator instruction** (`OP_MEMBER_UPLOAD`, MNP + `member_upload`), on the same path as removing a member. An unsigned one would let any + member turn it back on, which makes the control a suggestion. The transcript's subject + is `on` or `off` — what the operator is shown before signing has to name the outcome, + not the operation. +- **The node enforces it**; the interface merely stops offering it. `handshake_ack` + carries `member_upload` so a client knows whether to draw the Upload button and the + chat paperclip, and the node broadcasts `member_upload_ack` to everyone connected when + it changes. None of that is the control: a member on an old tab, or one speaking MNP + directly, is refused by the node with `member_upload_off`. + +**Absent means allowed**, at every layer — no row in `group_settings`, no key in the +group context, no field in the ack. A node or client that predates the setting behaves +exactly as it did, and an upgrade never silently closes a group. + +The operator is always exempt. Turning it off otherwise locks them out of their own +node, with a config file and a restart as the only way back. + ### 2.2 §5.5 Admission — devices, not one key per person v5 and `invite-pairing-v1.md` bind **one** key pair to an account per node: `identities` diff --git a/packages/meshbay-common/src/meshbay_common/adminop.py b/packages/meshbay-common/src/meshbay_common/adminop.py index 4e28f65..a793471 100644 --- a/packages/meshbay-common/src/meshbay_common/adminop.py +++ b/packages/meshbay-common/src/meshbay_common/adminop.py @@ -45,6 +45,10 @@ OP_MEMBER_REVOKE = "member_revoke" OP_GEK_ROTATE = "gek_rotate" # Forgetting a pinned identity, so someone can pair again after losing a device. OP_MEMBER_UNPIN = "member_unpin" +# Turning uploading by ordinary members on or off. Signed like the rest: the +# setting decides who may write to the operator's disk, so a node that took it +# from an unsigned message would let any member re-enable it for everyone. +OP_MEMBER_UPLOAD = "member_upload" # OP_GEK_BUNDLE_STORE is gone. Members no longer hand the node key material at # all: the node holds the GEK and wraps it itself, for a key the recipient proved # they hold (see `join.py` and docs/invite-pairing-v1.md). The operation existed diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py index bbdff63..1c6dd3e 100644 --- a/packages/meshbay-common/src/meshbay_common/protocol.py +++ b/packages/meshbay-common/src/meshbay_common/protocol.py @@ -78,6 +78,8 @@ class MNP: MEMBER_REVOKE_ACK = "member_revoke_ack" MEMBER_UNPIN = "member_unpin" # operator → node: forget an identity MEMBER_UNPIN_ACK = "member_unpin_ack" + MEMBER_UPLOAD = "member_upload" # operator → node: may members upload? + MEMBER_UPLOAD_ACK = "member_upload_ack" # Device linking. A new device files a request bound to a code it displays; # an already-pinned device of the same account approves it. Neither the hub # nor the node can produce the countersignature. diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js index 62bbfa5..0843d1d 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/app.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js @@ -1304,6 +1304,10 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth, const [nodeRoots, setNodeRoots] = useState([]); const [isNodeAdmin, setIsNodeAdmin] = useState(false); + // Whether ordinary members may upload here. The node decides and enforces it; + // this only says whether to offer the controls. Defaults to true so a node + // that predates the setting behaves as it always did. + const [memberUpload, setMemberUpload] = useState(true); // Paired ≠ operator account. `is_node_admin` says the hub account owning this // node is the one connecting; this says the node pinned *this browser's* key // as an operator key. Only the second one lets you sign an invite, and only @@ -1392,6 +1396,11 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth, _pendingJoinCode = null; if (cancelled) return; setIsNodeAdmin(!!ack.is_node_admin); + setMemberUpload(ack.member_upload !== false); + // Changed while we are connected, by an operator who may be someone + // else entirely. Without this the button stays until a reconnection, + // and a button that is still there is a button people press. + transport.onUploadPolicy = (allowed) => setMemberUpload(allowed); setOperatorPaired(transport.memberRole === 'operator'); // A first join to this node generated an identity for it; leave it with @@ -1792,6 +1801,10 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth, ? selectedFiles[0] : null; const deletableFiles = selectedFiles.filter( e => isNodeAdmin || (userId && e.uploader_id === userId)); + + // Asked in two places — the Files toolbar and the chat composer — so it is + // answered once. The operator is never locked out of their own node. + const mayUpload = memberUpload || isNodeAdmin; const run = (fn) => { setSelecting(false); setSelected(new Set()); @@ -1963,11 +1976,13 @@ function GroupPage({ groupId, group, token, username, userId, onRefreshAuth, ${tab === 'files' && status === 'connected' && html`
+ ${mayUpload && html` + `} ${canCreateDir && html`
`} + ${/* Operator only, and only with a live connection: the node is what + holds and enforces this, so there is nothing to show or change + without one. */ isNodeAdmin && connected && html` +
+

${t('members.uploads_title')}

+
+ + ${memberUpload ? t('members.uploads_on') : t('members.uploads_off')} + + +
+

${t('members.uploads_hint')}

+ ${uploadMsg && html`

${uploadMsg}

`} +
+ `} + ${connected && html`

${t('device.mine_title')}

@@ -2744,7 +2814,8 @@ function ChatImage({ filename, entries, transportRef, gekRef }) { return html`${filename}`; } -function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex, onPreview }) { +function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex, + onPreview, mayUpload = true }) { const [messages, setMessages] = useState([]); const [hasMore, setHasMore] = useState(false); const [loadingOlder, setLoadingOlder] = useState(false); @@ -3041,11 +3112,13 @@ function ChatPanel({ transportRef, username, entries, gekRef, onRefreshIndex, on `}
+ ${mayUpload && html` + `}