From 4500fe3854fd3a499d1139bc89ccc488d104cc29 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sat, 26 Sep 2026 02:44:52 +0200 Subject: fix(hub): the NAT-punch signal needs a shared active group, like the offer relay MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit POST /v1/nodes/{id}/incoming checked only the caller's own address, then revealed whether the node was connected (404 vs 504) and, with QUIC on, made it punch โ€” so any authenticated account could poll it for a node's liveness or make a stranger's node emit a UDP probe. The membership gate webrtc_offer did inline is now require_shared_active_group() in api/signaling.py, called by both routes; in notify_incoming it runs before anything depends on the node's connection state, so a non-member gets one uniform 403 whether the node is up or not. test_incoming_membership.py holds it (a non-member is refused with a membership 403 whether the node is connected or not; a member passes the gate); red before, green after. The offer relay is unchanged in behaviour (it now calls the shared helper); signaling/availability suites pass. Design ยง7.2 updated. Co-Authored-By: Claude Opus 4.8 --- docs/MESHBAY_DESIGN.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'docs/MESHBAY_DESIGN.md') diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index baef40d..4daa094 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1819,7 +1819,10 @@ groups from a client (**NS7**). Signaling is rate-limited, SDP-size bounded, capped per user, and **the caller must share an active group with the target node**. Otherwise any authenticated user could make a third party's machine allocate peer connections on demand (**H6**). -The address in a NAT-punch request must match the caller's source address. +The NAT-punch signal shares the offer relay's gate โ€” the caller must share an +active group with the node, checked before anything reveals whether the node is +connected, so it is no liveness oracle โ€” and the address it names must match the +caller's own source address. **The offer ceilings bound a member and never an ordinary one** (**AV30**). They are sized against an account with twenty groups on three devices, because a -- cgit v1.2.3