From 8cd7e467ebec987f66c4fe93a8d87dfbc57304d2 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sat, 15 Aug 2026 12:19:22 +0200 Subject: feat(files): download a folder as a zip, and remove an empty one MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two things a Files panel needs and did not have. **Removing a directory** is privileged, where creating one is not: it acts on a name other members are using, on the operator's disk. It is refused unless the directory is empty, and that rule is the safety property — whatever the browser sends, this cannot destroy content. The check runs twice, once before the challenge and once after the signature comes back, because a file can land during the round trip. A file also accepts its uploader's key; a directory has no uploader, so only the operator's key will do. **Downloading a folder** produces a zip built in the browser, written straight to disk as the chunks arrive. An archive of a group folder is routinely tens of gigabytes, so nothing is held: peak memory is one chunk plus a small record per file. The node is not involved at all — it serves the same encrypted chunks as any other download, holds no temporary files, and cannot be asked to compress anything. zipstream.js is store-only. Group content is video and images, already compressed, so deflate would spend CPU on every byte to save nothing, in the thread that is also decrypting. Sizes and CRCs go in a data descriptor after each file because a stream cannot seek back to patch a header, and zip64 kicks in per entry past 4 GiB and for the archive itself. Because none of that can be checked from the Python side of the house, test_zipstream.py runs the real module under Node and reads what it produces with zipfile — CRCs, UTF-8 names, zip64 records and all. The archives also pass `unzip -t`. Firefox and Safari have no File System Access API, so there is nowhere to stream to: the fallback builds the archive in memory and says so, with the size, before starting rather than after failing. One mistake worth recording: the first version of deleteDirectory passed the node's own answer as the value to check the challenge against, which turns the comparison into a tautology. It checks the path we asked for. Co-Authored-By: Claude Opus 5 --- docs/meshbay-draft-v5.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'docs/meshbay-draft-v5.md') diff --git a/docs/meshbay-draft-v5.md b/docs/meshbay-draft-v5.md index a8b7e4b..b03328b 100644 --- a/docs/meshbay-draft-v5.md +++ b/docs/meshbay-draft-v5.md @@ -250,6 +250,25 @@ version accepted a client-chosen path and overwrote whatever was there, which de deletion authorization as well: overwriting a file made the attacker its recorded uploader, and therefore the party allowed to delete it (C5a). +### 5.2b Removing a directory + +Creating a directory is not privileged (§5.2); removing one is, and it is refused +unless the directory is empty. The emptiness rule is the safety property: whatever +the caller intended, and whatever the browser sent, this operation cannot destroy +content. It is checked twice — once before the challenge is issued, and again +after the signature comes back, because a file can land during the round trip to +the operator's browser. + +Authorized by `_verify_admin_sig` alone. A file also accepts its uploader's key, +since the node recorded who put it there; a directory has no uploader, so there is +no second key to accept. + +Archives are not the node's business: a member downloading a folder as a zip +fetches the same encrypted chunks as any other download and assembles the archive +in the browser. The node serves no bundles, holds no temporary files, and cannot +be asked to compress anything — one fewer place where a request turns into work +on someone else's disk. + ### 5.3 Operator interface Two personas, and they need different tools: -- cgit v1.2.3