From fb91c4545c757711e1b5fd354ca4b311c89fd2c0 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sun, 9 Aug 2026 04:39:34 +0200 Subject: feat(hub): add production hub — config, auth, API routers, tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit config.py: TOML + env var priority. auth.py: Argon2id passwords, JWT EdDSA with jti, refresh token hashed (blake3). Routers: hub (info/pubkey), users (register/login/refresh/pubkeys), nodes (announce/get), groups (create/gek-bundle/gek-retrieve). Rate limiting via slowapi. app.py factory with lifespan. All 40 tests pass (SQLite in-memory, no PostgreSQL required). Fix: remove tests/__init__.py to resolve namespace conflicts. Co-Authored-By: Claude Sonnet 4.6 (1M context) --- packages/meshbay-hub/src/meshbay_hub/api/middleware.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 packages/meshbay-hub/src/meshbay_hub/api/middleware.py (limited to 'packages/meshbay-hub/src/meshbay_hub/api/middleware.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/api/middleware.py b/packages/meshbay-hub/src/meshbay_hub/api/middleware.py new file mode 100644 index 0000000..bed7b54 --- /dev/null +++ b/packages/meshbay-hub/src/meshbay_hub/api/middleware.py @@ -0,0 +1,13 @@ +""" +Hub middleware — rate limiting on auth endpoints. + +Uses slowapi (Starlette-compatible, token bucket algorithm). +Limits applied to /v1/users/register and /v1/users/login +to mitigate credential stuffing and registration floods. +""" + +from slowapi import Limiter +from slowapi.util import get_remote_address + +# Rate limiter instance — mounted on the FastAPI app in app.py +limiter = Limiter(key_func=get_remote_address) -- cgit v1.2.3