From 1a53eb4cc404ec94658fde0ae04cfe2ccf1810dc Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 10 Aug 2026 03:57:55 +0200 Subject: feat(hub): Phase 8 — Hub v2 security hardening + production readiness MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 8.1 Config-based admin authz (require_admin on all admin endpoints) 8.2 Email encrypted at rest (AES-256-GCM, HKDF from hub Ed25519 key) 8.3 Refresh token rotation with family-based reuse detection 8.4 Federation persistence (HubPeer model replaces in-memory dict) 8.5 Federation token verification now async (DB-backed) 8.6 CSAM hash check wired into swarm registration flow 8.7 Rate limiting on auth endpoints (5/10/20 per minute) 8.8 Healthcheck endpoint (GET /v1/health, no auth) 8.9 IP log cleanup background task (365-day retention) 8.10 Argon2id params bumped to 256 MB (pw_version, rehash on login) Deployed to meshbay.org — schema migrated, existing emails encrypted. 117 tests pass (29 hub, 88 common+node). Resolves security review items S1, S2, S5. Co-Authored-By: Claude Opus 4.6 --- packages/meshbay-hub/src/meshbay_hub/api/moderation.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/api/moderation.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/api/moderation.py b/packages/meshbay-hub/src/meshbay_hub/api/moderation.py index a8bf84f..6bb007b 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/moderation.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/moderation.py @@ -27,7 +27,7 @@ from pydantic import BaseModel from sqlalchemy import func, select from sqlalchemy.ext.asyncio import AsyncSession -from meshbay_hub.api.deps import get_current_user +from meshbay_hub.api.deps import get_current_user, require_admin from meshbay_hub.db.engine import get_db from meshbay_hub.db.models import ContentBlocklist, ContentReport, User @@ -138,7 +138,7 @@ async def get_blocklist( @router.get("/v1/admin/blocklist") async def admin_list_blocklist( - current_user: User = Depends(get_current_user), + current_user: User = Depends(require_admin), db: AsyncSession = Depends(get_db), limit: int = 500, ): @@ -164,7 +164,7 @@ async def admin_list_blocklist( @router.post("/v1/admin/blocklist", status_code=201) async def admin_add_blocklist( body: BlocklistAddRequest, - current_user: User = Depends(get_current_user), + current_user: User = Depends(require_admin), db: AsyncSession = Depends(get_db), ): existing = await db.get(ContentBlocklist, body.content_hash) @@ -183,7 +183,7 @@ async def admin_add_blocklist( @router.delete("/v1/admin/blocklist/{content_hash}", status_code=200) async def admin_remove_blocklist( content_hash: str, - current_user: User = Depends(get_current_user), + current_user: User = Depends(require_admin), db: AsyncSession = Depends(get_db), ): entry = await db.get(ContentBlocklist, content_hash) -- cgit v1.2.3