From d3ad243c4ae3a273f623bd5fc631e3266aa4d0e4 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 30 Sep 2026 11:49:56 +0200 Subject: fix: only the owner decides who hosts a group, and nobody is made a member unasked MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - hub: a node may host a group only if its account owns it or the owner approved that node (new `group_hosts`). Membership was the ceiling, and every member holds the group key, so any member's node could register as a host and be the one clients kept. A node claiming a group it may not host is recorded as a request; the owner is notified once and approves or refuses it (GET/POST/DELETE /v1/groups/{id}/hosts[/{node_id}]), which takes effect on a connected node at once. - hub: an owner adding a username creates an invitation (new `group_invitations`), accepted or declined by the invitee (/v1/groups/invitations, /{id}/invitation/accept|decline). Until then the group is not listed, not dialled, not searched and not in any token. Invitation links, open joins and group creation still make members directly: they are the account's own act. - hub: the MNP token names only the group it is minted for (group_id is now required), so a node operator no longer learns a member's other groups. - SPA: invitations on the home page; invited people and host requests in the group's settings; the transport sends group_id. Ten catalogues. - Browser probes for both screens, run in Chrome and Firefox. - Design §5.2, §7.2, §7.3, AV32, AV33; protocol §6.3; user guide. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/src/meshbay_hub/api/nodes.py | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/api/nodes.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py index 403f450..decd20e 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/nodes.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/nodes.py @@ -26,6 +26,10 @@ class MnpTokenRequest(BaseModel): # to it (E10), so it cannot be replayed to another node. The client knows it # from `/v1/groups/{id}/nodes` before it connects. node_pk: str = "" + # The one group this connection is for. The token names that group and no + # other: it is handed to the node's operator, who has no business learning + # every other group the member belongs to. + group_id: str = "" @router.post("/mnp-token") @@ -50,11 +54,16 @@ async def mnp_token( only *restricts* the token to whatever node holds that key, which is the one the client is connecting to; a wrong key yields a token no node will accept. """ - rows = await db.execute( - select(GroupMember.group_id).where(GroupMember.user_id == current_user.id)) - group_ids = [gid for (gid,) in rows.all()] + group_id = (body.group_id if body else "").strip() + if not group_id: + raise HTTPException(status_code=422, + detail="Name the group this connection is for (group_id)") + member = await db.get(GroupMember, (group_id, current_user.id)) return { - "mnp_token": issue_mnp_token(current_user.id, groups=group_ids, + # Empty when the account is not a member: the node then refuses with + # `not_a_member`, which is the answer that case has always had. + "mnp_token": issue_mnp_token(current_user.id, + groups=[group_id] if member else [], node_pk=(body.node_pk if body else "")), "expires_in": 900, } -- cgit v1.2.3