From 4b3e8c3b8b9d10c8ac333dd8db614a7569052472 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 10 Aug 2026 03:07:56 +0200 Subject: feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Implements all 8 milestones (7.0-7.7): - 7.0: JWT carries `groups` claim; node verifies group membership at MNP handshake (QUIC + TCP+TLS). Resolves security review C2. - 7.1: QUIC 0-RTT session resumption via stored session tickets (17-21ms reconnect vs 47ms cold). - 7.2: Hub→node WebSocket signaling for NAT punch coordination (`client_incoming`/`punch_ready`) + jti denylist push. Denylist class blocks revoked users/jtis at handshake. - 7.3: Multi-group daemon — one QUIC port serves N groups with per-group GEK, shared_root, and index routing. - 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg segment extraction). - 7.5: Sender Keys protocol for group chat (Signal Groups approach). Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM encryption, Ed25519 signing. Resolves security review C1. - 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type with peer broadcast, web UI with WebSocket push. - 7.7: Argon2id calibration CLI. First security review included (first-review.md). 109 tests, demo-v3 validated against meshbay.org production hub. Co-Authored-By: Claude Opus 4.6 --- packages/meshbay-hub/src/meshbay_hub/api/users.py | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/api/users.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py index 5a7a3b4..5a2c7be 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/users.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py @@ -18,7 +18,7 @@ from meshbay_hub.auth import ( ) from meshbay_hub.config import HubConfig from meshbay_hub.db.engine import get_db -from meshbay_hub.db.models import IPLog, RefreshToken, User +from meshbay_hub.db.models import GroupMember, IPLog, RefreshToken, User from meshbay_hub.api.deps import get_current_user router = APIRouter(prefix="/v1/users", tags=["users"]) @@ -136,7 +136,11 @@ async def login( if user.status != "active": raise HTTPException(status_code=403, detail=f"Account {user.status}") - access_token = issue_access_token(user.id, user.pk_ed25519, ttl=_ttl()) + memberships = await db.execute( + select(GroupMember.group_id).where(GroupMember.user_id == user.id)) + group_ids = [gid for (gid,) in memberships.all()] + access_token = issue_access_token( + user.id, user.pk_ed25519, ttl=_ttl(), groups=group_ids) raw_rt, rt_hash = generate_refresh_token() expires_at = datetime.now(timezone.utc) + timedelta(seconds=_refresh_ttl()) @@ -175,7 +179,11 @@ async def token_refresh( if not user or user.status != "active": raise HTTPException(status_code=401, detail="User not found or suspended") - new_token = issue_access_token(user.id, user.pk_ed25519, ttl=_ttl()) + memberships = await db.execute( + select(GroupMember.group_id).where(GroupMember.user_id == user.id)) + group_ids = [gid for (gid,) in memberships.all()] + new_token = issue_access_token( + user.id, user.pk_ed25519, ttl=_ttl(), groups=group_ids) return {"access_token": new_token, "token_type": "bearer", "expires_in": _ttl()} -- cgit v1.2.3