From 1a53eb4cc404ec94658fde0ae04cfe2ccf1810dc Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 10 Aug 2026 03:57:55 +0200 Subject: feat(hub): Phase 8 — Hub v2 security hardening + production readiness MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 8.1 Config-based admin authz (require_admin on all admin endpoints) 8.2 Email encrypted at rest (AES-256-GCM, HKDF from hub Ed25519 key) 8.3 Refresh token rotation with family-based reuse detection 8.4 Federation persistence (HubPeer model replaces in-memory dict) 8.5 Federation token verification now async (DB-backed) 8.6 CSAM hash check wired into swarm registration flow 8.7 Rate limiting on auth endpoints (5/10/20 per minute) 8.8 Healthcheck endpoint (GET /v1/health, no auth) 8.9 IP log cleanup background task (365-day retention) 8.10 Argon2id params bumped to 256 MB (pw_version, rehash on login) Deployed to meshbay.org — schema migrated, existing emails encrypted. 117 tests pass (29 hub, 88 common+node). Resolves security review items S1, S2, S5. Co-Authored-By: Claude Opus 4.6 --- packages/meshbay-hub/src/meshbay_hub/app.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'packages/meshbay-hub/src/meshbay_hub/app.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/app.py b/packages/meshbay-hub/src/meshbay_hub/app.py index 1c494fa..c80da28 100644 --- a/packages/meshbay-hub/src/meshbay_hub/app.py +++ b/packages/meshbay-hub/src/meshbay_hub/app.py @@ -9,6 +9,7 @@ Usage: app = create_app(cfg) """ +import asyncio from contextlib import asynccontextmanager from pathlib import Path @@ -22,12 +23,14 @@ from meshbay_hub.config import HubConfig from meshbay_hub.db.engine import close_db, init_db from meshbay_hub.api.hub import router as hub_router from meshbay_hub.api.users import router as users_router, set_config as users_set_config +from meshbay_hub.api.deps import set_admin_usernames from meshbay_hub.api.nodes import router as nodes_router from meshbay_hub.api.groups import router as groups_router from meshbay_hub.api.revocation import router as revocation_router from meshbay_hub.api.moderation import router as moderation_router from meshbay_hub.api.federation import router as federation_router from meshbay_hub.csam import csam_router +from meshbay_hub.api.health import router as health_router from meshbay_hub.api.relay import router as relay_router from meshbay_hub.api.webapp import router as webapp_router from meshbay_hub.api.middleware import limiter @@ -48,9 +51,23 @@ def create_app(cfg: HubConfig | None = None) -> FastAPI: generate_hub_keypair(kp) load_hub_keypair(kp, cfg.identity.id) users_set_config(cfg) + set_admin_usernames(cfg.identity.admin_usernames) + + from meshbay_hub.csam import get_csam_checker + get_csam_checker().load() + + from meshbay_hub.tasks.cleanup import cleanup_loop + from meshbay_hub.db.engine import get_session_factory + cleanup_task = asyncio.create_task(cleanup_loop(get_session_factory())) yield + cleanup_task.cancel() + try: + await cleanup_task + except asyncio.CancelledError: + pass + # Shutdown await close_db() @@ -74,6 +91,7 @@ def create_app(cfg: HubConfig | None = None) -> FastAPI: app.include_router(moderation_router) app.include_router(federation_router) app.include_router(csam_router) + app.include_router(health_router) app.include_router(relay_router) app.include_router(webapp_router) -- cgit v1.2.3