From 1a53eb4cc404ec94658fde0ae04cfe2ccf1810dc Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 10 Aug 2026 03:57:55 +0200 Subject: feat(hub): Phase 8 — Hub v2 security hardening + production readiness MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 8.1 Config-based admin authz (require_admin on all admin endpoints) 8.2 Email encrypted at rest (AES-256-GCM, HKDF from hub Ed25519 key) 8.3 Refresh token rotation with family-based reuse detection 8.4 Federation persistence (HubPeer model replaces in-memory dict) 8.5 Federation token verification now async (DB-backed) 8.6 CSAM hash check wired into swarm registration flow 8.7 Rate limiting on auth endpoints (5/10/20 per minute) 8.8 Healthcheck endpoint (GET /v1/health, no auth) 8.9 IP log cleanup background task (365-day retention) 8.10 Argon2id params bumped to 256 MB (pw_version, rehash on login) Deployed to meshbay.org — schema migrated, existing emails encrypted. 117 tests pass (29 hub, 88 common+node). Resolves security review items S1, S2, S5. Co-Authored-By: Claude Opus 4.6 --- packages/meshbay-hub/src/meshbay_hub/db/models.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/db') diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py index 2aeae41..c0b0491 100644 --- a/packages/meshbay-hub/src/meshbay_hub/db/models.py +++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py @@ -42,6 +42,7 @@ class User(Base): email: Mapped[str] = mapped_column(String(256), nullable=False) # kept for recovery pw_hash: Mapped[bytes] = mapped_column(nullable=False) pw_salt: Mapped[bytes] = mapped_column(nullable=False) + pw_version: Mapped[int] = mapped_column(Integer, default=1) pk_ed25519: Mapped[str] = mapped_column(String(64), nullable=False) # base64 raw 32B pk_x25519: Mapped[str] = mapped_column(String(64), nullable=False) # base64 raw 32B hub_id: Mapped[str] = mapped_column(String(128), nullable=False) @@ -132,17 +133,31 @@ class RefreshToken(Base): id: Mapped[str] = mapped_column(String(36), primary_key=True, default=_uuid) user_id: Mapped[str] = mapped_column(ForeignKey("users.id"), nullable=False) token_hash: Mapped[str] = mapped_column(String(64), unique=True, nullable=False) # blake3 hex + family_id: Mapped[str] = mapped_column(String(36), nullable=False, default=_uuid) expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False) created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now) revoked: Mapped[bool] = mapped_column(Boolean, default=False) user: Mapped["User"] = relationship(back_populates="refresh_tokens") - __table_args__ = (Index("ix_refresh_tokens_hash", "token_hash"),) + __table_args__ = ( + Index("ix_refresh_tokens_hash", "token_hash"), + Index("ix_refresh_tokens_family", "family_id"), + ) # ── IP logs (legal compliance) ──────────────────────────────────────────────── +class HubPeer(Base): + """Trusted peer hub for MHP federation.""" + __tablename__ = "hub_peers" + + hub_id: Mapped[str] = mapped_column(String(128), primary_key=True) + hub_url: Mapped[str] = mapped_column(String(256), nullable=False) + pk_hub_pem: Mapped[str] = mapped_column(Text, nullable=False) + trusted_since: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now) + + class FederatedGroup(Base): """ Groups received from peer hubs via MHP federation. -- cgit v1.2.3