From e671b931fd594a39fc840916c81b5d4b1f1e3227 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sat, 12 Sep 2026 13:47:49 +0200 Subject: fix(hub): the mail allowance is written down, and recovery keeps a share MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two dicts in `mail.py` held the budget, so every deploy handed out a fresh one — and this hub is deployed several times a day. A bound a restart forgets is not a bound, for the reason the denylist is persisted rather than held in memory (S3). It is a `mail_quota` table now, one row per counter, the recipient hashed so the table does not become a list of plaintext addresses. The counting moves with it, into an async `reserve` that has a session, and `send_off_loop` is the one door it stands in. `_send` keeps the purpose allow-list: that half needs no state, and it is what stops anything which puts a message on the wire from naming a reason this hub does not send for. The caller owns the commit, so a request that fails afterwards is not charged for mail nobody received. `hourly_reserved_for_recovery` is new. A flood of sign-ups used to be able to spend the whole hour and lock out the person waiting on a passphrase reset; registration and address changes may now spend only the unreserved share. Values changed as agreed: 10 messages a day to one recipient, 300 s between two reset codes. The address-change ceiling and its cooldown were two bounds on one thing — 3 a day and 60 s apart — and collapse into one 48-hour delay. Asking again for the address already pending is exempt: it reaches no new recipient, that recipient is bounded anyway, and without the exemption a typo locked the account out of correcting it for two days. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01T4YmK41VsEURWFdop4EEeT --- .../versions/e5f6a7b8c9d0_add_mail_quota.py | 36 ++++++++++++++++++++++ packages/meshbay-hub/src/meshbay_hub/db/models.py | 22 +++++++++++++ 2 files changed, 58 insertions(+) create mode 100644 packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/e5f6a7b8c9d0_add_mail_quota.py (limited to 'packages/meshbay-hub/src/meshbay_hub/db') diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/e5f6a7b8c9d0_add_mail_quota.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/e5f6a7b8c9d0_add_mail_quota.py new file mode 100644 index 0000000..8f2e4d2 --- /dev/null +++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/e5f6a7b8c9d0_add_mail_quota.py @@ -0,0 +1,36 @@ +"""add mail_quota + +The hub's outbound mail allowance, kept across restarts. It lived in two +dicts in `mail.py`, so every deploy handed out a fresh budget — and the hub is +deployed often. A bound a restart forgets is not a bound. + +Revision ID: e5f6a7b8c9d0 +Revises: d4e5f6a7b8c9 +""" + +from typing import Sequence, Union + +import sqlalchemy as sa +from alembic import op + +revision: str = "e5f6a7b8c9d0" +down_revision: Union[str, Sequence[str], None] = "d4e5f6a7b8c9" +branch_labels: Union[str, Sequence[str], None] = None +depends_on: Union[str, Sequence[str], None] = None + + +def upgrade() -> None: + op.create_table( + "mail_quota", + sa.Column("key", sa.String(64), primary_key=True), + sa.Column("window_start", sa.DateTime(timezone=True), nullable=False), + sa.Column("count", sa.Integer(), nullable=False, server_default="0"), + sa.Column("last_sent", sa.DateTime(timezone=True), nullable=True), + ) + + +def downgrade() -> None: + # Dropping this returns the hub to sending with no recorded history, not to + # sending without a bound: the limits themselves live in `hub_settings` and + # in the configuration file. + op.drop_table("mail_quota") diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py index e6c7d33..b052e00 100644 --- a/packages/meshbay-hub/src/meshbay_hub/db/models.py +++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py @@ -308,6 +308,28 @@ class UserPreference(Base): value: Mapped[str] = mapped_column(Text, nullable=False) +class MailQuota(Base): + """How much mail has gone where, kept across restarts. + + This was a pair of dicts in `mail.py`, which meant a restart handed out a + fresh allowance — and a hub restarts whenever it is deployed. A budget a + restart forgets is not a budget, for the same reason the denylist is + persisted rather than held in memory (S3). + + One row per thing being counted: + `hour` the instance's hourly total + `dest:` one recipient, hashed — this table must not become a + list of plaintext addresses (S2) + """ + + __tablename__ = "mail_quota" + + key: Mapped[str] = mapped_column(String(64), primary_key=True) + window_start: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now) + count: Mapped[int] = mapped_column(Integer, default=0) + last_sent: Mapped[datetime | None] = mapped_column(DateTime(timezone=True)) + + class HubSetting(Base): """ Instance-wide settings an admin changes at runtime from the panel. -- cgit v1.2.3