From 8926f163dad9d32dc06c3a142658a4e11d9c12c1 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 30 Sep 2026 15:48:51 +0200 Subject: refactor(hub): the transport holds an identity, never a private key Two public keys, sign() and shared(); the apps take transport.signFn. What holds the keys (this page, or the desktop main process) is the identity's business alone. Co-Authored-By: Claude Opus 5.5 --- .../src/meshbay_hub/static/group-settings.js | 34 +++++----------------- 1 file changed, 8 insertions(+), 26 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/static/group-settings.js') diff --git a/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js b/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js index f16bdf8..bde218b 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/group-settings.js @@ -450,12 +450,9 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef, // every render is a new prop identity every render, and the callbacks that // close over it in the table below are memoised on it. const adminSignFn = useCallback((transcript) => { - const sk = transportRef.current && transportRef.current.sessionKeys - && transportRef.current.sessionKeys.skEdB64; - if (!sk || !window.MeshBayKeys) { - throw new Error(t('node.root_no_signing_key')); - } - return window.MeshBayKeys.signBytes(sk, transcript); + const sign = transportRef.current && transportRef.current.signFn; + if (!sign) throw new Error(t('node.root_no_signing_key')); + return sign(transcript); }, [transportRef]); const loadNodeInfo = useCallback(async () => { @@ -608,10 +605,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef, if (!transport || !transport.connected) { throw new Error('Not connected to the node'); } - const sk = transport.sessionKeys && transport.sessionKeys.skEdB64; - const signFn = (sk && window.MeshBayKeys) - ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript) - : null; + const signFn = transport.signFn; await transport.setAppsEnabled(next, signFn); if (onEnabledApps) onEnabledApps(next); } catch (err) { @@ -648,10 +642,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef, if (!transport || !transport.connected) { throw new Error('Not connected to the node'); } - const sk = transport.sessionKeys && transport.sessionKeys.skEdB64; - const signFn = (sk && window.MeshBayKeys) - ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript) - : null; + const signFn = transport.signFn; await transport.setScanSettings(reconcileMinutes * 60, debounceSeconds, signFn); const applied = { reconcile_interval_secs: reconcileMinutes * 60, @@ -779,10 +770,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef, await platform.node.op('revokeMember', { userId: member.user_id, groupId }); } catch { /* best effort — node may not host this group */ } } else if (transport && transport.connected && operatorPaired) { - const sk = transport.sessionKeys && transport.sessionKeys.skEdB64; - const signFn = (sk && window.MeshBayKeys) - ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript) - : null; + const signFn = transport.signFn; try { await transport.revokeMember(member.user_id, signFn); } catch (err) { nodeError = err.message; } @@ -878,10 +866,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef, // Signed with the identity this node pinned for us — the only one it // will accept, and the only one we hold here. - const sk = transport.sessionKeys && transport.sessionKeys.skEdB64; - const signFn = (sk && window.MeshBayKeys) - ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript) - : null; + const signFn = transport.signFn; const result = await transport.createInvite( account.user_id, groupId, username, signFn); @@ -939,10 +924,7 @@ function GroupSettingsPanel({ groupId, group, token, transportRef, gekRef, const linkSignFn = useCallback(() => { const transport = transportRef && transportRef.current; - const sk = transport && transport.sessionKeys && transport.sessionKeys.skEdB64; - return (sk && window.MeshBayKeys) - ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript) - : null; + return (transport && transport.signFn) || null; }, [transportRef]); // A redeemed link is not shown: whoever used it is in the members list above, -- cgit v1.2.3