From 998f9c69308ee88fac36cfb77dfb6d07c6fa926a Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 23 Sep 2026 17:46:48 +0200 Subject: feat(hub): invitation-link tickets bound to a verified address MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit group_invite_links holds sha256(ticket) and the invitee's address blind index; redeeming grants membership to that account only. Owner-only create/list/cancel (a node token may create, never mail), 20 outstanding per group, optional mail written by the hub itself and capped at 10 per sender per day (mail.invite_link_daily_cap). MESHBAY_DESIGN.md ยง3.4 now carries the whole link design. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/tasks') diff --git a/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py b/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py index 1ef7796..b0ef4d4 100644 --- a/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py +++ b/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py @@ -7,7 +7,7 @@ from datetime import UTC, datetime, timedelta from sqlalchemy import delete, select from sqlalchemy.ext.asyncio import AsyncSession -from meshbay_hub.db.models import EmailVerification, Group, IPLog, User +from meshbay_hub.db.models import EmailVerification, Group, GroupInviteLink, IPLog, User log = logging.getLogger(__name__) @@ -42,6 +42,17 @@ async def purge_stale_pending_users(db: AsyncSession, return result.rowcount +async def purge_invite_links(db: AsyncSession) -> int: + """Unused invitation links once expired; used ones after a month.""" + from meshbay_hub.api.invite_links import KEEP_REDEEMED + now = datetime.now(UTC) + result = await db.execute(delete(GroupInviteLink).where( + (GroupInviteLink.redeemed_by.is_(None) & (GroupInviteLink.expires_at <= now)) + | (GroupInviteLink.redeemed_at < now - KEEP_REDEEMED))) + await db.commit() + return result.rowcount + + async def cleanup_loop(get_session): """Run cleanup once at startup, then every 24 hours.""" try: @@ -71,6 +82,9 @@ async def cleanup_loop(get_session): throttled = await login_throttle.purge_expired(db) if throttled: log.info("Purged %d expired sign-in counters", throttled) + links = await purge_invite_links(db) + if links: + log.info("Purged %d spent or expired invitation links", links) except asyncio.CancelledError: raise except Exception as e: -- cgit v1.2.3