From 2e9490ca27047ae03e495d397abbe1aec1b2273a Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 20 Aug 2026 22:21:19 +0200 Subject: feat: unified group management, public groups, and activity-based sidebar MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Create Group wizard (Electron-only) consolidates 6 steps across 4 interfaces into a single multi-step page: group creation on hub, node attachment, root selection via folder picker, GEK initialization, and auto-pairing — all in one flow. Browser SPA keeps its current behavior unchanged. Public group support (Option A — GEK for all groups): - All groups have GEK regardless of visibility; open-join groups auto-admit via TOFU when join_policy is "open" - Key rotation blocked for public groups (API guard + UI hidden) - Hub signaling allows WebRTC offers for nodes hosting open-join groups even when the caller isn't a member yet - attach_group writes join_policy to node.toml - Daemon loads GEK for all groups, not just private ones - Known-device path in join_request now auto-admits to open-join groups Node loopback API bridge (Electron IPC): - node:detect, node:call, node:pairing-code IPC handlers in main process - Renderer never sees tokens, paths, or keys (session token = physical access) - platform.js node namespace for UI consumption - Loopback endpoints: roots CRUD, member-upload toggle, reload Bug fixes: - Root change detection: removed premature ctx["roots"] updates from add_root and remove_root that prevented indexer retarget on reload - Duplicate offline message: global fallback now gated on !group - Signaling membership check: fallback to open-join groups for non-members Sidebar groups sorted by last_activity_at (most recent first): - New Group.last_activity_at column with Alembic migration - POST /v1/groups/{id}/activity endpoint, called on connect and chat send - Client-side sort + throttled hub updates (1/min) Co-Authored-By: Claude Opus 4.6 --- packages/meshbay-hub/src/meshbay_hub/api/groups.py | 28 +- .../meshbay-hub/src/meshbay_hub/api/revocation.py | 5 + .../meshbay-hub/src/meshbay_hub/api/signaling.py | 23 +- .../a7b8c9d0e1f2_add_group_last_activity.py | 28 ++ packages/meshbay-hub/src/meshbay_hub/db/models.py | 4 +- packages/meshbay-hub/src/meshbay_hub/static/app.js | 501 +++++++++++++++++++-- .../src/meshbay_hub/static/locales/en.js | 33 +- .../src/meshbay_hub/static/locales/fr.js | 2 +- .../meshbay-hub/src/meshbay_hub/static/platform.js | 31 +- .../meshbay-hub/src/meshbay_hub/static/style.css | 68 +++ 10 files changed, 675 insertions(+), 48 deletions(-) create mode 100644 packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7b8c9d0e1f2_add_group_last_activity.py (limited to 'packages/meshbay-hub/src') diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py index 6819ff6..65307f1 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py @@ -2,7 +2,8 @@ from fastapi import APIRouter, Depends, HTTPException, Request from pydantic import BaseModel -from sqlalchemy import func, or_, select +from datetime import datetime, timezone +from sqlalchemy import func, or_, select, update from sqlalchemy.ext.asyncio import AsyncSession from meshbay_hub.api.deps import get_current_user, require_user_scope @@ -36,7 +37,7 @@ async def my_groups( # added to it before a node exists would see a name they cannot # open and cannot be told why. or_(Group.hosted_at.is_not(None), Group.admin_id == current_user.id)) - .order_by(Group.name) + .order_by(Group.last_activity_at.desc()) ) groups = result.scalars().all() muted_rows = await db.execute( @@ -63,12 +64,35 @@ async def my_groups( # which is the evidence that actually concerns the user. "node_online": bool(get_online_nodes_for_group(g.id)), "hosted": g.hosted_at is not None, + "last_activity_at": g.last_activity_at.isoformat(), } for g in groups ] } +@router.post("/{group_id}/activity") +async def touch_group_activity( + group_id: str, + current_user: User = Depends(get_current_user), + db: AsyncSession = Depends(get_db), +): + """Bump a group's last_activity_at. Called by the client on chat/file events.""" + result = await db.execute( + select(GroupMember.group_id).where( + GroupMember.group_id == group_id, + GroupMember.user_id == current_user.id, + )) + if not result.first(): + raise HTTPException(status_code=403, detail="Not a member") + await db.execute( + update(Group) + .where(Group.id == group_id) + .values(last_activity_at=datetime.now(timezone.utc))) + await db.commit() + return {"ok": True} + + @router.get("/{group_id}/nodes") async def group_online_nodes( group_id: str, diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py index d555f9f..003e396 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py @@ -285,6 +285,11 @@ async def node_websocket(ws: WebSocket): elif msg.get("type") == "webrtc_answer": from meshbay_hub.api.signaling import handle_webrtc_answer handle_webrtc_answer(msg) + elif msg.get("type") == "update_groups": + new_gids = msg.get("group_ids", []) + _node_groups[node_id] = new_gids + await _mark_hosted(new_gids) + log.info("Node %s updated groups: %d", node_id[:8], len(new_gids)) elif msg.get("type") == "chat_notify": asyncio.ensure_future(_handle_chat_notify( msg.get("group_id", ""), diff --git a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py index cb00a67..84c1167 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/signaling.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/signaling.py @@ -90,7 +90,9 @@ async def webrtc_offer( if not ws: raise HTTPException(status_code=404, detail="Node not connected") - # The caller must share at least one active group with the target node. + # The caller must share at least one active group with the target node, + # OR the node must host at least one open-join group (public groups admit + # anyone — the node's MNP handshake handles authorization). node_group_ids = set(_node_groups.get(node_id, [])) if node_group_ids: result = await db.execute( @@ -100,12 +102,19 @@ async def webrtc_offer( )) shared = [gid for (gid,) in result.all()] if not shared: - raise HTTPException(status_code=403, detail="Not a member of any group on this node") - - active = await db.execute( - select(Group.id).where(Group.id.in_(shared), Group.status == "active")) - if not active.first(): - raise HTTPException(status_code=403, detail="Group is not active") + has_open = await db.execute( + select(Group.id).where( + Group.id.in_(node_group_ids), + Group.join_policy == "open", + Group.status == "active", + )) + if not has_open.first(): + raise HTTPException(status_code=403, detail="Not a member of any group on this node") + else: + active = await db.execute( + select(Group.id).where(Group.id.in_(shared), Group.status == "active")) + if not active.first(): + raise HTTPException(status_code=403, detail="Group is not active") if _pending_per_user.get(current_user.id, 0) >= MAX_PENDING_PER_USER: raise HTTPException(status_code=429, detail="Too many pending connections") diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7b8c9d0e1f2_add_group_last_activity.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7b8c9d0e1f2_add_group_last_activity.py new file mode 100644 index 0000000..8a4e2ee --- /dev/null +++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a7b8c9d0e1f2_add_group_last_activity.py @@ -0,0 +1,28 @@ +"""add_group_last_activity_at + +Revision ID: a7b8c9d0e1f2 +Revises: f1a2b3c4d5e6 +Create Date: 2026-08-20 20:50:00.000000 + +""" +from typing import Sequence, Union + +from alembic import op +import sqlalchemy as sa + + +revision: str = 'a7b8c9d0e1f2' +down_revision: Union[str, Sequence[str], None] = 'f1a2b3c4d5e6' +branch_labels: Union[str, Sequence[str], None] = None +depends_on: Union[str, Sequence[str], None] = None + + +def upgrade() -> None: + op.add_column('groups', + sa.Column('last_activity_at', sa.DateTime(timezone=True), + server_default=sa.func.now(), nullable=False)) + op.execute("UPDATE groups SET last_activity_at = created_at") + + +def downgrade() -> None: + op.drop_column('groups', 'last_activity_at') diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py index f1f11e2..3966bdc 100644 --- a/packages/meshbay-hub/src/meshbay_hub/db/models.py +++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py @@ -103,7 +103,9 @@ class Group(Base): # group. Until then the group has no files, no key and nobody to serve it, so # it is shown to its owner only and is what `prune-groups` collects. Set once # and never cleared: a node going offline does not un-host a group. - hosted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True)) + hosted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True)) + last_activity_at: Mapped[datetime] = mapped_column( + DateTime(timezone=True), default=_now, nullable=False) members: Mapped[list["GroupMember"]] = relationship(back_populates="group") diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js index 3fdba07..50ee9f6 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/app.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js @@ -638,21 +638,23 @@ function Sidebar({ groups, presence, route, menuOpen, role, hasNodeKey }) { href="#/explore"><${Icon} name="globe" /> ${t('sidebar.public_groups')} <${Icon} name="search" /> ${t('sidebar.search')} - <${Icon} name="plus" /> ${t('sidebar.create_group')} ${platform.capabilities.nodeAdmin && hasNodeKey && html`
${t('sidebar.node')}
<${Icon} name="server" /> ${t('node.title')} + <${Icon} name="plus" /> ${t('sidebar.create_group')}
`}
${t('sidebar.my_groups')}
${groups.length === 0 ? html`
${t('sidebar.no_groups')}
` - : groups.map(g => { + : [...groups].sort((a, b) => + (b.last_activity_at || b.created_at || '').localeCompare( + a.last_activity_at || a.created_at || '')).map(g => { // Three states, each backed by something. `node_online` comes from // the hub's signaling registry and rides on the group list itself, // so there is no poll and no timer; a connection this browser tried @@ -984,7 +986,9 @@ function ExplorePage({ token, myGroupIds }) {

${t('explore.title')}

- ${t('explore.create_group')} + ${platform.node.available && html` + ${t('explore.create_group')} + `}
`; + return html`<${CreateGroupFormSimple} ...${props} />`; +} + +function CreateGroupFormSimple({ token, onCreated }) { const [name, setName] = useState(''); const [description, setDescription] = useState(''); const [joinPolicy, setJoinPolicy] = useState('invite'); @@ -1041,8 +1050,6 @@ function CreateGroupPage({ token, onCreated }) { setLoading(true); setError(''); try { - // Derived, not asked: "open" is what makes a group listed, and there is - // no third combination the server would accept. const body = { name: name.trim(), join_policy: joinPolicy, visibility: joinPolicy === 'open' ? 'public' : 'private' }; if (description.trim()) body.description = description.trim().slice(0, 512); @@ -1083,15 +1090,6 @@ function CreateGroupPage({ token, onCreated }) {
- ${/* One question, not two. Visibility and admission were separate - selectors that could only ever be set together: a public group - admits everyone by definition, and a private one that anyone may - join is a directory listing nobody can find. The server already - refused public+invite with a 422 — the form could build a request - that could not succeed. Now the answer to "who can join" settles - both, and the descriptions say what each one means for who can - *find* the group, which is the part the visibility box was there - to state and no longer needs to. */ html`

${t('create_group.join_policy')}

@@ -1115,7 +1113,6 @@ function CreateGroupPage({ token, onCreated }) {
- `} +
+ `; + } + } + + // Step 1: Group details + directories + if (step === 1) { + const canProceed = name.trim() && roots.length > 0; + return html`
+

${t('wizard.title')}

+ ${error && html`
${error}
`} + +
+
+ + setName(e.target.value)} required autofocus /> +
+ +
+ +