From dd7d9c80baafe08287516fd4d486223b5199b102 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sun, 13 Sep 2026 21:18:23 +0200 Subject: fix(hub): a node that hosts nothing is not a free target, and a private group's hosts are its members' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two checks that were not performed, in the same shape: something true of the public case, written so it did not apply to the rest. **Signaling.** The membership check read `if node_group_ids:`, so an empty set skipped it — membership, group status and the public-group gate together — and the offer was relayed. Since AV1 made an empty claim mean "no groups" rather than "all of my owner's", that is the *normal* registration of a node hosting nothing: the unconfigured node left running, the machine in this register's founding incident, and the one least able to absorb the work. Each offer makes it allocate an RTCPeerConnection and gather ICE, 30 a minute, which is H6 restored in exactly the case AV1 made common. It is refused now. Nothing legitimate is lost: such a node refuses the handshake anyway — `group_id` is mandatory (M1) and a node with no group key refuses (NS8) — so this declines work the node would decline one step later at its own expense. **The node list.** `GET /v1/groups/{id}/nodes` checked membership only for a public group with public groups switched off. A private one answered any authenticated account that knew the id — which an ex-member knows for ever — with the ids and public keys of the machines hosting it. §7.4 already stated the property for the public case. Membership is required now unless the group is public and public groups are on. Nothing needs the list before joining: an open join writes the membership row first, and an invitation registers the invitee's when the code is created, both checked before making the change. `test_webrtc_signaling_roundtrip` had to be repaired, and is the finding restated: it registered a node in `_connected_nodes` and never in `_node_groups`, so it drove the relay through the hole rather than through the door — the check it routed around was the defect. It now registers the group a real node registers. §7.2 and §7.3 gain the rules, the register AV24 and AV25, and test_availability_between_members.py two cases that fail on the property against the previous source. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01UMxEQadpzPkYLFf5CYKhpW --- packages/meshbay-hub/tests/test_hub_api.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'packages/meshbay-hub/tests/test_hub_api.py') diff --git a/packages/meshbay-hub/tests/test_hub_api.py b/packages/meshbay-hub/tests/test_hub_api.py index 5bb6af9..73f7fea 100644 --- a/packages/meshbay-hub/tests/test_hub_api.py +++ b/packages/meshbay-hub/tests/test_hub_api.py @@ -682,6 +682,17 @@ async def test_webrtc_signaling_roundtrip(client, app): fake_ws = FakeWS(node_id) _connected_nodes[node_id] = fake_ws + # The caller must share an active group with the node, which is what this + # test used to get away without: a node registered for no group skipped the + # membership check entirely, so this exercised the relay through the hole + # rather than through the door. Registering the group is what a real node + # does on its socket. + from meshbay_hub.api.revocation import _node_groups + r = await client.post("/v1/groups", json={"name": "sig-group"}, + headers={"Authorization": f"Bearer {token}"}) + assert r.status_code == 201, r.text + _node_groups[node_id] = [r.json()["group_id"]] + try: r = await client.post(f"/v1/nodes/{node_id}/webrtc/offer", json={"sdp": "v=0\r\noffer-sdp", "ice_candidates": []}, @@ -693,6 +704,7 @@ async def test_webrtc_signaling_roundtrip(client, app): assert "peer_id" in data finally: _connected_nodes.pop(node_id, None) + _node_groups.pop(node_id, None) # ── IP log cleanup (8.9) ──────────────────────────────────────────────────── -- cgit v1.2.3